Information access security control method and system

Abstract

The invention relates to the technical field of energy efficiency management, in particular to an information access security control method and system. The method comprises the following steps: performing secure physical space authorization on a target access environment, and deploying a secure environment acquisition network; performing access environment benchmark monitoring by using a secure environment acquisition network to obtain environment benchmark feature data; a user carries out real-time access environment monitoring through user terminal equipment to generate real-time access environment monitoring data; performing multi-dimensional access risk assessment on the real-time access environment monitoring data through the environment reference feature data, and performing dynamic information security access execution to obtain access control execution data; and monitoring an operation behavior of the user in real time based on the access control execution data so as to realize information access security control. According to the invention, information access in an unauthorized physical environment can be effectively prevented, and the capability of resisting position cheating, illegal invasion and potential internal threats is remarkably improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an information access security control method and system. Background Art

[0002] Existing information security access measures mainly focus on technical means such as user identity authentication, access control, and network firewalls. Although these technologies have played a certain role in preventing network attacks, data theft, and malicious tampering, they are insufficient in considering physical environment security factors. Users often access sensitive information in various complex and changing physical environments. This makes traditional security protection measures that rely solely on digital authentication and access control have obvious limitations and are difficult to effectively prevent the risk of information leakage in unauthorized physical environments. Therefore, traditional access control technology lacks the ability to monitor and analyze the user's physical environment in real time, and cannot accurately determine whether the user is in a safe access environment. Attackers can bypass identity authentication and location-based access restrictions through location spoofing technology (such as forging GPS signals) or stealing devices in unauthorized areas, directly access sensitive data, and thus illegally obtain protected information. Summary of the invention

[0003] Based on this, the present invention provides an information access security control method and system to solve at least one of the above technical problems.

[0004] To achieve the above purpose, an information access security control method includes the following steps:

[0005] Step S1: Perform secure physical space authorization on the target access environment to obtain a secure physical space; deploy a secure environment acquisition network in the secure physical space; use the secure environment acquisition network to perform access environment benchmark monitoring to obtain environmental benchmark feature data; wherein the secure environment acquisition network includes a spectrum analyzer, a wireless network card, and an electromagnetic signal receiving unit;

[0006] Step S2: obtaining user identity information; securely encrypting environmental benchmark feature data using the user identity information to obtain secure environmental benchmark data; the user initiates an information access request through a user terminal device to obtain an access trigger signal; based on the access trigger signal, the user terminal device is used to perform real-time access environment monitoring to generate real-time access environment monitoring data;

[0007] Step S3: Perform multi-dimensional access risk assessment on the real-time access environment monitoring data through the security environment benchmark data to obtain multi-dimensional access risk assessment data;

[0008] Step S4: Perform dynamic information security access execution based on the multi-dimensional access risk assessment data to obtain access control execution data; monitor the user's operation behavior in real time based on the access control execution data to achieve information access security control.

[0009] Through deploying a dedicated security environment acquisition network inside the pre-authorized secure physical space, the present invention can comprehensively and meticulously obtain the unique physical and electromagnetic characteristics of this security environment, forming reliable environmental reference characteristic data. Encrypting these reference data using the user identity information not only ensures the security of the reference data, but also binds it to a specific security environment, providing a credible reference standard for subsequent risk assessment. When a user attempts to initiate an information access request, their terminal device will immediately collect real-time access environment monitoring data of the current environment. This proactive real-time monitoring method can capture the instantaneous changes in the user's current environment, providing dynamic environmental information for subsequent security decisions. Other factors affecting access security are comprehensively considered, such as the subtle change trend of environmental characteristics, the frequency and intensity of abnormal energy fluctuations, etc. Through this multi-dimensional analysis, it is possible to more accurately determine whether the environment where the user is currently located is still secure, thereby effectively identifying potential unauthorized access risks, such as the deception behavior of an attacker attempting to simulate a security environment. The system can execute dynamic information security access control and make flexible adjustments according to the real-time environmental security status. When the evaluation result shows that the environmental security risk is low, the user can access information normally; while when an environmental anomaly or increased risk is detected, the system can immediately take corresponding security measures, such as restricting the user's access rights, performing secondary identity verification, or even interrupting the current access session. This mechanism of dynamic adjustment can effectively respond to complex and changeable security environments, avoid sensitive operations in potentially risky environments, and thus minimize the possibility of information leakage. After the environment is evaluated as secure and the user is allowed to access information, the system will still continuously monitor and analyze the user's operation behavior. By detecting whether the user's operations conform to normal behavior patterns, such as whether there are abnormal data access frequencies, unconventional file operations, etc., potential internal threats or maliciously controlled user terminals can be discovered in a timely manner. Once abnormal behavior is detected, the system can immediately issue an alarm or take further security measures, such as recording operation logs, restricting specific operations, or even locking the user account, thereby forming an additional security defense line to further enhance the security of information access. Therefore, an information access security control method of the present invention can effectively identify and prevent information access in an unauthorized physical environment through proactive environmental reference establishment, real-time environmental monitoring, multi-dimensional risk assessment, and dynamic access control and behavior monitoring, significantly enhancing the ability to resist location deception, illegal intrusion, and potential internal threats.

[0010] Preferably, the access environment baseline monitoring using the secure environment collection network in step S1 includes:

[0011] Using a spectrum analyzer to continuously collect radio frequency signals for 10 minutes at a sampling rate of 2 MS / s, and transmitting the collected raw radio frequency signals to the edge computing node through a high-speed data interface to obtain raw radio frequency sampling signals;

[0012] Performing radio frequency fingerprint feature analysis on the raw radio frequency sampling signals to obtain radio frequency fingerprint feature vectors; wherein, the radio frequency fingerprint feature analysis includes signal harmonic distortion calculation, signal zero-crossing count statistics, and carrier frequency offset estimation;

[0013] Using a wireless network card to scan for surrounding Bluetooth and Wi-Fi devices every 2 seconds, record the MAC address, signal strength, and device name for 5 minutes to obtain a raw baseline environment network list; wherein, the wireless network card supports 2.4 GHz and 5 GHz frequency bands and has concurrent scanning capabilities;

[0014] Performing trusted network filtering on the raw baseline environment network list through a preset trusted network threshold to obtain baseline environment trusted network data;

[0015] Marking a trusted device group in the secure physical space; performing low-power Bluetooth beacon broadcasting on the trusted device group, and then generating trusted device electromagnetic signal strength data according to the electromagnetic signal strength received by the electromagnetic signal receiving unit;

[0016] Calculating the average value of the trusted device electromagnetic signal strength data, and performing anchor signal association according to the trusted device group to obtain trusted anchor signal feature data;

[0017] Integrating the radio frequency fingerprint feature vectors, baseline environment trusted network data, and trusted anchor signal feature data to generate environment baseline feature data.

[0018] The present invention continuously collects radio frequency signals at a high sampling rate using a spectrum analyzer, and extracts the frequency points and their amplitudes in the radio frequency signal concentration through fast Fourier transform to form a radio frequency fingerprint feature vector with high recognition. This enables the system to perceive subtle radio frequency activity changes in the environment, effectively distinguish different physical spaces, and preliminarily identify potential malicious signals. The wireless network card periodically scans the surrounding Bluetooth and Wi-Fi devices, records key network information, constructs an original reference environment network list, and further filters it through a preset trusted network threshold to eliminate temporary or unstable network interferences, obtaining more stable and reliable reference environment trusted network data, and remaining vigilant against unknown or suspicious network connections. By collecting and calculating the average value of the signal strengths of devices in the secure physical space, it provides a reliable distance and location reference for subsequent real-time environment monitoring, effectively improving the judgment accuracy of whether the user is in the preset safe area, and helping to detect behaviors attempting to deceive by simulating the signals of trusted devices. Integrating the radio frequency fingerprint feature vector, the reference environment trusted network data, and the trusted anchor point signal feature data can more comprehensively and robustly describe the unique environmental fingerprint of the secure physical space.

[0019] Preferably, the secure encryption of the environmental reference feature data by the user identity information in step S2 includes:

[0020] Performing a hash operation on the user identity information to generate a user identity hash value;

[0021] Using a random number generator to generate a 256-bit random number, and performing an exclusive OR operation on the user identity hash value and the random number to obtain a mixed key seed;

[0022] Performing key derivation processing according to the mixed key seed to generate a user-specific encryption key;

[0023] Performing symmetric encryption on the environmental reference feature data with the user-specific encryption key to generate encrypted secure environmental reference data;

[0024] Associating the user identity information with the encrypted secure environmental reference data, and then performing secure storage to obtain secure environmental reference data.

[0025] The present invention generates a unique and fixed-length user identity hash value through hashing the user identity information, which can effectively hide the user's original identity information and prevent the direct exposure of sensitive information. A random number generator is introduced to generate a high-strength 256-bit random number, and it is XOR-operated with the user identity hash value. The generated mixed key seed has higher randomness and security. Using the user-exclusive key for encryption ensures that only the user with the corresponding identity can decrypt and use these benchmark data after authentication, effectively preventing unauthorized access and leakage. Associating the user's original identity information with the encrypted security environment benchmark data enables the system to quickly retrieve the corresponding security environment benchmark data according to the user's identity. At the same time, since the benchmark data itself has been encrypted with high strength, even if the storage medium is illegally accessed, the original environmental benchmark information cannot be directly obtained.

[0026] Preferably, the real-time security environment monitoring using the user terminal device based on the access trigger signal in step S2 includes:

[0027] Performing user identity authentication according to the access trigger signal to obtain user identity authentication data;

[0028] When the user identity authentication data is true, responding to the access trigger signal, judging the current system state of the user terminal device. When the network connection state of the user terminal device is greater than the preset transmission bandwidth threshold and the battery power is greater than 20%, an environmental detection readiness signal is obtained; otherwise, an environmental detection ability insufficient signal is generated and a prompt message is sent to the user;

[0029] Performing a detection task process according to the environmental detection readiness signal to obtain environmental detection task configuration data;

[0030] Controlling the user terminal device to perform real-time access environment monitoring based on the environmental detection task configuration data to generate real-time access environment monitoring data; the real-time access environment monitoring includes radio frequency monitoring and network environment monitoring, and the real-time access environment monitoring data includes real-time radio frequency acquisition metadata and real-time network environment data.

[0031] After the authentication of the present invention is passed, the system will further respond to the access trigger signal and perform real-time system status evaluation on the user terminal device. By judging whether the network connection status of the terminal device meets the preset transmission bandwidth threshold and whether the battery power is sufficient (greater than 20%), it can ensure that the subsequent environmental detection process has sufficient resource support and avoid the occurrence of incomplete detection data or detection interruption due to unstable network or insufficient power. When the terminal device meets the preparation conditions for environmental detection, the system will generate an environmental detection ready signal and process the detection task accordingly. The system can intelligently configure the specific parameters and strategies for environmental detection according to the current access request and device status, such as the detection frequency range, sampling duration, network scanning interval, etc. The system will control the user terminal device to perform real-time access environment monitoring based on the environmental detection task configuration data, directly obtain the latest information of the user's current environment, and obtain environmental characteristic information from different dimensions, so as to more accurately judge whether the environment where the user is currently located is safe and reliable.

[0032] Preferably, the real-time access environment monitoring data includes:

[0033] Continuously collect radio frequency signals in the access physical environment by using the built-in or external radio frequency acquisition module of the user terminal device based on the environmental detection task configuration data to obtain the original radio frequency sampling data stream;

[0034] Perform data preprocessing on the original radio frequency sampling data stream, and then perform timestamp marking to generate radio frequency time-domain sampling data;

[0035] Perform fast Fourier transform on the radio frequency time-domain sampling data to obtain real-time radio frequency spectrum data;

[0036] Calculate the real-time power spectral density according to the real-time radio frequency spectrum data;

[0037] Extract the average power value of each sub-band according to the real-time power spectral density to obtain the real-time band power distribution vector data;

[0038] Perform noise floor estimation and significant peak detection according to the real-time band power distribution vector data to generate a real-time significant radio frequency peak feature list;

[0039] Arrange the real-time significant radio frequency peak feature list in frequency order and perform radio frequency acquisition metadata integration according to the real-time band power distribution vector data to obtain real-time radio frequency acquisition metadata.

[0040] The present invention continuously collects the radio frequency signals in the physical environment currently accessed by the user through a radio frequency acquisition module built in or externally connected to the user terminal device, and can capture the dynamic changes of the environmental radio frequency signals. Necessary data preprocessing is performed on the original radio frequency sampling data stream, such as filtering, gain calibration, etc., to improve the signal quality, and an accurate timestamp is marked for each sampling point. The introduction of the timestamp enables subsequent analysis to track the time characteristics of signal changes. Performing a fast Fourier transform on the radio frequency time-domain sampling data is beneficial for identifying specific radio frequency signal characteristics. The power spectral density can more accurately reflect the energy intensity of the signal at each frequency. Extracting the average power value of each sub-band in the real-time power spectral density can more finely describe the radio frequency energy distribution characteristics in the environment. Based on the real-time frequency band power distribution vector data, noise floor estimation and significant peak detection are performed, which can more accurately identify the significant radio frequency signal peaks exceeding the noise floor. These peaks often correspond to active radio devices or potential interference sources in the environment.

[0041] Preferably, the network environment monitoring includes:

[0042] Based on the environmental detection task configuration data, call the API interfaces of Bluetooth and Wi-Fi in the user terminal device to perform active scanning for 15 seconds to obtain real-time environmental network list data;

[0043] Perform Bluetooth beacon analysis according to the real-time environmental network list data, and extract the MAC address and signal strength. When the signal strength is greater than -75 dBm, record it as a valid signal to obtain real-time Bluetooth anchor data;

[0044] Based on the environmental detection task configuration data, control the NFC module in the user terminal device to read the surrounding NFC tags at a working frequency of 13.56 MHz to obtain the NFC status data of the access device; wherein, the NFC status data of the access device includes whether NFC is enabled, whether it is in a polling state, and the device ID of the last NFC interaction;

[0045] Combine the real-time environmental network list data, the real-time Bluetooth anchor data, and the NFC status data of the access device to obtain real-time network environment data.

[0046] The present invention configures data according to environmental detection task, calls the application programming interfaces (APIs) of Bluetooth and Wi-Fi in the user terminal device, performs active scanning for 15 seconds, obtains information on detectable Bluetooth and Wi-Fi devices around, and thus constructs real-time environmental network list data. Such active scanning can promptly detect changes in surrounding network devices. Analyze the Bluetooth beacons in the obtained real-time environmental network list data, and mainly extract the MAC addresses and signal strengths of Bluetooth devices. By setting a signal strength threshold (greater than -75 dBm), filter out distant devices with weak signals, and only retain the effective signals of nearby devices with strong signals. These nearby Bluetooth devices belong to fixed or trusted devices around the user. Also, based on the environmental detection task configuration data, control the near field communication (NFC) module in the user terminal device to read surrounding NFC tags at a working frequency of 13.56 MHz, which can sense whether there are specific devices or environmental tags around the user that need to be interacted with, and helps determine whether the user is in the expected working or safe area.

[0047] Preferably, step S3 includes the following steps:

[0048] Step S31: Identify the common MAC addresses in the reference environmental trusted network data in the secure environmental reference data and the real-time environmental network list data in the real-time network environment data, and then perform a network environment matching degree score to obtain the network environment matching degree;

[0049] Step S32: Calculate the coverage rate of a single trusted anchor point for the real-time Bluetooth anchor point data in the real-time network environment data using the trusted anchor point signal feature data in the secure environmental reference data, and then perform a spatial position credibility assessment to generate the spatial position matching degree;

[0050] Step S33: Analyze abnormal interaction behaviors based on the NFC status data of the access device to obtain NFC abnormal behavior data;

[0051] Step S34: Perform an NFC security risk assessment on the NFC abnormal behavior data to generate NFC risk assessment data;

[0052] Step S35: Detect intrusion risks for the real-time radio frequency acquisition metadata through the radio frequency fingerprint feature vectors in the secure environmental reference data to generate intrusion risk assessment data;

[0053] Step S36: Perform a multi-dimensional access risk assessment based on the network environment matching degree, spatial position matching degree, NFC risk assessment data, and intrusion risk assessment data to obtain multi-dimensional access risk assessment data.

[0054] By identifying the MAC addresses that coexist in the secure environment reference data and the real-time network environment data, the present invention can quantify the similarity between the current network environment and the preset secure environment. A higher matching degree means that the network composition of the current environment is closer to the secure environment, reducing the potential risk of unauthorized network access. By analyzing whether the real-time Bluetooth signal covers the expected trusted anchor points and the degree of coverage, it is possible to more accurately determine whether the user is in the preset secure physical space, effectively preventing the user from accessing in unauthorized areas. For NFC interaction behaviors, the system will analyze the abnormal interaction behavior of the NFC status data of the access device, which helps to identify potential security risks caused by NFC spoofing attacks or user misoperations. The system will also use the pre-stored radio frequency fingerprint feature vectors to detect the intrusion risk of the real-time collected radio frequency metadata, and can detect whether there are abnormal radio frequency signal activities, such as unknown radio devices or malicious interference signals, so as to evaluate whether there are potential physical intrusion or radio frequency attack risks in the current environment.

[0055] Preferably, the intrusion risk detection of the real-time radio frequency collected metadata by the radio frequency fingerprint feature vectors in the secure environment reference data includes:

[0056] Perform spectrum difference comparison between the real-time frequency band power distribution vector data in the real-time radio frequency collected metadata and the radio frequency fingerprint feature vectors to generate a spectrum difference metric value;

[0057] Perform temporal stability analysis on the spectrum difference metric value to obtain a frequency band fluctuation stability coefficient;

[0058] Based on the frequency band fluctuation stability coefficient, perform abnormal high-power frequency point detection on the real-time significant radio frequency peak feature list in the real-time radio frequency collected metadata to obtain abnormal frequency point detection data;

[0059] Match the abnormal frequency point detection data with known interference sources through a preset interference signal feature library. When it cannot be identified as a known interference source, it is determined as a potential intrusion signal;

[0060] Perform abnormal peak correlation analysis on the potential intrusion signal, and then perform intrusion type identification to generate intrusion type risk assessment data.

[0061] By comparing the real-time frequency band power distribution vector data with the pre-established RF fingerprint feature vector, the present invention can quantify the degree of deviation between the overall RF spectrum of the current environment and the reference spectrum of the safe environment, and preliminarily judge whether there is abnormal RF activity. By analyzing the temporal trend of the spectrum difference, it is possible to judge whether the RF characteristics of the current environment are stable. The violent fluctuations reveal that the environment has undergone unexpected changes or there are interference sources. By identifying the frequency points beyond the normal power range, the strong signal interference source or potential illegal transmitting device in the environment can be quickly located. The detected abnormal frequency points are matched using the preset interference signal feature library. If it can be identified as a known, non-threatening interference source (such as a normal Bluetooth or Wi-Fi signal), the risk is eliminated. For abnormal frequency points that cannot be identified as known interference sources, they are determined to be potential intrusion signals, and more in-depth analysis is required. By analyzing the frequency, bandwidth, power, modulation mode and other characteristics of the abnormal signal, and comparing it with various known intrusion signal types (such as malicious interference, illegal monitoring equipment, etc.), the nature and level of the potential threat can be more accurately judged.

[0062] Preferably, step S4 comprises the following steps:

[0063] Step S41: Calculate the threat probability distribution based on the multi-dimensional access risk assessment data to generate the user's current access risk level;

[0064] Step S42: based on the user's current access risk level and the multi-dimensional access risk assessment data, searching for a corresponding access control policy from a predefined risk level-access control mapping table to obtain an initial access control policy;

[0065] Step S43: extracting specific permission items according to the initial access control policy to obtain a dynamic permission item list;

[0066] Step S44: Associating the dynamic permission item list with the access request and updating the user access session status;

[0067] Step S45: Perform information security access execution on the user based on the user access session status to obtain access control execution data;

[0068] Step S46: Based on the access control execution data, the user operation behavior is monitored in real time during the information access process. When the user has illegal operation behavior, the operation is immediately blocked, the corresponding dynamic permission item is deleted, and the user access session status is reinitialized to achieve information access security control.

[0069] The present invention calculates the threat probability distribution based on multi-dimensional access risk assessment data, which can clearly reflect the security status of the current environment. According to the calculated current access risk level of the user and the detailed multi-dimensional access risk assessment data, it ensures that users with different risk levels have matching initial access permissions, achieving a preliminary risk-based permission allocation. According to the initial access control policy, it accurately determines the operations that the user is currently allowed to perform, realizing the minimization and refinement management of permissions. During the information access process, the system will perform specific security access control based on the user's access session status, such as allowing reading of specific files and prohibiting modification of sensitive data. This access control based on dynamic permissions can effectively limit the scope of the user's operations and reduce the security risks caused by illegal or unauthorized operations. During the information access process, it monitors the user's operation behavior in real time. Once it detects that the user has a violation operation behavior, the system will immediately block the operation, delete the corresponding dynamic permission item, and re-initialize the user's access session status. This real-time monitoring and handling mechanism for violation behaviors can timely discover and prevent potential security threats, continuously ensuring the security of the information system even after the user has passed the preliminary risk assessment and obtained access permissions, forming a dynamic security barrier. Through this proactive monitoring and response, the system can effectively prevent security risks brought by internal threats and user misoperations, ensuring the security and controllability of the information access process.

[0070] Preferably, the present invention also provides an information access security control system that executes the information access security control method as described above. The information access security control system includes:

[0071] An environmental benchmark collection module, which is used to authorize the secure physical space of the target access environment to obtain the secure physical space; deploy a secure environment collection network in the secure physical space; use the secure environment collection network to monitor the access environment benchmark and obtain environmental benchmark feature data; wherein, the secure environment collection network includes a spectrum analyzer, a wireless network card, and an electromagnetic signal receiving unit;

[0072] An access environment monitoring module, which obtains the user identity information; secures and encrypts the environmental benchmark feature data through the user identity information to obtain secure environmental benchmark data; the user initiates an information access request through the user terminal device to obtain an access trigger signal; based on the access trigger signal, it uses the user terminal device to perform real-time access environment monitoring and generates real-time access environment monitoring data;

[0073] A multi-dimensional risk assessment module, which is used to perform multi-dimensional access risk assessment on the real-time access environment monitoring data through the secure environmental benchmark data to obtain multi-dimensional access risk assessment data;

[0074] A dynamic access control module is used to perform dynamic information security access execution according to multi-dimensional access risk assessment data to obtain access control execution data, and to monitor the operation behavior of users in real time based on the access control execution data to achieve information access security control. Brief Description of the Drawings

[0075] Figure 1 It is a schematic flow chart of the steps of a method for information access security control according to the present invention;

[0076] Figure 2 For Figure 1 It is a schematic detailed implementation step flow chart of step S3 in

[0077] The realization, functional features and advantages of the object of the present invention will be further described in conjunction with the embodiments with reference to the drawings. Detailed Embodiments

[0078] The technical method of the present invention will be clearly and completely described below with reference to the drawings. Obviously, the described embodiments are some but not all of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the scope of protection of the present invention.

[0079] In addition, the drawings are only schematic diagrams of the present invention and are not necessarily drawn to scale. The same reference numerals in the drawings represent the same or similar parts, and thus repeated descriptions thereof will be omitted. Some of the block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. The functional entities can be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor methods and / or microcontroller methods.

[0080] It should be understood that although the terms "first", "second", etc. may be used herein to describe various units, these units should not be limited by these terms. These terms are only used to distinguish one unit from another. For example, without departing from the scope of the exemplary embodiments, the first unit may be referred to as the second unit, and similarly the second unit may be referred to as the first unit. The term "and / or" used herein includes any and all combinations of one or more of the listed related items.

[0081] To achieve the above object, please refer to Figures 1 to 2 , the present invention provides a method for information access security control, including the following steps:

[0082] Step S1: Perform security physical space authorization on the target access environment to obtain a secure physical space; deploy a secure environment collection network in the secure physical space; use the secure environment collection network to perform access environment baseline monitoring to obtain environmental baseline feature data; wherein, the secure environment collection network includes a spectrum analyzer, a wireless network card, and an electromagnetic signal receiving unit;

[0083] Step S2: Obtain user identity information; perform secure encryption on the environmental baseline feature data through the user identity information to obtain secure environmental baseline data; the user initiates an information access request through the user terminal device to obtain an access trigger signal; based on the access trigger signal, use the user terminal device to perform real-time access environment monitoring to generate real-time access environment monitoring data;

[0084] Step S3: Perform multi-dimensional access risk assessment on the real-time access environment monitoring data through the secure environmental baseline data to obtain multi-dimensional access risk assessment data;

[0085] Step S4: Perform dynamic information security access execution according to the multi-dimensional access risk assessment data to obtain access control execution data; based on the access control execution data, monitor the user's operation behavior in real time to achieve information access security control.

[0086] In the embodiment of the present invention, the information access security control method includes the following steps:

[0087] Step S1: Perform security physical space authorization on the target access environment to obtain a secure physical space; deploy a secure environment collection network in the secure physical space; use the secure environment collection network to perform access environment baseline monitoring to obtain environmental baseline feature data; wherein, the secure environment collection network includes a spectrum analyzer, a wireless network card, and an electromagnetic signal receiving unit;

[0088] In the embodiments of the present invention, for a specific area where information access security control needs to be implemented, such as a server computer room, a confidential document storage room, or a classified meeting room, the user delimits the physical boundary of the area according to the organization's security policies and physical security standards. The delimitation of the physical boundary can be clearly defined by means of physical fences, access control systems, the coverage range of surveillance cameras, etc. Subsequently, the administrator creates a secure physical space object corresponding to the physical area in the security management system and assigns a unique identifier to the secure physical space. For this secure physical space, for example, a secure environment acquisition network is deployed inside an electronic document reading room. The network includes a spectrum analyzer with a fixed sampling rate set to 2 MS / s, continuously and uninterruptedly collecting indoor radio frequency signals for 600 seconds to generate an original radio frequency sampling signal file. Perform a fast Fourier transform on the original radio frequency sampling signal, extract the top 20 frequency points with the largest amplitudes in the spectrum and their corresponding amplitude values, form a radio frequency fingerprint feature vector, and store it in a list form, with each element containing accurate frequency values and amplitude values. At the same time, use a computer equipped with an Intel AX200 wireless network card to scan the surrounding Bluetooth and Wi-Fi devices every 2 seconds for 300 seconds, record the MAC addresses, received signal strength indicators (RSSIs), and broadcast device names of all detected devices, and form an original reference environment network list. Filter the original list through a preset list of trusted network MAC addresses, and only retain the device records whose MAC addresses match the trusted list to obtain the trusted network data for the reference environment. Three fixed trusted device groups are preset in the reading room, each group contains three low-power Bluetooth beacons, configured with the same broadcast frequency and power, and broadcasting unique device identifiers. Use a handheld spectrum analyzer with a directional antenna to receive the Bluetooth signals broadcast by each trusted device group at five preset anchor points in the reading room, and record the signal strength (RSSI value) of each beacon at each anchor point. Calculate the average value of the signal strengths received by each trusted device group at all anchor points, and associate the average value with the corresponding trusted device group identifier and anchor point location to generate trusted anchor point signal feature data, which is stored in a table. Finally, integrate the radio frequency fingerprint feature vector, the trusted network data for the reference environment, and the trusted anchor point signal feature data into an environmental reference feature data file.

[0089] Step S2: Obtain user identity information; perform security encryption on the environmental reference feature data through the user identity information to obtain secure environmental reference data; the user initiates an information access request through the user terminal device to obtain an access trigger signal; based on the access trigger signal, use the user terminal device to perform real-time access environment monitoring to generate real-time access environment monitoring data;

[0090] In an embodiment of the present invention, the work ID provided by a user attempting to enter the reading room to consult documents is obtained as the user identity information. The SHA-256 algorithm is used to perform a hash operation on the work ID to generate a 256-bit user identity hash value. A cryptographically secure pseudo-random number generator is called to generate a 256-bit random number, and the user identity hash value is subjected to a bitwise exclusive OR operation with the random number to obtain a 256-bit mixed key seed. Using the HMAC-SHA-256 key derivation function, with a preset fixed salt value as an aid, the mixed key seed is processed to derive a 256-bit user-specific AES-256 encryption key. The Galois / Counter Mode (GCM) of the AES-256 algorithm is selected, and a random 128-bit random number is generated. Using the derived user-specific encryption key and the generated random number, the previously generated environmental benchmark feature data JSON file is symmetrically encrypted to generate encrypted secure environmental benchmark data, including ciphertext, random number, and authentication tag. The user's work ID is associated with the encrypted secure environmental benchmark data (ciphertext, random number, authentication tag) in the database and securely stored to form the final secure environmental benchmark data. When a user with a work permit swipes the card at the entrance of the reading room, the system generates an information access request, triggering an access trigger signal. After receiving the signal, the user terminal device (such as the user's tablet computer, pre-installed with a secure access control application) first prompts the user to authenticate their identity through fingerprint. After the user successfully completes the fingerprint authentication, the user terminal device sends a message indicating successful verification to the background authentication server. The server compares the fingerprint features with the pre-registered template. After successful verification, the user identity authentication data is generated as true. The user terminal device then checks its own network connection status and obtains the current Wi-Fi downlink transmission rate (e.g., obtained through the operating system API). At the same time, the current battery power percentage of the device is obtained (e.g., obtained through the operating system API). If the Wi-Fi downlink transmission rate is greater than the preset 10 Mbps and the battery power is greater than 20%, the user terminal device generates an environmental detection readiness signal. Otherwise, an environmental detection capability insufficient signal is generated, and a prompt message is displayed on the tablet computer screen: "The current network is unstable or the battery power is insufficient. Please try again later." After receiving the environmental detection readiness signal, the background system sends environmental detection task configuration data to the user terminal device. This data specifies in JSON format that the sampling frequency of radio frequency monitoring is 2 MS / s, the duration is 5 seconds, and the scanning frequency band is the 2.4 GHz ISM band; the network environment monitoring scans Wi-Fi and Bluetooth, the scanning interval is 2 seconds, and the MAC address, RSSI, and device name are recorded; at the same time, it instructs the NFC module to read the NFC tag at a frequency of 13.56 MHz. The user terminal device, according to this configuration data, calls its built-in radio frequency acquisition module to continuously acquire radio frequency signals in the 2.4 GHz band for 5 seconds to obtain the original radio frequency sampling data stream.Preprocess the data stream by removing the DC component and normalizing the amplitude, and add an accurate timestamp to each sampling point to generate RF time-domain sampling data. Perform a fast Fourier transform on the RF time-domain sampling data to obtain real-time RF spectrum data, and calculate the real-time power spectral density. Calculate the average power value of each sub-band according to the preset frequency band division scheme to obtain real-time frequency band power distribution vector data. Perform noise floor estimation and significant peak detection to generate a list of real-time significant RF peak features, and arrange them in frequency order. Integrate this list with information such as real-time frequency band power distribution vector data, acquisition timestamp, sampling frequency, and duration to form real-time RF acquisition metadata. At the same time, the user terminal device calls the API interfaces of Bluetooth and Wi-Fi to actively scan for 15 seconds, record the MAC addresses, RSSIs, and device names of all scanned devices to obtain real-time environmental network list data. Analyze the Bluetooth devices in the real-time environmental network list, extract the MAC addresses and signal strengths, and record them as real-time Bluetooth anchor data when the signal strength is greater than -75 dBm and the MAC address matches the preset list of beacon MAC addresses in the reading room. The user terminal device enables the NFC module to poll the surrounding NFC tags at a frequency of 13.56 MHz to obtain whether NFC is enabled, whether it is in the polling state, and the device ID of the last NFC interaction to obtain access device NFC status data. Finally, combine the real-time environmental network list data, real-time Bluetooth anchor data, and access device NFC status data to obtain real-time network environment data.

[0091] Step S3: Perform a multi-dimensional access risk assessment on the real-time access environment monitoring data through the secure environment benchmark data to obtain multi-dimensional access risk assessment data;

[0092] In the embodiments of the present invention, after receiving the real-time access environment monitoring data sent by the user terminal device, the system first extracts the security environment reference data associated with the current user's job number (which needs to be decrypted using the user's exclusive decryption key, but in this risk assessment stage, we directly use the unencrypted reference data for comparison to illustrate the principle). By comparing the reference environment trusted network data and the real-time environment network list data, identifying the common MAC addresses, calculating the ratio of the number of matching trusted devices to the total number of reference trusted devices, the network environment matching degree is obtained. Using the average signal strength of the beacons recorded in the reference environment trusted anchor signal feature data at different positions, comparing the beacons and their signal strengths detected in the real-time Bluetooth anchor data, calculating the single trusted anchor coverage rate, and performing trilateration to estimate the current position of the user terminal device, determining whether it is located within the preset safe area of the reading room, and generating the spatial position matching degree (for example, if it is within the safe area, the matching degree is high, otherwise it is low). Analyzing the NFC status data of the access device, if the NFC is in an unexpected on or polling state, or interacts with an unknown NFC tag, NFC abnormal behavior data including the abnormal type and the device ID involved is generated. According to the NFC abnormal behavior data, the predefined risk rules are matched, the risk level of the NFC interaction is evaluated, and the NFC risk assessment data is generated (for example, high risk indicates detecting an interaction with an unknown high-privilege tag). Comparing the real-time frequency band power distribution vector data in the real-time radio frequency acquisition metadata with the reference radio frequency fingerprint feature vector, calculating the spectrum difference metric value. Analyzing the temporal stability of this metric value, the frequency band fluctuation stability coefficient is obtained. Based on this coefficient, abnormal high-power frequency point detection is performed on the real-time significant radio frequency peak feature list, and the abnormal frequency point data is obtained. Matching the abnormal frequency point data with the preset interference signal feature library, if it cannot be identified as a known interference source, it is determined as a potential intrusion signal. Analyzing the characteristics such as the frequency, bandwidth, and power of the potential intrusion signal, identifying the intrusion type, and generating the intrusion type risk assessment data including the risk level. Finally, according to the preset weights, a weighted calculation is performed on the network environment matching degree, the spatial position matching degree, the NFC risk assessment data, and the intrusion risk assessment data to obtain a multi-dimensional access risk score.

[0093] Step S4: Perform dynamic information security access execution according to the multi-dimensional access risk assessment data to obtain access control execution data; based on the access control execution data, monitor the operation behavior of the user in real time to achieve information access security control.

[0094] In an embodiment of the present invention, based on the multi-dimensional access risk assessment data (such as "medium risk") generated in step S3, the system searches for a predefined risk level - access control mapping table. Suppose the initial access control policy corresponding to the medium risk level is "allow access to non-confidential documents, prohibit file downloading and copying, and restrict network communication". According to this initial policy, query the permission management system to extract the user's "read" permission for non-confidential electronic documents in the reading room, but do not grant permissions such as "modify", "delete", "copy", "download", etc. At the same time, restrict the direct connection of the user's terminal device to the external network and only allow limited communication through a controlled internal server. These specific permission operations are added to the user's dynamic permission item list. Each file access request of the user is compared with this dynamic permission item list, and only operations that meet the list regulations are allowed to be executed. The access session status of the user is updated to record the currently effective dynamic permission items. During the process of the user accessing the file, the system monitors the user's operation behavior in real time. For example, if the user attempts to click the "download" button or use the copy and paste function, the monitoring module will detect that this operation does not conform to the restrictions in the dynamic permission item list, immediately block the operation, and pop up a warning message. If the user attempts to establish a network connection with an external IP address, it will also be blocked by the firewall policy. If the monitoring system detects that the user attempts to bypass the permission control, perform frequent illegal operations, or trigger a higher-level security warning (such as attempting to access top-secret documents), the system will immediately block the user's current operation, delete all dynamic permission items in its session, and force the user to re-authenticate and conduct an environmental risk assessment to achieve more strict information access security control.

[0095] Preferably, the use of the security environment acquisition network for access environment baseline monitoring in step S1 includes:

[0096] Use a spectrum analyzer to continuously collect radio frequency signals for 10 minutes at a sampling rate of 2MS / s, and transmit the collected raw radio frequency signals to the edge computing node through a high-speed data interface to obtain raw radio frequency sampling signals;

[0097] Perform radio frequency fingerprint feature analysis on the raw radio frequency sampling signals to obtain radio frequency fingerprint feature vectors; among them, the radio frequency fingerprint feature analysis includes signal harmonic distortion calculation, signal zero-crossing count statistics, and carrier frequency offset estimation;

[0098] Use a wireless network card to scan for surrounding Bluetooth and Wi-Fi devices every 2 seconds, record the MAC address, signal strength, and device name for 5 minutes to obtain a raw baseline environment network list;

[0099] Perform trusted network filtering on the raw baseline environment network list through a preset trusted network threshold to obtain baseline environment trusted network data;

[0100] Mark a trusted device group for a secure physical space; perform low - power Bluetooth beacon broadcasting for the trusted device group, and then generate trusted device electromagnetic signal strength data based on the electromagnetic signal intensity received by the electromagnetic signal receiving unit;

[0101] Calculate the average value of the trusted device electromagnetic signal strength data, and perform anchor signal association according to the trusted device group to obtain trusted anchor signal feature data;

[0102] Integrate the radio frequency fingerprint feature vector, the reference environment trusted network data, and the trusted anchor signal feature data to generate environmental reference feature data.

[0103] In an embodiment of the present invention, the spectrum analyzer model is selected as Agilent N9020B, and its configuration ensures a real-time sampling rate of 2 MS / s or higher. Start the spectrum analyzer, set the center frequency to cover the common wireless communication frequency bands within the target secure physical space (such as the 2.4 GHz and 5 GHz ISM bands), set the bandwidth to a range sufficient to capture the target signal, and set the resolution bandwidth to 10 kHz to balance frequency resolution and scanning speed. The spectrum analyzer operates in continuous scan mode, and the sampling duration is precisely set to 600 seconds. Using the built-in fast Fourier transform (FFT) algorithm module, perform spectrum analysis on this time-domain signal to obtain the frequency-domain signal. The number of points for the FFT operation is determined according to the sampling rate and sampling time to ensure that the frequency resolution meets the requirements. Analyze the amplitude spectrum of the frequency-domain signal, and automatically identify the 20 frequency points with the largest amplitudes through a preset peak search algorithm. Record the exact frequency values and corresponding amplitude values of these 20 frequency points. Use the wireless network scanning tool provided by the operating system or a third-party network analysis tool (such as Wireshark) to set the wireless network card to promiscuous mode. Trigger the wireless network card to scan for surrounding wireless signals at a fixed interval of 2 seconds. Each scan operation records the MAC addresses, received signal strength indication (RSSI) values, and broadcast device names (if any) of all detected Bluetooth devices. Similarly, record the MAC addresses (BSSIDs), RSSI values, and service set identifiers (SSIDs) of all scanned Wi-Fi access points (APs). This scanning process lasts for 300 seconds to form an original reference environment network list containing multiple scan results. Each record in the list contains the scan timestamp, device type (Bluetooth / Wi-Fi), MAC address, signal strength, and device name (if any). The system is pre-configured with a trusted network threshold, which includes a series of MAC address prefixes or complete MAC addresses of Bluetooth and Wi-Fi devices considered to be legally present within the target secure physical space. For each record in the original reference environment network list, extract its MAC address and compare it with the preset trusted network threshold. If the MAC address matches any entry in the trusted threshold, that record is determined to be trusted network data. Create a new list that only contains the records of trusted network devices, and this list is the reference environment trusted network data. Mark several predetermined fixed positions within the target secure physical space as trusted device groups. Each trusted device group deploys at least three beacon devices that support low-power Bluetooth broadcast functions. The beacon device model is selected as Texas Instruments CC2640R2F. These beacon devices are configured to periodically broadcast low-power Bluetooth signals containing unique identifiers at the same broadcast frequency and power.In the environmental baseline monitoring stage, a portable electromagnetic signal receiving unit, such as a handheld spectrum analyzer combined with a directional antenna, is used to receive the low-power Bluetooth signals broadcast by each trusted device group at several preset positions (serving as anchor positions) within the target secure physical space. The received signal strength indication (RSSI) values from each beacon device in each trusted device group are recorded at each anchor position. For each trusted device group, the arithmetic mean of the signal strength values received at all its anchor positions is calculated, and each trusted device group is associated with its corresponding average electromagnetic signal strength data and the anchor positions to generate trusted anchor signal feature data. These three parts of data are stored in a JSON file, where the radio frequency fingerprint feature vector is stored as an array, the baseline environment trusted network data is stored as a list, each element in the list is a dictionary containing the MAC address, RSSI, and device name, and the trusted anchor signal feature data is stored as a dictionary with the MAC address of the beacon device as the key and the corresponding average RSSI value as the value.

[0104] Particularly importantly, the radio frequency fingerprint feature analysis specifically includes:

[0105] The original radio frequency sampling signal is segmented into sampling frames to obtain radio frequency sampling frame data;

[0106] Based on the radio frequency sampling frame data, the radio frequency instantaneous amplitude, phase, and frequency are calculated to obtain an instantaneous radio frequency feature data frame;

[0107] Based on the radio frequency sampling frame data, signal harmonic distortion and signal intermodulation product distortion analyses are performed to obtain non-linear signal feature data;

[0108] Based on the radio frequency sampling frame data, the number of times the signal crosses the zero level is calculated to obtain the radio frequency signal zero-crossing rate; based on the radio frequency sampling frame data, the slopes and times of the rising and falling edges of the signal are analyzed to obtain the signal rise-fall time;

[0109] Based on the radio frequency sampling frame data, carrier frequency offset estimation is performed to obtain carrier frequency offset data;

[0110] The instantaneous radio frequency feature data frame, non-linear signal feature data, radio frequency signal zero-crossing rate, signal rise-fall time, and carrier frequency offset data are statistically analyzed across frames to obtain a radio frequency fingerprint feature vector.

[0111] In the embodiments of the present invention, for each frame of radio frequency sampling frame data, the instantaneous amplitude, phase, and frequency of the radio frequency signal are calculated using Hilbert transform. The calculated instantaneous amplitude, phase, and frequency are stored in a vector to form an instantaneous radio frequency feature data frame. Fast Fourier transform (FFT) is performed on each frame of radio frequency sampling frame data to obtain the spectrum of the signal. The amplitude and phase of the harmonic components in the spectrum are analyzed to calculate the harmonic distortion of the signal, such as total harmonic distortion (THD). At the same time, the amplitude and phase of the intermodulation product components in the spectrum are analyzed to calculate the intermodulation product distortion of the signal, such as third-order intermodulation intercept point (IP3). For each frame of radio frequency sampling frame data, the total number of zero-crossing events occurring within a radio frequency sampling frame is counted, and then this number is divided by the time length of the frame to obtain the zero-crossing rate of the radio frequency signal of this frame, with the unit of number / second. The envelope of the signal is identified in each radio frequency sampling frame. The envelope can be obtained by calculating the instantaneous amplitude of the signal. Then, local maxima and local minima are searched for in the envelope, and these points correspond to the peaks and valleys of the signal. The rising edge is defined as the process of the signal amplitude rising from the valley to the peak, and the falling edge is defined as the process of the signal amplitude falling from the peak to the valley. The time length (the time elapsed from the valley to the peak) and the amount of amplitude change of each rising edge are measured, and the average slope of the rising edge (amount of amplitude change / time length) is calculated. Similarly, the time length and the amount of amplitude change of each falling edge are measured, and the average slope of the falling edge is calculated. For each frame of radio frequency sampling frame data, a frequency offset estimation algorithm, such as an FFT-based frequency offset estimation algorithm or a phase-locked loop-based frequency offset estimation algorithm, is used to estimate the carrier frequency offset of the signal. The estimated carrier frequency offset value is stored in the carrier frequency offset data. Cross-frame statistics are performed on the instantaneous radio frequency feature data frames, non-linear signal feature data, radio frequency signal zero-crossing rate, signal rise-fall time, and carrier frequency offset data of all frames. For example, statistical features such as the mean, variance, maximum value, and minimum value of the amplitude, phase, and frequency in each frame of instantaneous radio frequency feature data frame are calculated; the mean and variance of the non-linear signal feature data are calculated; the mean and variance of the radio frequency signal zero-crossing rate, signal rise-fall time, and carrier frequency offset are calculated. All the calculated statistical features are combined into a vector, that is, the radio frequency fingerprint feature vector.

[0112] Preferably, the secure encryption of the environmental reference feature data by the user identity information in step S2 includes:

[0113] Perform a hash operation on the user identity information to generate a user identity hash value;

[0114] Use a random number generator to generate a 256-bit random number, and perform an exclusive OR operation on the user identity hash value and the random number to obtain a mixed key seed;

[0115] Perform key derivation processing according to the mixed key seed to generate a user-specific encryption key;

[0116] Symmetrically encrypt the environmental benchmark feature data with the user-specific encryption key to generate encrypted secure environmental benchmark data;

[0117] Associate the user identity information with the encrypted secure environmental benchmark data and then perform secure storage to obtain secure environmental benchmark data.

[0118] In an embodiment of the present invention, the original identity information provided by a user for information access control is obtained. The identity information may include a user ID, an employee number, or other strings that can uniquely identify the user's identity. The original identity information is subjected to a one-way encryption operation using a hash algorithm that conforms to the SHA-256 standard. Specifically, the original identity information is used as the input of the SHA-256 algorithm, and through a series of complex bit operations (including exclusive OR, AND, shift, addition, etc.) and table look-up operations, a hash value with a fixed length of 256 bits is generated. This hash value is irreversible, that is, it is impossible to reverse-derive the original identity information from the hash value, and for the same input, the same output is always produced. For a slight change in the input, the output will be significantly different. Call the cryptographically secure pseudo-random number generator (CSPRNG) built into the system, such as a hardware-based random number generator or a generator implemented by an algorithm that has undergone strict cryptographic analysis, to generate a random number with a length of 256 bits. This random number is represented in binary form. Obtain the user identity hash value (in 256-bit binary form) generated in the previous step. Perform a bitwise exclusive OR (XOR) operation on the 256-bit user identity hash value and the generated 256-bit random number. The rule of the exclusive OR operation is: if the two input bits are the same, the output is 0; if the two input bits are different, the output is 1. After the bitwise exclusive OR operation, a new 256-bit binary number is obtained, and this value is used as the mixed key seed. Define a fixed salt value, which is a pre-set non-random string used to increase the security of key derivation and prevent rainbow table attacks. Use this salt value and the mixed key seed together as the input of the HMAC-SHA-256 algorithm. The HMAC-SHA-256 algorithm uses the SHA-256 hash function and the key (here the mixed key seed) to generate a message authentication code (MAC). Use the first 256 bits of this MAC as the derived user-specific encryption key. The iteration count of the key derivation function is set to one to meet the current security requirements. The finally obtained user-specific encryption key is a 256-bit binary string, which is used for the symmetric encryption algorithm. Use the derived 256-bit user-specific encryption key as the key of the AES-256 algorithm. Select the cipher block chaining (CBC) mode or the Galois / counter mode (GCM) as the operating mode of AES, and generate a random initialization vector (IV) (for the CBC mode) or a random nonce (for the GCM mode). Use the AES-256 encryption algorithm to encrypt the environmental benchmark feature data with the user-specific encryption key and the generated IV / nonce. Establish an association between the user's original identity information and the encrypted secure environmental benchmark data. The association method may be to create a record in the database, which contains the user identity information as an index and the corresponding encrypted secure environmental benchmark data (ciphertext, IV / nonce, authentication tag).Alternatively, the encrypted data file can be stored with the user's identity information as part of the file name. Select a storage medium or database system with data encryption capabilities for secure storage to ensure that even if the storage medium is accessed without authorization, the original environmental benchmark feature data cannot be directly obtained because the data is stored in encrypted form and can only be decrypted with the correct user-specific decryption key. The correspondence between the user identity information and the encrypted data needs to be recorded during the storage process so that the corresponding encrypted secure environmental benchmark data can be retrieved based on the user identity during the subsequent information access control process.

[0119] Preferably, the real-time secure environment monitoring using the user terminal device based on the access trigger signal in step S2 includes:

[0120] Perform user identity authentication based on the access trigger signal to obtain user identity authentication data;

[0121] When the user identity authentication data is true, respond to the access trigger signal, judge the current system state of the user terminal device. When the network connection state of the user terminal device is greater than the preset transmission bandwidth threshold and the battery power is greater than 20%, obtain an environmental detection readiness signal; otherwise, generate an environmental detection capability insufficient signal and send a prompt message to the user;

[0122] Perform detection task processing based on the environmental detection readiness signal to obtain environmental detection task configuration data;

[0123] Control the user terminal device to perform real-time access environment monitoring based on the environmental detection task configuration data, and generate real-time access environment monitoring data; the real-time access environment monitoring includes radio frequency monitoring and network environment monitoring, and the real-time access environment monitoring data includes real-time radio frequency acquisition metadata and real-time network environment data.

[0124] In an embodiment of the present invention, when a user attempts to access a protected information resource, the system generates an access trigger signal. After receiving this signal, the user terminal device prompts the user to input an identity credential, which can include the user ID and the corresponding password, biometric information (such as fingerprint or facial recognition data), or a one-time password generated by a security token. After the user inputs or provides the identity credential on the terminal device, the terminal device sends the credential to the authentication server through a secure channel. After receiving the user credential, the authentication server first retrieves the stored user registration information and then performs corresponding verification operations according to the received credential type. For example, for password verification, the server compares the received password with the stored hash value; for biometric verification, the server extracts features from the received biometric data and matches them with the registered template; for token verification, the server verifies whether the received one-time password is consistent with the valid password generated within the current time window. The verification result generates user authentication data, which is a boolean value indicating whether the user authentication is successful or failed. When the user authentication data is true, the system responds to the access trigger signal and initiates an inspection of the current system state of the user terminal device. First, the current network connection status of the user terminal device is detected. Specifically, the type of the current network connection (such as Wi-Fi, cellular data) and the real-time uplink and downlink transmission rates are obtained through the API provided by the operating system. The obtained real-time downlink transmission rate is compared with a preset transmission bandwidth threshold (such as 10 Mbps). At the same time, the current battery power percentage of the user terminal device is obtained through the operating system API and compared with a preset battery power threshold (such as 20%). Only when the downlink transmission rate of the network connection of the user terminal device is greater than or equal to the preset transmission bandwidth threshold and the battery power is greater than the preset battery power threshold, the system generates an environmental detection ready signal, indicating that the terminal device has the ability to perform the environmental detection task. If any condition is not met, an environmental detection ability insufficient signal is generated, and a prompt message is sent to the user through the display interface of the user terminal device, informing the user that the current network connection is unstable or the battery power is too low, and suggesting that the user connect to a more stable network or charge before attempting to access again. After receiving the environmental detection ready signal, the system generates environmental detection task configuration data for guiding the user terminal device to perform real-time environmental monitoring. This configuration data includes the following information: the sampling frequency of radio frequency monitoring (such as 2 MS / s), the duration of radio frequency monitoring (such as 5 seconds), the frequency band range to be scanned for radio frequency monitoring (such as the 2.4 GHz ISM band), the types of wireless networks to be scanned for network environment monitoring (such as Wi-Fi and Bluetooth), the interval time of network scanning (such as scanning once every 2 seconds), and the network information fields to be recorded (such as MAC address, signal strength, device name).The configuration data is transmitted to the user terminal device in the form of structured data (such as JSON or XML). After receiving the environmental detection task configuration data, the user terminal device starts real-time access to environmental monitoring according to the configuration information. For radio frequency monitoring, the terminal device calls its built-in wireless communication module, collects radio frequency signals in the surrounding environment at the sampling frequency and duration specified in the configuration data, converts the collected analog signals into digital signals, and stores them as real-time radio frequency sampling data. Then, perform fast Fourier transform processing on the real-time radio frequency sampling data, extract the spectrum information, and record the current acquisition timestamp and spectrum data to form real-time radio frequency acquisition metadata. For network environment monitoring, the terminal device uses its Wi-Fi and Bluetooth modules to scan the surrounding Wi-Fi access points and Bluetooth devices at the scan interval specified in the configuration data, record the MAC address (BSSID), signal strength (RSSI), service set identifier (SSID) of each scanned Wi-Fi access point, and the MAC address, signal strength (RSSI), and device name (if available) of each scanned Bluetooth device. Each scan result is attached with the current timestamp, and the results of multiple scans are aggregated to form real-time network environment data.

[0125] Preferably, the real-time access environmental monitoring data includes:

[0126] Continuously collect radio frequency signals in the accessed physical environment by using the built-in or external radio frequency acquisition module of the user terminal device based on the environmental detection task configuration data to obtain the original radio frequency sampling data stream;

[0127] Perform data preprocessing on the original radio frequency sampling data stream, and then perform timestamp marking to generate radio frequency time-domain sampling data;

[0128] Perform fast Fourier transform on the radio frequency time-domain sampling data to obtain real-time radio frequency spectrum data;

[0129] Calculate the real-time power spectral density according to the real-time radio frequency spectrum data;

[0130] Extract the average power value of each sub-band according to the real-time power spectral density to obtain real-time band power distribution vector data;

[0131] Perform noise floor estimation and significant peak detection according to the real-time band power distribution vector data to generate a real-time significant radio frequency peak feature list;

[0132] Arrange the real-time significant radio frequency peak feature list in frequency order, and perform radio frequency acquisition metadata integration according to the real-time band power distribution vector data to obtain real-time radio frequency acquisition metadata.

[0133] In an embodiment of the present invention, the user terminal device activates the built-in or USB interface-connected radio frequency acquisition module according to the received environmental detection task configuration data. The radio frequency acquisition module has the ability to continuously collect signals at a configured sampling frequency (e.g., 2MS / s) within a specified frequency band range. The acquisition process lasts for a preset time length (e.g., 5 seconds). The radio frequency acquisition module converts the received analog radio frequency signal into discrete digital sampling points, forming a continuous raw radio frequency sampling data stream. This data stream contains complex sampling values arranged in chronological order, and each sampling value represents the amplitude and phase information of the signal received at a specific moment. Preliminary data preprocessing is performed on the raw radio frequency sampling data stream. The preprocessing operations include DC component removal, amplitude normalization, etc., aiming to eliminate some interference factors during the acquisition process and improve the accuracy of subsequent signal processing. For example, calculate the average value of the raw sampling data and subtract this average value from each sampling value to remove the DC bias. After completing the data preprocessing, an accurate timestamp is added to each sampling point in the raw radio frequency sampling data stream. This timestamp records the specific moment when each sampling point is acquired, and the time accuracy reaches the microsecond level. The radio frequency sampling data after adding the timestamp is called radio frequency time-domain sampling data. The radio frequency time-domain sampling data is segmented into several equal-length time-domain data blocks. The length of each data block is determined according to the number of points for FFT operation and the desired frequency resolution. Apply the fast Fourier transform (FFT) algorithm to each time-domain data block. The FFT algorithm converts the time-domain signal into a frequency-domain signal, and the output is spectral data in complex form, where each complex number represents the amplitude and phase of a specific frequency component. After performing the FFT operation on each time-domain data block, a series of real-time radio frequency spectrum data corresponding to different time periods is obtained. For each complex frequency component in each real-time radio frequency spectrum data block, calculate the square of its amplitude, and then divide it by the equivalent noise bandwidth and the sampling time to obtain the power spectral density (PSD) estimate value at that frequency point. The power spectral density represents the distribution of signal energy over frequency, and the unit is usually W / Hz or dBm / Hz. By calculating the power spectral density, the spectral data can be converted into energy distribution information, more intuitively reflecting the intensity of different frequency components. The calculated real-time power spectral density data still corresponds to the time-domain data block on which the FFT operation is performed, that is, each PSD data block represents the frequency energy distribution within a time segment. Divide the entire monitoring frequency band into several continuous sub-bands. For example, the 2.4GHz ISM band can be divided into multiple sub-channels with equal bandwidths. For each real-time power spectral density data block calculated in the previous step, calculate the average power value within each sub-band. The specific operation is to perform an arithmetic average on the power spectral density values of all frequency points within each sub-band. Each time segment corresponds to generating a real-time band power distribution vector data, and each element of this vector represents the average power value of the corresponding sub-band.Calculate the average or median of all elements in the power distribution vector as an estimate of the noise floor. Then, set a significance threshold, which can be a fixed difference relative to the noise floor (e.g., 10 dB above the noise floor), or dynamically adjusted based on statistical methods. Traverse each element in the real-time frequency band power distribution vector. If the average power value of a certain sub-band exceeds the sum of the estimated noise floor and the significance threshold, it is considered that there is a significant RF peak in that sub-band. Record the center frequency and peak power corresponding to the significant peak. Detect and record all significant peaks exceeding the threshold to generate a list of real-time significant RF peak features, where each element in the list contains peak frequency and peak power information. Sort the list of real-time significant RF peak features in ascending order of frequency values. At the same time, incorporate the real-time frequency band power distribution vector data corresponding to this time period into the integration process. Integrate the sorted list of real-time significant RF peak features, the corresponding real-time frequency band power distribution vector data, along with information such as the timestamp of this RF signal acquisition, sampling frequency, and acquisition duration, to form real-time RF acquisition metadata. This metadata contains key feature information of the RF environment acquired at a specific time point, including the overall frequency band power distribution and significant signal peaks and their frequencies and intensities.

[0134] Preferably, the network environment monitoring includes:

[0135] Based on the environment detection task configuration data, call the API interfaces of Bluetooth and Wi-Fi in the user terminal device to perform active scanning for 15 seconds to obtain real-time environment network list data;

[0136] Perform Bluetooth beacon analysis based on the real-time environment network list data, and extract the MAC address and signal strength. When the signal strength is greater than -75 dBm, record it as a valid signal to obtain real-time Bluetooth anchor data;

[0137] Based on the environment detection task configuration data, control the NFC module in the user terminal device to read the surrounding NFC tags at a working frequency of 13.56 MHz to obtain the NFC status data of the access device; wherein, the NFC status data of the access device includes whether NFC is enabled, whether it is in a polling state, and the device ID of the last NFC interaction;

[0138] Combine the real-time environment network list data, real-time Bluetooth anchor data, and NFC status data of the access device to obtain real-time network environment data.

[0139] In an embodiment of the present invention, after receiving the environmental detection task configuration data, the user terminal device respectively calls the Bluetooth and Wi-Fi scanning API interfaces provided by the operating system according to the specified network types (Bluetooth and Wi-Fi) and the scanning duration (15 seconds) in the configuration. For Wi-Fi scanning, the Wi-Fi module of the terminal device actively sends probe request frames, listens for beacon frames and probe response frames sent by surrounding Wi-Fi access points (APs), and records information such as the MAC address (BSSID), signal strength (RSSI), service set identifier (SSID), and encryption type of each detected Wi-Fi network. For Bluetooth scanning, the Bluetooth module of the terminal device broadcasts query messages and listens for response messages sent by surrounding Bluetooth devices, and records the MAC address, signal strength (RSSI), and device name (if broadcast) of each scanned Bluetooth device. The entire scanning process lasts for 15 seconds, during which multiple consecutive scans are performed, and all scanned Wi-Fi and Bluetooth device information is aggregated to form real-time environmental network list data. For the recorded Bluetooth device records, the MAC address and signal strength (RSSI) value are extracted. According to the pre-set list of MAC addresses of Bluetooth beacon devices, it is determined whether the currently scanned Bluetooth device belongs to a trusted Bluetooth beacon device. If the MAC address of the scanned Bluetooth device matches an entry in the pre-set beacon MAC address list and its received signal strength (RSSI) is greater than the pre-set effective signal threshold (-75 dBm), the MAC address and signal strength of the Bluetooth device are recorded as a valid real-time Bluetooth anchor data. The user terminal device enables its built-in near-field communication (NFC) module according to the environmental detection task configuration data. The NFC module is controlled to start polling the surrounding NFC tags at a working frequency of 13.56 MHz. Through the NFC API interface provided by the operating system, the working status of the current NFC module is obtained, including whether the NFC function is enabled. If the NFC function is enabled, it is further determined whether the NFC module is in the active polling mode, that is, whether it is actively scanning the surrounding NFC tags. If any NFC tag is detected to be close and data interaction occurs during the polling process, the unique identifier (device ID) of the NFC tag with the most recent successful interaction is recorded. If the NFC function is in the off state, or is enabled but not in the polling state, or no NFC interaction occurs, these status information are recorded accordingly. Finally, the enabled status, polling status of the NFC module, and the NFC device ID of the most recent interaction (if any) are combined into access device NFC status data. These three different types of data are organized into a structured data format, such as a JSON object.The JSON object can contain three main key-value pairs: one key corresponds to the real-time environment network list data (the value of which is a list containing information about all scanned network devices), one key corresponds to the real-time Bluetooth anchor data (the value of which is a list containing beacon MAC addresses and signal strengths), and another key corresponds to the access device NFC status data (the value of which is an object containing NFC status information).

[0140] As an example of the present invention, refer to Figure 2 as shown in Figure 1 the detailed implementation step flow diagram of step S3 in

[0141] Step S31: Identify the common MAC addresses in the reference environment trusted network data in the secure environment reference data and the real-time environment network list data in the real-time network environment data, and then perform a network environment matching degree scoring to obtain the network environment matching degree;

[0142] In the embodiment of the present invention, the reference environment trusted network data is extracted from the secure environment reference data, and this data contains a list of MAC addresses of known trusted Wi-Fi and Bluetooth devices. The real-time environment network list data is extracted from the real-time network environment data, and this data contains a list of MAC addresses of all Wi-Fi and Bluetooth devices detected in the current environment. Traverse each MAC address in the real-time environment network list data and check whether it exists in the reference environment trusted network data. Count the number of matching MAC addresses. Calculate the network environment matching degree score: divide the number of matching MAC addresses by the total number of MAC addresses in the reference environment trusted network data. Multiply the calculation result by 100% to obtain the network environment matching degree percentage value. For example, if there are 10 trusted devices in the reference environment and 6 devices detected in the real-time environment match the reference environment, the network environment matching degree is (6 / 10)×100% = 60%. Take this percentage value as the network environment matching degree.

[0143] Step S32: Calculate the coverage rate of a single trusted anchor for the real-time Bluetooth anchor data in the real-time network environment data using the trusted anchor signal feature data in the secure environment reference data, and then perform a spatial position credibility evaluation to generate a spatial position matching degree;

[0144] In an embodiment of the present invention, trusted anchor signal feature data is extracted from security environment reference data, which includes the MAC address of each trusted Bluetooth anchor device and its corresponding average RSSI value. Real-time Bluetooth anchor data is extracted from real-time network environment data, which includes the MAC address of Bluetooth beacon devices detected in the current environment and their RSSI values. For each trusted Bluetooth anchor, check whether its MAC address exists in the real-time Bluetooth anchor data. If it exists, it is considered that the anchor is covered. Calculate the single trusted anchor coverage rate: divide the number of covered anchors by the total number of trusted anchors. Then, according to a preset distance-RSSI mapping relationship model, such as the RSSI ranging formula based on the logarithmic path loss model, convert the RSSI value of each covered anchor in the real-time Bluetooth anchor data into the estimated distance between the user terminal device and the anchor. According to these distance values and the known positions of the anchors, use the trilateration method or other positioning algorithms to estimate the spatial position of the user terminal device. Compare the estimated position with a predefined safe area to determine whether the user terminal device is located within the safe area. If it is located within the safe area, the spatial position credibility is high; otherwise, the spatial position credibility is low. Combine the single trusted anchor coverage rate and the spatial position credibility, and use the weighted average method to generate the final spatial position matching degree.

[0145] Step S33: Analyze abnormal interaction behaviors based on the NFC status data of the access device to obtain NFC abnormal behavior data;

[0146] In an embodiment of the present invention, analyze whether NFC is in an unexpected state. For example, if it is stipulated in the security policy that the NFC function should be in the off state in a specific scenario, and it is detected that NFC is in the on state, it is considered abnormal. Another example is that if it is detected that NFC is in the active polling state, but there is no expected NFC tag nearby that needs to be interacted with, it is regarded as an abnormal behavior. Further analyze the device ID of the most recent NFC interaction. Compare this device ID with the ID of a trusted NFC tag that is pre-registered or recorded in the reference environment. If the ID of the most recently interacted NFC tag is not in the trusted list, or does not match the expected interaction object of the current access operation, it is considered that there is a potential risk. In addition, the frequency and duration of NFC interactions can also be analyzed. For example, frequent interactions with different unknown NFC tags in a short period of time, or maintaining a connection with a certain unknown NFC tag for a long time, are considered abnormal behaviors. According to the above analysis, generate NFC abnormal behavior data, which can be a boolean value indicating whether there is an abnormal behavior; or it can be a structured data containing multiple fields, detailing information such as the detected abnormal type, occurrence time, and the ID of the NFC tag involved.

[0147] Step S34: Perform NFC security risk assessment on NFC abnormal behavior data to generate NFC risk assessment data;

[0148] In the embodiments of the present invention, a series of NFC security risk rules and corresponding risk levels are defined. For example, "NFC is turned on when it is stipulated to be turned off in the policy" can be considered a low risk because it is a user's misoperation. The risk level of "interacting with an unknown NFC tag" depends on the nature of the unknown tag and the interaction content. If only public information is read, it is a medium risk; if it involves the transmission of sensitive data or triggers an unknown application, it is a high risk. "Frequently interacting with multiple unknown NFC tags within a short period of time" indicates an attempt of malicious scanning or man-in-the-middle attack and can be rated as a high risk. During the assessment process, the NFC abnormal behavior data is matched with the predefined risk rules. If an abnormal behavior that conforms to a certain risk rule is detected, NFC risk assessment data is generated according to the risk level corresponding to the rule. The NFC risk assessment data can be a numerical value representing the risk level (such as low, medium, high), or it can be a structured data containing a risk description and a risk level. For example, if it is detected that there is data interaction with a high-risk unknown NFC tag, the NFC risk assessment data is "Risk level: high, description: There is high-risk data interaction with the device with ID [unknown NFC tag ID]". If no NFC abnormal behavior is detected, the NFC risk assessment data can be indicated as "no risk".

[0149] Step S35: Perform intrusion risk detection on the real-time radio frequency acquisition metadata through the radio frequency fingerprint feature vector in the security environment benchmark data to generate intrusion risk assessment data;

[0150] In the embodiments of the present invention, the radio frequency fingerprint feature vector is extracted from the security environment benchmark data. The real-time frequency band power distribution vector data is extracted from the real-time radio frequency acquisition metadata. Calculate the similarity between the real-time frequency band power distribution vector data and the radio frequency fingerprint feature vector, such as using cosine similarity. Determine whether there is an intrusion risk according to the similarity score. If the similarity is lower than the preset threshold, it is considered that there is an intrusion risk, and the intrusion risk level is determined according to the difference between the similarity score and the threshold. For example, the greater the difference, the higher the risk level. The intrusion risk level is used as the intrusion risk assessment data.

[0151] Step S36: Perform multi-dimensional access risk assessment based on the network environment matching degree, spatial location matching degree, NFC risk assessment data, and intrusion risk assessment data to obtain multi-dimensional access risk assessment data.

[0152] In the embodiments of the present invention, the evaluation results of each dimension are normalized to unify their values to the same range (for example, between 0 and 1) for unified comparison and calculation. For the network environment matching degree and the spatial location matching degree, their percentage forms or the normalized values can be directly used. For the NFC risk assessment data and the intrusion risk assessment data, if the output is the risk level (such as low, medium, high), it needs to be mapped to a numerical range (for example, low = 0.2, medium = 0.6, high = 1.0). If the output is the risk score, it can be directly used or normalized. Next, according to the set weights, the evaluation results of each dimension are weighted and summed to obtain a comprehensive risk score. The calculation formula can be: multi-dimensional risk score = (network environment matching degree × weight 1) + (spatial location matching degree × weight 2) + (NFC risk assessment value × weight 3) + (intrusion risk assessment value × weight 4), where the sum of weight 1, weight 2, weight 3, and weight 4 is 1.

[0153] Preferably, the intrusion risk detection of the real-time radio frequency acquisition metadata by the radio frequency fingerprint feature vector in the secure environment benchmark data includes:

[0154] Performing a spectrum difference comparison between the real-time frequency band power distribution vector data and the radio frequency fingerprint feature vector in the real-time radio frequency acquisition metadata to generate a spectrum difference metric value;

[0155] Performing a temporal stability analysis on the spectrum difference metric value to obtain a frequency band fluctuation stability coefficient;

[0156] Based on the frequency band fluctuation stability coefficient, performing an abnormal high-power frequency point detection on the real-time significant radio frequency peak feature list in the real-time radio frequency acquisition metadata to obtain abnormal frequency point detection data;

[0157] Matching the abnormal frequency point detection data with known interference sources through a preset interference signal feature library. When it cannot be recognized as a known interference source, a potential intrusion signal is determined;

[0158] Performing an abnormal peak correlation analysis on the potential intrusion signal, and then performing an intrusion type identification to generate intrusion type risk assessment data.

[0159] In an embodiment of the present invention, a radio frequency fingerprint feature vector is extracted from the secure environment reference data, and the vector contains the power values of each frequency band in the reference environment. A real-time frequency band power distribution vector data is extracted from the real-time radio frequency acquisition metadata, and the vector contains the power values of each frequency band in the current environment. The Euclidean distance is used to calculate the distance between the real-time frequency band power distribution vector data and the radio frequency fingerprint feature vector, and a spectrum difference metric value is obtained. The larger the value, the greater the spectrum difference. A plurality of real-time frequency band power distribution vector data collected within a period of time (e.g., the past 1 minute) are stored in a matrix, and each row represents the frequency band power distribution vector at a time point. The standard deviation of the power value of each frequency band within this time period is calculated, and the standard deviation is divided by the average power value of the frequency band to obtain the fluctuation coefficient of the frequency band. The average value of the fluctuation coefficients of all frequency bands is obtained to get the frequency band fluctuation stability coefficient. The smaller the coefficient, the more stable the frequency band fluctuation. Based on the frequency band fluctuation stability coefficient, an abnormal high-power frequency point detection is performed on the real-time significant radio frequency peak feature list in the real-time radio frequency acquisition metadata. Specifically, each frequency point in the real-time significant radio frequency peak feature list is traversed. If the power value of this frequency point exceeds the average power value of this frequency band in the reference environment plus a preset threshold (e.g., twice the reference power value), and the fluctuation coefficient of this frequency band is less than the frequency band fluctuation stability coefficient, then this frequency point is marked as an abnormal high-power frequency point, and these abnormal frequency points are stored in the abnormal frequency point detection data, which contains the frequency and power value of each abnormal frequency point. Each abnormal frequency point in the abnormal frequency point detection data is compared with a preset interference signal feature library. The interference signal feature library contains feature information such as the frequency, power, modulation method, etc. of known interference sources, such as Wi-Fi signals, Bluetooth signals, Zigbee signals, etc. The frequency and power are used as matching criteria. If an abnormal frequency point is very close to the frequency and power of a certain known interference source in the interference signal feature library (e.g., the frequency difference is less than 1 MHz and the power difference is less than 3 dB), then it is considered that this abnormal frequency point is generated by a known interference source and is removed from the abnormal frequency point detection data. An abnormal peak correlation analysis is performed on the remaining potential intrusion signals that cannot be identified as known interference sources. For example, analyze whether there is a harmonic relationship between the frequencies of the potential intrusion signals, or whether there are multiple abnormal peaks occurring simultaneously in a short period of time. According to the results of the correlation analysis, the type of the potential intrusion signal is identified, such as narrowband interference, broadband interference, spoofing interference, etc. According to the identified intrusion type, its corresponding risk level is evaluated. For example, the risk level of narrowband interference is relatively low, the risk level of broadband interference is relatively high, and the risk level of spoofing interference is the highest.

[0160] Preferably, step S4 includes the following steps:

[0161] Step S41: Calculate the threat probability distribution according to the multi-dimensional access risk assessment data to generate the user's current access risk level;

[0162] Step S42: Based on the user's current access risk level and multi-dimensional access risk assessment data, look up the corresponding access control policy from the predefined risk level - access control mapping table to obtain the initial access control policy;

[0163] Step S43: Extract specific permission items according to the initial access control policy to obtain a list of dynamic permission items;

[0164] Step S44: Associate the list of dynamic permission items with the access request and update the user access session status;

[0165] Step S45: Perform information security access execution on the user based on the user access session status to obtain access control execution data;

[0166] Step S46: Based on the access control execution data, monitor the user's operation behavior in real time during the information access process. When the user has a violation operation behavior, immediately block the operation, delete the corresponding dynamic permission item, and re-initialize the user access session status to achieve information access security control.

[0167] In the embodiments of the present invention, a threat probability distribution is calculated based on multi-dimensional access risk assessment data, such as a comprehensive risk score. Specifically, the risk score is divided into different hierarchical intervals, such as low risk, medium risk, and high risk, and the threat probability corresponding to each hierarchical interval is determined according to historical data or expert experience. For example, a risk score between 0 and 30 is low risk, and the threat probability is 10%; a risk score between 31 and 60 is medium risk, and the threat probability is 50%; a risk score between 61 and 100 is high risk, and the threat probability is 90%. The current access risk level of the user is determined according to the hierarchical interval into which the multi-dimensional access risk assessment data falls. Based on the user's current access risk level and the scores of each sub-item in the multi-dimensional access risk assessment data, such as network environment matching degree, spatial location matching degree, NFC risk assessment data, and intrusion risk assessment data, the corresponding access control policy is found from a predefined risk level - access control mapping table. This mapping table defines the access control policies corresponding to different risk levels and combinations of scores of each risk sub-item, such as allow access, restrict access, deny access, etc. According to the matching result, an initial access control policy is obtained. For example, if the initial access control policy is "partially restricted, prohibit modifying sensitive data", it is necessary to further determine which specific data resources are considered "sensitive data", and which operations the user is prohibited from (such as "modifying", "deleting", etc.). These specific permission control items will be added to the dynamic permission item list. The process of extracting permission items requires querying a pre-configured permission management system or policy database, which stores the corresponding relationships between users, roles, resources, and operations. According to the user's identity information and the restriction conditions specified in the initial access control policy, the specific operations that the user is allowed to perform and the specific resources that can be accessed are retrieved. For example, if a user requests access to a specific file resource and the initial access control policy allows "read-only access", the dynamic permission item list will contain the permission for the user to perform the "read" operation on the file, but does not contain the permissions for other operations such as "modifying" or "deleting". The dynamic permission item list can be a data structure containing multiple permission entries, and each entry clearly specifies which resources the user can perform which operations on. When a user initiates an information access request (such as opening a certain file, querying a certain database record), the system will obtain the user's dynamic permission item list. The user's access request is matched with the permission entries in the dynamic permission item list. Only when the user's access request matches a certain permission entry in the list (that is, the requested accessed resource and the performed operation are within the scope allowed by the permission entry), the access request is considered legal. After the permission verification is completed, the user's access session status needs to be updated. The user access session status records information such as the current user's identity information, session ID, current valid dynamic permission item list, and the validity period of the session.Each time a user successfully passes authentication and obtains dynamic permissions, their session state will be created or updated, containing the latest list of dynamic permission items. Subsequently, any access requests initiated by the user during this session will be subject to permission checks based on the dynamic permissions recorded in this session state. For example, when a user successfully logs in and completes an environmental risk assessment, the system will create a new session for them and associate the list of dynamic permission items generated based on the assessment results with this session. When the user initiates a request to access a certain information resource, the security control module will intercept the request and check the list of dynamic permission items associated with the user's session. It will determine whether the user's requested operation and the target resource are within the scope permitted by a certain permission entry in the list. If the user's request conforms to the provisions of a certain permission entry, the operation is allowed, and the user can successfully access the target information resource. If the user's request does not conform to the provisions of any permission entry, the operation is refused, and a corresponding access denied prompt message is returned to the user. The access control execution data records each access request of the user, the execution result (allowed or denied), and the specific permission entry on which it is based. For example, when a user attempts to edit a file that is restricted to read-only, the system will check the dynamic permissions in their session state, find that there is no "edit" permission, and then refuse the edit operation and record an access control execution data indicating that the user's edit of the file was refused due to insufficient permissions. During the process of the user's information access, the system will record and analyze the user's operation behaviors in real time, such as which files were accessed, which operations were performed, which commands were entered, etc. The real-time operation behaviors of the user will be compared with predefined patterns of illegal operation behaviors. The patterns of illegal operation behaviors can include attempting to access unauthorized resources, performing abnormal operations on sensitive data (such as frequent copying, deletion), executing high-risk system commands, etc. When the system detects that a certain operation behavior of the user matches the predefined pattern of illegal operation behaviors, it will immediately take blocking measures, such as interrupting the current operation, closing the current session, or even locking the user account. At the same time, to ensure security, the system will immediately delete the corresponding dynamic permission items in the user's current session and re-initialize the user's access session state, which means that the user needs to re-authenticate and perform an environmental risk assessment again to obtain access permissions, and the new access permissions will be determined based on the re-assessed environmental risks and will be more restrictive than the previous permissions. For example, if a user attempts to perform a file deletion operation after being granted read-only permissions, the system will immediately block the deletion operation, delete any write permissions in their session, and force the user to log in again.

[0168] Preferably, the present invention also provides an information access security control system that executes the information access security control method as described above. The information access security control system includes:

[0169] The environment benchmark acquisition module is used to authorize the target access environment with a secure physical space to obtain a secure physical space; deploy a secure environment acquisition network in the secure physical space; use the secure environment acquisition network to perform access environment benchmark monitoring to obtain environment benchmark feature data; wherein the secure environment acquisition network includes a spectrum analyzer, a wireless network card, and an electromagnetic signal receiving unit;

[0170] Access the environment monitoring module to obtain user identity information; securely encrypt the environment benchmark feature data through the user identity information to obtain secure environment benchmark data; the user initiates an information access request through the user terminal device to obtain an access trigger signal; based on the access trigger signal, the user terminal device is used to perform real-time access environment monitoring to generate real-time access environment monitoring data;

[0171] A multi-dimensional risk assessment module is used to perform a multi-dimensional access risk assessment on the real-time access environment monitoring data through the security environment benchmark data to obtain multi-dimensional access risk assessment data;

[0172] The dynamic access control module is used to perform dynamic information security access execution according to multi-dimensional access risk assessment data to obtain access control execution data; based on the access control execution data, the user's operation behavior is monitored in real time to achieve information access security control.

[0173] This application aims to comprehensively and meticulously obtain the unique physical and electromagnetic characteristics of a secure physical space by deploying a secure environment acquisition network within it, thereby forming reliable environmental reference feature data. Encrypting the environmental reference data using user identity information not only ensures the security of the data but also binds it to a specific secure environment, providing a credible reference standard for subsequent risk assessment. When a user initiates an information access request, the system real-time collects access environment monitoring data of the current environment through the user's terminal device. This proactive real-time monitoring method can capture the instantaneous changes in the user's current environment. By comprehensively considering factors such as network environment matching degree, spatial location credibility, NFC interaction behavior, and radio frequency signal intrusion risk, it can more accurately determine whether the environment where the user is currently located is secure and reliable, thereby effectively identifying potential unauthorized access risks, such as the deception behavior of an attacker attempting to simulate a secure environment. The system can dynamically adjust according to the real-time environmental security status. When the evaluation result shows that the environmental security risk is relatively low, the user can access information normally; while when an environmental anomaly or increased risk is detected, the system can immediately take corresponding security measures, such as restricting the user's access rights, performing secondary identity verification, or even interrupting the current access session. This dynamic adjustment mechanism can effectively respond to complex and changeable security environments, avoid performing sensitive operations in potentially risky environments, and thus minimize the possibility of information leakage to the greatest extent. After the user is allowed to access information, the system will still continuously monitor and analyze the user's operation behavior. By detecting whether the user's operations conform to normal behavior patterns, such as whether there are abnormal data access frequencies, unconventional file operations, etc., potential internal threats or maliciously controlled user terminals can be discovered in a timely manner. Once abnormal behavior is detected, the system can immediately issue an alarm or take further security measures, such as recording operation logs, restricting specific operations, or even locking the user account, thereby forming an additional security defense line to further enhance the security of information access.

[0174] Therefore, in any aspect, the embodiments should be regarded as exemplary and non-limiting. The scope of the present invention is defined by the appended claims rather than the above description. Thus, all changes falling within the meaning and scope of the equivalent elements of the application documents are intended to be encompassed within the present invention.

[0175] The above description is only the specific implementation manners of the present invention, enabling those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be obvious to those skilled in the art. The general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to these embodiments shown herein, but rather will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An information access security control method, characterized in that, The following steps are involved: Step S1: Authorize the target access environment to obtain a secure physical space; Deploy a secure environment collection network in a secure physical space; Using a secure environment acquisition network to perform access environment benchmark monitoring to obtain environmental benchmark feature data; wherein the secure environment acquisition network includes a spectrum analyzer, a wireless network card, and an electromagnetic signal receiving unit; Step S2: obtaining user identity information; securely encrypting environmental benchmark feature data using the user identity information to obtain secure environmental benchmark data; the user initiates an information access request through a user terminal device to obtain an access trigger signal; based on the access trigger signal, the user terminal device is used to perform real-time access environment monitoring to generate real-time access environment monitoring data; Step S3: Perform multi-dimensional access risk assessment on the real-time access environment monitoring data through the security environment benchmark data to obtain multi-dimensional access risk assessment data; Step S4: Perform dynamic information security access execution according to the multi-dimensional access risk assessment data to obtain access control execution data; monitor the user's operation behavior in real time based on the access control execution data to achieve information access security control.

2. The information access security control method according to claim 1, characterized in that The step S1 of using the secure environment collection network to perform access environment benchmark monitoring includes: Use a spectrum analyzer to continuously collect RF signals for 10 minutes at a sampling rate of 2MS / s, and transmit the collected original RF signals to the edge computing node through a high-speed data interface to obtain the original RF sampling signals; Performing RF fingerprint feature analysis on the original RF sampling signal to obtain a RF fingerprint feature vector; wherein the RF fingerprint feature analysis includes signal harmonic distortion calculation, signal crossing zero level times statistics, and carrier frequency offset estimation; Using a wireless network card to scan surrounding Bluetooth and Wi-Fi devices every 2 seconds, record MAC addresses, signal strengths, and device names for 5 minutes, and obtain an original baseline environment network list; wherein the wireless network card supports 2.4 GHz and 5 GHz frequency bands and has concurrent scanning capabilities; The original benchmark environment network list is filtered by a preset trusted network threshold to obtain the benchmark environment trusted network data; Mark the trusted device group in the secure physical space; broadcast low-power Bluetooth beacon to the trusted device group, and then generate the trusted device electromagnetic signal strength data according to the electromagnetic signal strength of the device received by the electromagnetic signal receiving unit; Calculate the average value of the electromagnetic signal strength data of the trusted device, and associate the anchor point signal with the trusted device group to obtain the trusted anchor point signal feature data; The radio frequency fingerprint feature vector, the benchmark environment trusted network data and the trusted anchor point signal feature data are integrated into the environmental benchmark feature to generate the environmental benchmark feature data.

3. The information access security control method according to claim 1, wherein The secure encryption of the environmental baseline feature data by the user identity information in step S2 includes: Perform hash operation on user identity information to generate a user identity hash value; Generate a 256-bit random number using a random number generator, and perform an XOR operation on the user identity hash value and the random number to obtain a mixed key seed; Perform key derivation processing based on the mixed key seed to generate a user-specific encryption key; Symmetrically encrypt the environmental benchmark feature data with the user's exclusive encryption key to generate encrypted secure environmental benchmark data; Associate the user identity information with the encrypted secure environmental benchmark data, and then based on the secure storage of the secure element, obtain the secure environmental benchmark data.

4. The information access security control method according to claim 1, wherein The real-time secure environment monitoring using the user terminal device based on the access trigger signal in step S2 includes: Perform user identity authentication according to the access trigger signal to obtain user identity authentication data; When the user identity authentication data is true, respond to the access trigger signal, judge the current system state of the user terminal device. When the network connection state of the user terminal device is greater than the preset transmission bandwidth threshold and the battery power is greater than 20%, obtain the environmental detection ready signal; otherwise, generate an environmental detection ability insufficient signal and send a prompt message to the user; Process the detection task according to the environmental detection ready signal to obtain environmental detection task configuration data; Control the user terminal device to perform real-time access environment monitoring based on the environmental detection task configuration data to generate real-time access environment monitoring data; the real-time access environment monitoring includes radio frequency monitoring and network environment monitoring, and the real-time access environment monitoring data includes real-time radio frequency acquisition metadata and real-time network environment data.

5. The information access security control method according to claim 4, characterized in that, The real-time access environment monitoring data includes: Based on the environmental detection task configuration data, use the built-in or external radio frequency acquisition module of the user terminal device to continuously collect radio frequency signals in the access physical environment to obtain the original radio frequency sampling data stream; Perform data preprocessing on the original radio frequency sampling data stream, and then perform timestamp marking to generate radio frequency time-domain sampling data; Perform fast Fourier transform on the radio frequency time-domain sampling data to obtain real-time radio frequency spectrum data; Calculate the real-time power spectral density according to the real-time radio frequency spectrum data; Extract the average power value of each sub-band according to the real-time power spectral density to obtain the real-time band power distribution vector data; Perform noise floor estimation and significant peak detection according to the real-time band power distribution vector data to generate a real-time significant radio frequency peak feature list; Arrange the real-time significant radio frequency peak feature list in frequency order, and integrate the radio frequency acquisition metadata according to the real-time band power distribution vector data to obtain the real-time radio frequency acquisition metadata.

6. The information access security control method according to claim 4, characterized in that The network environment monitoring includes: Based on the environmental detection task configuration data, call the API interfaces of Bluetooth and Wi-Fi in the user terminal device to perform active scanning for 15 seconds to obtain real-time environmental network list data; Perform Bluetooth beacon analysis according to the real-time environmental network list data, and extract the MAC address and signal strength. When the signal strength is greater than -75dBm, record it as a valid signal to obtain real-time Bluetooth anchor data; Based on the environmental detection task configuration data, control the NFC module in the user terminal device to read the surrounding NFC tags at a working frequency of 13.56MHz to obtain the access device NFC status data; among them, the access device NFC status data includes whether NFC is enabled, whether it is in a polling state, and the device ID of the last NFC interaction. Combine the real-time environment network list data, real-time Bluetooth anchor data, and the NFC status data of the access device to perform network environment combination, and obtain real-time network environment data.

7. The information access security control method according to claim 4, characterized in that, Step S3 includes the following steps: Step S31: Identify the common MAC addresses in the reference environment trusted network data in the security environment reference data and the real-time environment network list data in the real-time network environment data, and then perform a network environment matching degree score to obtain the network environment matching degree; Step S32: Use the trusted anchor signal feature data in the security environment reference data to calculate the coverage rate of a single trusted anchor for the real-time Bluetooth anchor data in the real-time network environment data, and then perform a spatial location credibility assessment to generate a spatial location matching degree; Step S33: Analyze the abnormal interaction behavior based on the NFC status data of the access device to obtain NFC abnormal behavior data; Step S34: Perform an NFC security risk assessment on the NFC abnormal behavior data to generate NFC risk assessment data; Step S35: Detect the intrusion risk of the real-time radio frequency acquisition metadata through the radio frequency fingerprint feature vector in the security environment reference data to generate intrusion risk assessment data; Step S36: Perform a multi-dimensional access risk assessment based on the network environment matching degree, spatial location matching degree, NFC risk assessment data, and intrusion risk assessment data to obtain multi-dimensional access risk assessment data.

8. The information access security control method according to claim 7, wherein The intrusion risk detection of the real-time radio frequency acquisition metadata through the radio frequency fingerprint feature vector in the security environment reference data includes: Compare the spectrum difference between the real-time frequency band power distribution vector data in the real-time radio frequency acquisition metadata and the radio frequency fingerprint feature vector to generate a spectrum difference metric value; Perform a temporal stability analysis on the spectrum difference metric value to obtain a frequency band fluctuation stability coefficient; Based on the frequency band fluctuation stability coefficient, detect the abnormally high power frequency points in the real-time significant radio frequency peak feature list in the real-time radio frequency acquisition metadata to obtain abnormally detected frequency point data; Match the abnormally detected frequency point data with the known interference source library through a preset interference signal feature library. If it cannot be identified as a known interference source, then determine the potential intrusion signal; Perform an abnormal peak correlation analysis on the potential intrusion signal, and then perform an intrusion type identification to generate intrusion type risk assessment data.

9. The information access security control method according to claim 1, characterized in that, Step S4 includes the following steps: Step S41: Calculate the threat probability distribution based on the multi-dimensional access risk assessment data to generate the user's current access risk level; Step S42: Based on the user's current access risk level and the multi-dimensional access risk assessment data, search for the corresponding access control policy from the predefined risk level - access control mapping table to obtain the initial access control policy; Step S43: Extract the specific permission items according to the initial access control policy to obtain a dynamic permission item list; Step S44: Associate the dynamic permission item list with the access request and update the user access session status; Step S45: Perform information security access execution on the user based on the user access session status to obtain access control execution data; Step S46: Based on the access control execution data, the user operation behavior is monitored in real time during the information access process. When the user has illegal operation behavior, the operation is immediately blocked, the corresponding dynamic permission item is deleted, and the user access session status is reinitialized to achieve information access security control.

10. An information access security control system, characterized in that, Used to execute the information access security control method as claimed in claim 1, the information access security control system comprises: The environment benchmark acquisition module is used to authorize the target access environment with a secure physical space to obtain a secure physical space; deploy a secure environment acquisition network in the secure physical space; use the secure environment acquisition network to perform access environment benchmark monitoring to obtain environment benchmark feature data; wherein the secure environment acquisition network includes a spectrum analyzer, a wireless network card, and an electromagnetic signal receiving unit; Access the environment monitoring module to obtain user identity information; securely encrypt the environment benchmark feature data through the user identity information to obtain secure environment benchmark data; the user initiates an information access request through the user terminal device to obtain an access trigger signal; based on the access trigger signal, the user terminal device is used to perform real-time access environment monitoring to generate real-time access environment monitoring data; A multi-dimensional risk assessment module is used to perform a multi-dimensional access risk assessment on the real-time access environment monitoring data through the security environment benchmark data to obtain multi-dimensional access risk assessment data; The dynamic access control module is used to perform dynamic information security access execution according to multi-dimensional access risk assessment data to obtain access control execution data; based on the access control execution data, the user's operation behavior is monitored in real time to achieve information access security control.

Images