Computer data security protection method and system

Abstract

The invention discloses a computer data security protection method and system, and belongs to the technical field of information security. The method comprises the steps of obtaining data content risk data and value data, constructing a data content risk model and a data value model, and calculating a data security coefficient through a data security model; meanwhile, constructing a visitor safety coefficient based on visitor permission range data and risk data; and finally, dynamically matching a security coefficient through a data-access security matching model, and granting an access permission to check, modify or deny according to an SM threshold. According to the method, dynamic quantitative matching of the data risk and the access behavior is realized, and the accuracy and safety of authority control are remarkably improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of information security, and particularly relates to a method and system for computer data security protection. Background Art

[0002] In traditional computer data security protection technologies, permission control is mostly based on static rules (such as roles or fixed policies), lacking real-time assessment of data dynamic risks and visitor behaviors. The existing methods have the following problems:

[0003] (1) Ignoring the dynamic correlation between data content risks (such as key strength, access frequency) and data value (such as business dependence, recovery cost), resulting in overly rigid permission allocation;

[0004] (2) Visitor permission determination only depends on historical records or a single indicator (such as identity authentication), making it difficult to identify abnormal behaviors (such as unauthorized access, cross-system over-privilege operations);

[0005] (3) Security policies cannot be adaptively adjusted, easily leading to over-opening or over-restriction of permissions, affecting business efficiency and security.

[0006] Therefore, there is an urgent need for a dynamic and fine-grained security protection method to achieve precise permission control by quantifying the matching degree between data risks and visitor behaviors. Summary of the Invention

[0007] Aiming at the deficiencies of the prior art, the present invention provides a method and system for computer data security protection, which solves the above problems.

[0008] To achieve the above object, the present invention is realized through the following technical solutions: A method for computer data security protection, comprising:

[0009] Obtaining the content risk data and value data of the saved data, and obtaining the permission range data and risk data of the visitor;

[0010] Constructing and importing a data content risk evaluation model based on the content risk data of the saved data, and then outputting a data content risk coefficient;

[0011] Constructing and importing a data value model based on the value data of the saved data, and then outputting a data value coefficient;

[0012] Constructing and importing a data security model based on the data value coefficient and the data content risk coefficient, and then outputting a data security coefficient;

[0013] Constructing and importing an access permission range model based on the permission range data of the visitor, and then outputting an access permission range coefficient;

[0014] Construct a visitor risk model based on the risk data of the visitor, import it, and then output the visitor risk coefficient;

[0015] Construct a visitor security coefficient based on the visitor permission range coefficient and the visitor risk coefficient, import it, and then output the visitor security coefficient;

[0016] Construct a data-access security matching model based on the visitor security coefficient and the data security coefficient, import it, and then output the data-access security matching degree;

[0017] Compare the obtained data-access security matching degree with the corresponding threshold, and then obtain the operation permission of the current visitor for the current saved data.

[0018] Based on the above technical solutions, the present invention also provides the following optional technical solutions:

[0019] Further technical solution: The content risk data of the saved data includes key length, data access frequency, and the proportion of the saver's permission; the value data of the saved data includes recovery time objective, business dependence degree, and data sharing range; the permission range data of the visitor includes the number of accessible sensitive levels, the number of cross-system permissions, and the proportion of the number of accessible data fields; the risk data of the visitor includes the unapproved access rate, the proportion of abnormal sessions, and the number of policy violations.

[0020] Further technical solution: The specific steps for constructing a data content risk evaluation model based on the content risk data of the saved data, importing it, and then outputting the data content risk coefficient are as follows:

[0021] Import the key length into the formula to output the key length exponent, to adjust the key sensitivity, where is the key length;

[0022] Perform a ratio processing on the current data access frequency and the maximum access frequency allowed by the service to obtain the access frequency exponent;

[0023] Perform a ratio processing on the saver's permission proportion and the maximum allowed saver's permission proportion to obtain the saver's permission proportion exponent;

[0024] Construct a data content risk model based on the key length exponent, the access frequency exponent, and the saver's permission proportion exponent, and import the key length exponent, the access frequency exponent, and the saver's permission proportion exponent to obtain the data content risk coefficient;

[0025] The data content risk model is expressed as:

[0026] ;

[0027] Among them, represents the data content risk coefficient, represents the key length exponent, represents the access frequency exponent, represents the saved permission ratio exponent, represents the weight coefficient and , and the larger the value, the higher the data content risk.

[0028] Further technical solution: The steps for obtaining the data value coefficient are as follows:

[0029] Perform a ratio process on the recovery time objective, business dependency, and data sharing scope with their respective maximum allowable values, and then obtain the recovery time objective exponent, business dependency exponent, and data sharing scope exponent;

[0030] Import the obtained recovery time objective exponent, business dependency exponent, and data sharing scope exponent into the data value model, and then obtain the data value coefficient;

[0031] The data value model is expressed as:

[0032] ;

[0033] Among them, represents the data value coefficient, represents the recovery time objective exponent, represents the business dependency exponent, represents the data sharing scope exponent, represents the weight coefficient and , and the larger the value, the higher the data value.

[0034] Further technical solution: The data security model is expressed as:

[0035] ;

[0036] Among them, represents the data security coefficient, represents the data content risk coefficient, represents the data value coefficient, and the larger the value, the higher the data value.

[0037] Further technical solution: The steps for constructing an access permission range model based on the accessor's permission range data and importing it to output the access permission range coefficient are as follows:

[0038] The number of accessible sensitive levels and the number of cross-system permissions are processed as ratios with the corresponding maximum allowable values, and then the accessible sensitive level index and the cross-system permission number index are obtained;

[0039] The accessible sensitive level index, the cross-system permission number index, and the proportion of accessible data fields are imported into the constructed visitor permission range model to output the visitor permission range coefficient;

[0040] The visitor permission range model is expressed as:

[0041] ;

[0042] where, represents the visitor permission range coefficient, represents the accessible sensitive level index, represents the cross-system permission number index, represents the proportion of accessible data fields, represents the weight coefficient and , and the larger the value, the wider the visitor permission range and the higher the potential risk.

[0043] Further technical solution: The steps of constructing a visitor risk model based on the visitor's risk data and importing it to output the visitor risk coefficient are:

[0044] The number of policy violations is processed as a ratio with the maximum allowable number of violations to obtain the policy violation number index;

[0045] The policy violation number index, the unapproved access rate, and the proportion of abnormal sessions are imported into the constructed visitor risk model to output the visitor risk coefficient;

[0046] The visitor risk model is expressed as:

[0047] ;

[0048] where, represents the visitor risk coefficient, represents the unapproved access rate, represents the proportion of abnormal sessions, represents the policy violation number index, represents the weight coefficient and , and the larger the value, the higher the visitor risk.

[0049] Further technical solution: The visitor security model is expressed as:

[0050] ;

[0051] Among them, represents the visitor safety factor, represents the visitor risk factor, represents the visitor permission range factor, represents the permission amplification factor.

[0052] Further technical solution: The data-access security matching model is expressed as:

[0053] ;

[0054] Among them, represents the data-access security matching degree, represents the data security factor, represents the visitor safety factor, represents the asymmetry tolerance factor, and the larger the value, the higher the matching degree between the visitor safety factor and the data security factor.

[0055] Further technical solution: The steps of comparing the obtained data-access security matching degree with the corresponding threshold and then obtaining the operation permission of the current visitor for the currently saved data are as follows:

[0056] If , it means that the current visitor safety factor and the security factor of the saved data are highly matched, and viewing, modification, and export are allowed;

[0057] If , it means that the current visitor safety factor and the security factor of the saved data are moderately matched, and viewing and modification are allowed;

[0058] If , it means that the current visitor safety factor and the security factor of the saved data are lowly matched, and viewing is allowed;

[0059] If , it means that the current visitor safety factor and the security factor of the saved data are not matched, and access is refused and an alarm is triggered.

[0060] The present invention provides a method and system for computer data security protection, which has the following beneficial effects compared with the prior art:

[0061] 1. The present invention uses a data content risk model, a data value model, and a visitor risk model to quantify the data security factor and the visitor security factor in real time, enhancing the risk response ability. At the same time, based on the threshold rule of the data-access security matching degree, the operation permissions are dynamically adjusted, taking into account both security and flexibility. Additionally, a data security model and a visitor security model are introduced to suppress the permission amplification in high-risk scenarios and reduce the risks of data leakage and abuse. The present invention realizes the dynamic quantitative matching of data risks and access behaviors, significantly improving the accuracy and security of permission control. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 It is a schematic flowchart of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0063] In order to make the objectives, technical solutions and advantages of the present invention clearer and more understandable, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0064] The following describes the specific implementation of the present invention in detail with reference to specific embodiments.

[0065] Please refer to Figure 1 , a computer data security protection method provided by an embodiment of the present invention, includes the following steps:

[0066] Obtain the content risk data and value data of the saved data, and obtain the permission range data and risk data of the visitor;

[0067] Construct a data content risk evaluation model based on the content risk data of the saved data and import it, and then output the data content risk factor;

[0068] Construct a data value model based on the value data of the saved data and import it, and then output the data value factor;

[0069] Construct a data security model based on the data value factor and the data content risk factor and import it, and then output the data security factor;

[0070] Construct an access permission range model based on the permission range data of the visitor and import it, and then output the access permission range factor;

[0071] Construct a visitor risk model based on the risk data of the visitor and import it, and then output the visitor risk factor;

[0072] Construct a visitor security factor based on the visitor permission range factor and the visitor risk factor and import it, and then output the visitor security factor;

[0073] Construct a data-access security matching model based on the security factor of the visitor and the data security factor, import it, and then output the data-access security matching degree;

[0074] Compare the obtained data-access security matching degree with the corresponding threshold, and then obtain the operation permission of the current visitor for the currently saved data.

[0075] In the present invention, by obtaining the risk data and value data of the data content, constructing a data content risk model and a data value model, and calculating the data security factor through a data security model; at the same time, based on the visitor permission range data and risk data, constructing a visitor security factor; finally, dynamically matching the security factors through a data-access security matching model, and granting viewing, modification, or access rejection permissions according to the SM threshold. The present invention realizes the dynamic quantitative matching of data risks and access behaviors, and significantly improves the accuracy and security of permission control.

[0076] Preferably, the content risk data of the saved data includes the key length, data access frequency, and the proportion of the saver's permissions;

[0077] The value data of the saved data includes the recovery time objective, business dependency (based on the number of business processes of the saved data, that is, the number of core processes stopped due to data unavailability, such as supply chain, production, customer service, etc.), and the data sharing range (the number of shared systems);

[0078] The permission range data of the visitor includes the number of accessible sensitive levels, the number of cross-system permissions (the number of permissions to access different business systems, used to identify high-risk operation permissions, such as the proportion of delete permissions), and the proportion of the number of accessible data fields (the proportion of the number of accessible data fields to the total number of fields);

[0079] The risk data of the visitor includes the unapproved access rate (the proportion of the number of unapproved accesses to the total number of accesses, used to evaluate the standardization of privileged permission management), the proportion of abnormal sessions (the proportion of the number of accesses from unusual devices or IPs to the total number of accesses, used to detect the risk of account theft or sharing), and the number of policy violations (the number of violations of access control policies, such as unauthorized access, used to measure the matching degree between permissions and actual behaviors).

[0080] Preferably, the specific steps for constructing a data content risk evaluation model based on the content risk data of the saved data and importing it to output the data content risk factor are as follows:

[0081] Import the key length into the formula to output the key length exponent, to adjust the key sensitivity, is the key length;

[0082] Ratio the current data access frequency with the maximum access frequency allowed by the business to obtain the access frequency index;

[0083] The saver permission ratio is compared with the maximum allowed saver permission ratio to obtain the saver permission ratio index;

[0084] A data content risk model is constructed based on the key length index, access frequency index, and preserver authority ratio index, and the key length index, access frequency index, and preserver authority ratio index are imported to obtain the data content risk coefficient;

[0085] The data content risk model is expressed as:

[0086]

[0087] in, Indicates the data content risk factor, represents the key length exponent, represents the access frequency index, Indicates that the permission ratio index is saved. represents the weight coefficient and , The larger the value, the higher the risk of the data content.

[0088] The above technical solution is achieved by comprehensively analyzing the key security (key length index ), access frequency index, and the permission ratio index used to evaluate the risk of data content, namely the key length index The larger (longer the key), the lower the risk The greater the access frequency index and the percentage of stored permissions, the higher the risk. From the overall performance, the data content risk coefficient The larger the value, the higher the risk of the data content.

[0089] Preferably, the steps for obtaining the data value coefficient are:

[0090] Ratio the recovery time objective, business dependency, and data sharing scope to their respective maximum allowable values to obtain the recovery time objective index, business dependency index, and data sharing scope index;

[0091] Import the obtained recovery time objective index, business dependency index, and data sharing scope index into the data value model to obtain the data value coefficient;

[0092] The data value model is expressed as:

[0093]

[0094] in, represents the data value coefficient, represents the recovery time objective index, represents the business dependency index, represents the data sharing scope index, represents the weight coefficient and , And the larger the value, the higher the data value.

[0095] The above technical solution is based on the comprehensive recovery time objective index ( ), business dependence index ( ) and the Data Sharing Coverage Index ( ) to assess data value, namely the recovery time objective index ( ) and business dependency index ( ) is larger, the higher the value is, and the data sharing scope index ( ) is larger, the wider the sharing range, and the value may decrease ( ) decreases, and from the overall performance point of view, the data value coefficient ( ) The larger it is, the higher the value.

[0096] Preferably, the data security model is expressed as:

[0097]

[0098] in, Indicates the data safety factor, Indicates the data content risk factor, represents the data value coefficient, And the larger the value, the higher the data value.

[0099] The above technical solution balances the risk factor of data content ( ) and data value coefficient ( ), measure the data security factor ( ), when the data content risk factor ( ) and data value coefficient ( ) are high, the denominator increases, suppressing the data safety factor ( ) excessive growth, from the overall performance point of view data safety factor ( ), the larger the data value, the higher the data security requirements.

[0100] Preferably, the steps of constructing an access permission range model based on the visitor's access permission range data and importing and then outputting the access permission range coefficient are:

[0101] Ratio process the number of accessible sensitive levels and the number of cross-system permissions with their corresponding maximum allowable values, and then obtain the accessible sensitive level index and the cross-system permission number index;

[0102] Import the accessible sensitive level index, the cross-system permission number index, and the proportion of accessible data fields into the constructed visitor permission range model to output the visitor permission range coefficient;

[0103] The visitor permission range model is expressed as:

[0104]

[0105] Wherein, represents the visitor permission range coefficient, represents the accessible sensitive level index, represents the cross-system permission number index, represents the proportion of accessible data fields, represents the weight coefficient and , and the larger the value, the wider the visitor permission range and the higher the potential risk.

[0106] The above technical solution evaluates the visitor's permission range by comprehensively considering the accessible sensitive level index ( ), the cross-system permission number index ( ), and the proportion of accessible fields ( ). Generally speaking, the larger the value of the visitor permission range coefficient ( ), the wider the visitor permission range and the higher the potential risk.

[0107] Preferably, the steps of constructing a visitor risk model based on the visitor's risk data and importing it to output the visitor risk coefficient are as follows:

[0108] Ratio process the number of policy violations and the maximum allowable number of violations to obtain the policy violation number index;

[0109] Import the policy violation number index, the unapproved access rate, and the proportion of abnormal sessions into the constructed visitor risk model to output the visitor risk coefficient;

[0110] The visitor risk model is expressed as:

[0111]

[0112] Wherein, represents the visitor risk coefficient, represents the unapproved access rate, represents the proportion of abnormal sessions, represents the policy violation number index, represents a weight coefficient and , and the larger the value, the higher the risk of the visitor.

[0113] The above technical solution evaluates the risk of the visitor by comprehensively considering the unapproved access rate ( ), the proportion of abnormal sessions ( ), and the policy violation times index ( ). From the overall performance, the larger the value of the visitor risk coefficient , the higher the risk of the visitor.

[0114] Preferably, the visitor security model is expressed as:

[0115]

[0116] wherein, represents the visitor security coefficient, represents the visitor risk coefficient, represents the visitor permission range coefficient, represents the permission amplification factor.

[0117] Combining the visitor risk coefficient ( ) and the visitor permission range coefficient ( ) to calculate the visitor security coefficient, that is, the larger the visitor risk coefficient ( ), the smaller ( ), the lower the security coefficient. The larger the visitor permission range coefficient ( ) (wider permission range), amplifies the risk (required ). From the overall performance, the larger the value of the visitor security coefficient , the higher the security of the visitor.

[0118] Preferably, the data - access security matching model is expressed as:

[0119]

[0120] wherein, represents the data - access security matching degree, represents the data security coefficient, represents the visitor security coefficient, represents the asymmetry tolerance coefficient, and the larger the value, the higher the matching degree between the visitor security coefficient and the data security coefficient.

[0121] This technical solution measures the matching degree between the data security coefficient ( ) and the visitor security coefficient ( ) through the data - access security matching model. When At this time, the denominator is the smallest, and the data-access security matching degree is the highest. From the overall performance, the data-access security matching degree The larger the value, the higher the security matching degree and the looser the access permission.

[0122] Preferably, the step of comparing the obtained data-access security matching degree with the corresponding threshold value and then obtaining the operation permission of the current visitor for the currently saved data is as follows:

[0123] If , it means that the security coefficient of the current visitor highly matches the security coefficient of the saved data, and viewing, modification, and export are allowed;

[0124] If , it means that the security coefficient of the current visitor moderately matches the security coefficient of the saved data, and viewing and modification are allowed;

[0125] If , it means that the security coefficient of the current visitor lowly matches the security coefficient of the saved data, and viewing is allowed;

[0126] If , it means that the security coefficient of the current visitor does not match the security coefficient of the saved data, and access is refused and an alarm is triggered.

[0127] As an embodiment of the present invention, a security protection system for computer data adopts the above-mentioned security protection method for computer data.

[0128] It should be noted that in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variant thereof are intended to cover non-exclusively, so that a process, method, article or device including a series of elements not only includes those elements, but also includes other elements not expressly listed, or also includes elements inherent to such process, method, article or device.

[0129] Although the embodiments of the present invention have been shown and described, for those of ordinary skill in the art, it can be understood that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of the present invention, and the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for securing computer data, characterized in that, It includes the following steps: Obtain the content risk data and value data of the saved data, and obtain the permission scope data and risk data of the visitor; Construct a data content risk evaluation model based on the content risk data of the saved data and import it, and then output the data content risk coefficient; Construct a data value model based on the value data of the saved data and import it, and then output the data value coefficient; Construct a data security model based on the data value coefficient and the data content risk coefficient and import it, and then output the data security coefficient; Construct an access permission scope model based on the permission scope data of the visitor and import it, and then output the access permission scope coefficient; Construct a visitor risk model based on the risk data of the visitor and import it, and then output the visitor risk coefficient; Construct a visitor security coefficient based on the visitor permission scope coefficient and the visitor risk coefficient and import it, and then output the visitor security coefficient; Construct a data-access security matching model based on the visitor security coefficient and the data security coefficient and import it, and then output the data-access security matching degree; Compare the obtained data-access security matching degree with the corresponding threshold value, and then obtain the operation permission of the current visitor for the current saved data.

2. The security protection method for computer data according to claim 1, wherein The content risk data of the saved data includes key length, data access frequency, and the proportion of the saver's permission; the value data of the saved data includes recovery time objective, business dependency, and data sharing scope; the permission scope data of the visitor includes the number of accessible sensitive levels, the number of cross-system permissions, and the proportion of the number of accessible data fields; the risk data of the visitor includes the unapproved access rate, the proportion of abnormal sessions, and the number of policy violations.

3. The security protection method for computer data according to claim 2, characterized in that, The specific steps for constructing a data content risk evaluation model based on the content risk data of the saved data and importing it, and then outputting the data content risk coefficient are as follows: Import the key length into the formula and output the key length exponent, to adjust the key sensitivity, where is the key length; Perform a ratio process on the current data access frequency and the maximum access frequency allowed by the business, and then obtain the access frequency index; Perform a ratio process on the saver's permission proportion and the maximum allowed saver's permission proportion, and then obtain the saver's permission proportion index; Construct a data content risk model based on the key length index, the access frequency index, and the saver's permission proportion index, and import the key length index, the access frequency index, and the saver's permission proportion index, and then obtain the data content risk coefficient; The data content risk model is expressed as: ； Among them, represents the data content risk coefficient, represents the key length exponent, represents the access frequency exponent, represents the saved permission ratio exponent, represents the weight coefficient and , and the larger the value, the higher the data content risk.

4. The security protection method for computer data according to claim 3, wherein The steps for obtaining the data value coefficient are as follows: Perform a ratio process on the recovery time objective, the business dependency, and the data sharing scope with their respective maximum allowed values, and then obtain the recovery time objective index, the business dependency index, and the data sharing scope index; Import the obtained recovery time objective index, business dependency index, and data sharing scope index into the data value model, and then obtain the data value coefficient; The data value model is expressed as: ； Among them, represents the data value coefficient, represents the recovery time objective index, represents the business dependency index, represents the data sharing scope index, represents the weight coefficient and , and the larger the value, the higher the data value.

5. The security protection method for computer data according to claim 4, characterized in that, The data security model is expressed as: ； Among them, represents the data security coefficient, represents the data content risk coefficient, represents the data value coefficient, and the larger the value, the higher the data value.

6. The security protection method for computer data according to claim 5, wherein The steps for constructing an access permission scope model based on the permission scope data of the visitor and importing it, and then outputting the access permission scope coefficient are as follows: Perform a ratio process on the number of accessible sensitive levels and the number of cross-system permissions with the corresponding maximum allowed values, and then obtain the accessible sensitive level index and the cross-system permission number index; Import the accessible sensitive level index, the cross-system permission quantity index, and the proportion of accessible data fields into the constructed visitor permission range model to output the visitor permission range coefficient; The visitor permission range model is expressed as: ； Among them, represents the visitor permission range coefficient, represents the accessible sensitivity level index, represents the cross-system permission quantity index, represents the proportion of accessible data fields, represents the weight coefficient and , and the larger the value, the wider the visitor permission range and the higher the potential risk.

7. The security protection method for computer data according to claim 6, wherein The steps of constructing a visitor risk model based on the risk data of the visitor and importing it to output the visitor risk coefficient are as follows: Perform a ratio process on the number of policy violations and the maximum allowable number of violations to obtain the policy violation number index; Import the policy violation number index, the unapproved access rate, and the abnormal session proportion into the constructed visitor risk model to output the visitor risk coefficient; The visitor risk model is expressed as: ； Among them, represents the visitor risk coefficient, represents the unapproved access rate, represents the proportion of abnormal sessions, represents the policy violation times index, represents the weight coefficient and , and the larger the value, the higher the visitor risk.

8. The security protection method for computer data according to claim 7, wherein The visitor security model is expressed as: ； Among them, represents the visitor safety factor, represents the visitor risk factor, represents the visitor permission range factor, represents the permission amplification factor.

9. The security protection method for computer data according to claim 8, wherein The data-access security matching model is expressed as: ； Among them, represents the data-access security matching degree, represents the data security coefficient, represents the visitor security coefficient, represents the asymmetry tolerance coefficient, and the larger the value, the higher the matching degree between the visitor security coefficient and the data security coefficient.

10. The security protection method for computer data according to claim 9, characterized in that, The steps of comparing the obtained data-access security matching degree with the corresponding threshold to obtain the operation permission of the current visitor for the current saved data are as follows: If , it means that the security factor of the current visitor highly matches the security factor of the saved data, and viewing, modification, and export are allowed; If , it means that the security factor of the current visitor moderately matches the security factor of the saved data, and viewing and modification are allowed; If , it means that the security factor of the current visitor has a low match with the security factor of the saved data, and viewing is allowed; If , it means that the security factor of the current visitor does not match the security factor of the saved data, and access is refused and an alarm is triggered.

Images