Multi-level dynamic data access control method and device based on credential environment

Abstract

The invention provides a multi-level dynamic data access control method and device based on a credential environment, and the method comprises the steps: obtaining a data access request initiated by a user and associated environment state information, carrying out the multi-factor authentication processing of a user identity, and combining the pre-stored user role attribute information and responsibility division data, thereby achieving the multi-level dynamic data access control. Generating an initial permission set of the user for the data resource identifier; extracting historical access behavior records of the user in the credential environment to generate historical access behavior characteristics, extracting real-time state characteristics in combination with the environment state information, performing association analysis on the historical access behavior characteristics and the real-time state characteristics, and generating a risk assessment result of the user access behavior; and adjusting access permission configuration of the user to the data resource identifier, generating a permission control instruction, and executing permission control operation of accessing the data resource identifier by the user. According to the method, the accuracy, the dynamic adaptability, the safety and the reliability of data access control in the credential environment are improved.

Description

Technical Field

[0001] The present invention relates to the field of access control, and in particular to a multi-level dynamic data access control method and device based on an information and communication environment. Background Art

[0002] With the development of information technology and the popularization of the trusted computing environment, data access control technology is crucial in ensuring the security of information systems. The core goal is to allow users to access only data resources within their authority scope, preventing unauthorized access and data leakage. Current data access control methods usually include two main links: identity authentication and authority allocation. Identity authentication is mostly based on single or two-factor verification methods, while authority allocation is mainly based on static authority templates preset by user roles or positions. Access requests are allowed or denied by verifying the matching relationship between user identity and preset authority. However, existing technologies have certain limitations in practical applications. For example, the identity authentication process lacks awareness of the environmental status and is difficult to identify the risk of identity fraud in abnormal environments. Authority allocation relies on static templates and cannot adjust the authority scope according to the user's real-time access behavior pattern and dynamic changes in the environment. As a result, in complex trusted computing environments, either the efficiency of legitimate access is affected due to excessive rigidity of authority, or security vulnerabilities exist due to insufficient dynamic adaptability, making it difficult to achieve a balance between security and flexibility. Summary of the Invention

[0003] The present invention provides a multi-level dynamic data access control method and device based on a trusted innovation environment.

[0004] In the first aspect, an embodiment of the present invention provides a multi-level dynamic data access control method based on a trusted innovation environment, the method comprising: obtaining a data access request initiated by a user and associated environmental status information, the data access request including a user identity and a data resource identifier requested for access, the environmental status information including device operation status information of the physical layer, connection status information of the network layer, and access context information of the application layer in the trusted innovation environment; performing multi-factor authentication processing on the user identity, and generating an initial permission set for the user for the data resource identifier in combination with pre-stored user role attribute information and responsibility division data; extracting historical access behavior records of the user in the trusted innovation environment to generate historical access behavior features, extracting real-time status features in combination with the environmental status information, performing correlation analysis on the historical access behavior features and the real-time status features, and generating a risk assessment result of the user access behavior; adjusting the user's access permission configuration for the data resource identifier based on the initial permission set and the risk assessment result, and generating a permission control instruction; based on the permission control instruction, executing permission control operations for the user's access to the data resource identifier, and recording permission change information and access operation logs during the permission control process.

[0005] In the second aspect, an embodiment of the present invention provides a multi-level dynamic data access control device, including: a memory, in which a computer program is stored; a processor, used to load the computer program to implement the multi-level dynamic data access control method based on the trusted innovation environment as described above.

[0006] The multi-level dynamic data access control method based on the trusted innovation environment provided by the present invention realizes the comprehensive perception of the full-stack environment status of the access scenario by obtaining the user data access request and the associated physical layer device operation status information, network layer connection status information and application layer access context information, so that the access control decision can fully consider the real-time operation status of each level of the trusted innovation environment; by performing multi-factor authentication processing on the user identity identification and combining the pre-stored user role attribute information and responsibility division data to generate the initial permission set, the reliability of the identity authentication is deeply bound with the user's organizational role and job responsibility, so that the initial permission allocation meets the identity authenticity requirements and matches the user's actual responsibility requirements; by extracting the user's historical access behavior records to generate the historical The system combines historical access behavior characteristics with environmental status information to extract real-time status characteristics and conducts correlation analysis to generate risk assessment results, realizing two-dimensional risk perception of historical patterns of user access behavior and current environmental dynamics, and improving the comprehensiveness and accuracy of risk assessment; by adjusting user access permission configuration according to the initial permission set and risk assessment results, permission control not only follows the rigid permission framework based on role responsibilities, but also can flexibly adapt to real-time risk status, avoiding the limitation of static authorization that is difficult to cope with complex environmental changes; by executing permission control operations and recording permission change information and access operation logs, the access process is traceable and auditable, thereby improving the accuracy, dynamic adaptability, security and reliability of data access control in the information innovation environment as a whole. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Figure 1 This is a flowchart of a multi-level dynamic data access control method based on a trusted innovation environment provided by an embodiment of the present invention; Figure 2 This is a schematic diagram of the composition of a multi-level dynamic data access control device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0008] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0009] See also Figure 1 , Figure 1A flowchart of a multi-level dynamic data access control method based on a trusted computing environment is provided in an embodiment of the present invention. The method is executed by a multi-level dynamic data access control device, and the method includes the following steps: Step S100: Obtain a data access request initiated by a user and associated environmental status information. The data access request includes a user identity identifier and a data resource identifier requested for access. The environmental status information includes device operation status information of the physical layer in the trusted computing environment, connection status information of the network layer, and access context information of the application layer.

[0010] A data access request is a request from a user to the trusted computing environment to obtain data resources. The user identity is information used to uniquely identify the user, such as the user's account name, ID number, etc. This identifier can be used to distinguish different individual users. The data resource identifier requested for access is the identifier of the data resource to be accessed, such as a database table name, file path, etc. The environmental status information reflects the current status of the trusted computing environment at the physical layer, network layer, and application layer. The device operation status information at the physical layer describes the operation of the hardware devices in the trusted computing environment, such as the server's CPU usage, memory occupancy, and storage media read and write speeds. This information reflects the current usage and performance of the device's computing, storage, and other resources. The connection status information at the network layer involves network communication, including the type of transmission protocol on which the network connection is based, such as TCP / IP, the data transmission rate, that is, the amount of data transmitted per unit time, and network latency, that is, the time it takes for data to be transmitted from the sender to the receiver. The access context information at the application layer is related to the application and user operations, such as the application identifier that initiates the access request, which can clearly indicate which application initiated the request; the interface element characteristics of the user's current operating interface, such as the types of controls such as buttons and text boxes on the interface; and the way the access request was initiated, that is, whether the request was initiated through a local client or a remote terminal.

[0011] Data access requests can be obtained by listening at the application programming interface (API) of the trusted computing environment. When a user initiates a request, the API captures the request and extracts the user identity and the data resource identifier requested for access. For environmental status information, system monitoring tools can be used to obtain physical layer device operating status information. For example, in a Linux system, the top command can be used to view CPU and memory usage, and the iostat command can be used to view the read and write speeds of storage media. Network layer connection status information can be obtained through network monitoring software such as Wireshark, which can capture network data packets and analyze information such as the transmission protocol, data transmission rate, and network latency. Obtaining application layer access context information can be logged in the application, recording the application's identification, element information of the user interface, and the path by which the request was initiated.

[0012] Step S200: Perform multi-factor authentication on the user identity, combine pre-stored user role attribute information and responsibility division data, and generate an initial permission set for the user for the data resource identifier.

[0013] Multi-factor authentication is the process of verifying user identity through a variety of different types of authentication credentials, with the goal of improving the security and accuracy of identity authentication. Pre-stored user role attribute information is information related to user roles that is pre-stored in the permission management database of the trusted innovation environment, including role hierarchy characteristics, such as senior administrators, ordinary users and other different levels; data access scope characteristics, that is, the range of data resources that the role can access; operation permission type characteristics, such as the types of operations that can be queried, modified, deleted, etc. Responsibility division data is data that specifies the responsibilities and permissions of different positions in detail, including a list of standard data access permissions corresponding to different position characteristic information, that is, the data resources that the position can access and the operations that can be performed, as well as the time range for the effectiveness of permissions, which specifies the time period during which these permissions are valid.

[0014] The initial permission set is a set of permissions for data resource identifiers identified by users based on multi-factor authentication results, user role attribute information, and division of responsibilities data. It includes the types of access operations allowed, such as reading and writing; data access granularity, that is, the size of the accessible data range, for example, whether the entire data table or some fields can be accessed; and the validity period of the permission, which specifies how long the permission is valid.

[0015] When performing multi-factor authentication on a user's identity, the user's identity is first parsed to extract key information, and then multiple authentication credentials are used for collaborative verification. When generating the initial permission set based on pre-stored information, the relevant user role attribute information is retrieved based on the authenticated user's identity subject information. This information is then used to query the responsibility division data. Finally, the permission items corresponding to the data resource identifier are selected and their validity is verified.

[0016] As an implementation method, step S200 may specifically include the following steps S210~S250: Step S210: Parse the user identity identifier and extract the user identity subject information, which includes organizational affiliation information, job feature information and unique identity coding information related to the user identity.

[0017] The user identity identifier is a string or code that contains a variety of information. Parsing the identifier will extract the key information. Organizational affiliation information indicates the organization or department to which the user belongs, such as a business unit of a company, a college of a school, etc., reflecting the user's position in the organizational structure. Job characteristic information describes the characteristics of the user's job position, such as software development engineer, financial analyst, etc., reflecting the user's job responsibilities and professional fields. Unique identity coding information is a code used to uniquely identify the user, ensuring the uniqueness of the user's identity in the entire information and innovation environment.

[0018] To parse user identities, you can use regular expression matching to extract organizational information, job characteristics, and unique identity code information from the identity string based on predefined identity format rules. For example, if the user identity format is "organization code-job code-unique code," you can use regular expressions to match and extract the corresponding information.

[0019] Step S220: Call the multi-factor authentication component in the trusted computing environment to perform authentication processing on the user's identity subject information. The authentication processing includes collaborative verification of the first authentication credential generated based on the hardware authentication device held by the user, the second authentication credential generated based on the user's biometrics, and the third authentication credential generated based on the user's knowledge information.

[0020] The multi-factor authentication component is a module specifically designed for multi-factor identity authentication within a trusted computing environment. It integrates multiple authentication methods and verification logic. The first authentication credential is generated by a hardware authentication device held by the user, such as a smart card or USB key. The hardware authentication device has a built-in encryption algorithm. When it receives an authentication request, it generates a unique authentication credential based on this algorithm. The second authentication credential is generated based on the user's biometrics, which include fingerprints, facial features, and irises. This biometric information is obtained through a biometric acquisition device and preprocessed and extracted to generate a representative authentication credential. The third authentication credential is generated based on the user's knowledge information, which can include a preset password or answers to security questions. After the user enters this knowledge information, the system performs format verification and content matching to generate the corresponding authentication credential. Collaborative verification involves simultaneously verifying all three authentication credentials. Multi-factor authentication is considered successful only when all three pass verification. This significantly improves the security of identity authentication, as an attacker would need to simultaneously obtain the user's hardware authentication device, biometrics, and knowledge information to successfully authenticate.

[0021] As an implementation method, step S220 may specifically include the following steps S221~S225: Step S221: Send an authentication request instruction to the hardware authentication device held by the user, the hardware authentication device generates a first authentication credential based on a built-in encryption algorithm, and returns the first authentication credential to the multi-factor authentication component.

[0022] An authentication request is a message sent by the multi-factor authentication component to the hardware authentication device, triggering it to generate an authentication credential. The encryption algorithm built into the hardware authentication device is typically a complex mathematical algorithm, such as the Advanced Encryption Standard (AES). Upon receiving the authentication request, the hardware authentication device processes the key or seed data stored internally according to the algorithm to generate a unique first authentication credential. This credential can be an encrypted string or sequence of numbers.

[0023] The authentication request instruction can be sent through a hardware device interface, such as a USB interface, a Bluetooth interface, etc. The multi-factor authentication component will send the instruction according to the communication protocol specified by the hardware device. After receiving the instruction, the hardware authentication device will process it and return the generated first authentication credential to the multi-factor authentication component through the same interface.

[0024] Step S222: Obtain the user's biometric information through the biometric collection device in the trusted innovation environment, pre-process the biometric information, and generate a second authentication credential.

[0025] Biometric collection devices are devices specifically designed to collect user biometrics, such as fingerprint sensors, facial recognition cameras, and iris recognition sensors. To obtain biometric information, users place the corresponding body part at the designated location on the collection device, such as placing their finger on the fingerprint sensor or facing the facial recognition camera. The collection device captures raw biometric data, such as fingerprint ridge images and facial pixel data. Preprocessing involves performing operations such as cleaning, noise reduction, and feature extraction on the collected biometric information. Cleaning removes noise and interfering information from the collected data, such as stains in fingerprint images and shadows in facial images. Noise reduction further reduces random noise in the data, improving data quality. Feature extraction extracts representative features from the processed data, such as fingerprint feature points and key facial feature vectors. These features are encoded and encrypted to generate a secondary authentication credential.

[0026] Step S223: prompting the user to input preset knowledge information, performing format verification and content matching on the knowledge information input by the user, and generating a third authentication credential.

[0027] Prompting users to enter preset knowledge information can be displayed through the user interface of the trusted innovation environment, such as by popping up a dialog box prompting the user to enter a password or answer to a security question. Format verification checks whether the knowledge information entered by the user meets pre-set format requirements, such as password length and character type. Content matching compares the knowledge information entered by the user with pre-stored knowledge information benchmark values ​​to determine whether they are consistent.

[0028] If the knowledge information entered by the user is formatted correctly and its content matches the reference value, a third authentication credential is generated. This third authentication credential can be generated by performing a hash operation on the input information, generating a fixed-length hash value as the authentication credential. A hash operation is a one-way encryption algorithm, such as MD5 or SHA-256, that can convert input information of any length into a fixed-length hash value that is unique and irreversible.

[0029] Step S224: calling the authentication verification module through the multi-factor authentication component, comparing the first authentication credential with the pre-stored hardware device authentication reference value, and calculating the first matching degree; comparing the second authentication credential with the pre-stored biometric reference template, and calculating the second matching degree; comparing the third authentication credential with the pre-stored knowledge information reference value, and calculating the third matching degree.

[0030] The authentication verification module is a submodule within the multi-factor authentication component, specifically designed to verify and match various authentication credentials. The pre-stored hardware device authentication reference value is obtained by storing the initial authentication credentials generated by the hardware device when the user registers the hardware authentication device. When comparing the first authentication credential with this reference value, a string comparison algorithm can be used to calculate the similarity between them and obtain a first degree of match. For example, the Levenshtein distance algorithm can be used to calculate the edit distance between two strings. The smaller the edit distance, the higher the degree of match.

[0031] The pre-stored biometric reference template is obtained by processing and storing the biometric information collected during the user's initial biometric registration. When comparing the second authentication credential with this reference template, a feature matching algorithm, such as a template matching algorithm or a machine learning-based classification algorithm, can be used. A second match degree is obtained by calculating the similarity between the two.

[0032] The pre-stored knowledge information reference value is obtained by encrypting and storing the user's preset knowledge information. When comparing the third authentication credential with the reference value, a string comparison or hash value comparison method can also be used to calculate the third matching degree.

[0033] Step S225: When the first matching degree, the second matching degree, and the third matching degree are all higher than their respective preset matching thresholds, the multi-factor authentication is determined to be successful; otherwise, the multi-factor authentication is determined to have failed, and a prompt message indicating the reason for the authentication failure is generated. The prompt message indicating the reason for the authentication failure includes the type of credential that failed to pass the authentication and the corresponding matching degree information.

[0034] The preset match threshold is a pre-set standard value used to determine whether the authentication credentials have passed verification. Different authentication credentials may have different thresholds. For example, the preset match threshold for the first authentication credential may be set at 90%, the threshold for the second authentication credential may be set at 80%, and the threshold for the third authentication credential may be set at 95%. When the first, second, and third match degrees are all above their respective thresholds, it indicates that all three authentication credentials have passed verification, and multi-factor authentication is considered successful.

[0035] If any of the authentication credentials matches below the corresponding preset matching threshold, the multi-factor authentication is considered to have failed. At this time, the multi-factor authentication component will generate a prompt message indicating the reason for the authentication failure, clearly indicating which authentication credential failed to pass the verification.

[0036] Step S230: When the first authentication credential, the second authentication credential and the third authentication credential all pass verification, the user role attribute information associated with the user identity subject information is retrieved from the authority management database of the trusted innovation environment. The user role attribute information includes role hierarchy characteristics, data access scope characteristics and operation authority type characteristics.

[0037] The rights management database is a database specifically used to store information related to user rights within the trusted computing environment. Once multi-factor authentication is successful, the user's identity is verified. The database can then be used to query the associated user role attributes based on the user's identity information. Because the organizational affiliation, job characteristics, and unique identity code information contained in the user's identity information uniquely identify the user's role and rights, the database uses this information for precise matching and querying.

[0038] The role level feature indicates the user's role level within the organization, such as senior management, middle management, and general employee. The data access scope feature specifies the range of data resources that the role can access, such as a department's database tables and file directories. The operation permission type feature clarifies the types of operations that the role can perform on data resources, such as query, insert, update, and delete.

[0039] To retrieve information from the permissions management database, you can use Structured Query Language (SQL) to query it. For example, if the database table is named "user_roles" and contains the fields "user_id" (corresponding to the unique identity code in the user identity principal information), "role_level" (characteristic of role level), "data_access_range" (characteristic of data access scope), and "operation_permissions" (characteristic of operation permission type), you can use the following SQL statement to query: SELECT role_level,data_access_range,operation_permissions FROM user_roles WHERE user_id = 'user unique identity code'.

[0040] Step S240: Query preset duty division data based on user role attribute information. The duty division data includes a list of standard data access permissions corresponding to different job characteristics and a time range for the permissions to take effect.

[0041] Pre-defined division of responsibilities data is a collection of data that details the responsibilities and permissions of different positions within the trusted computing environment. It is typically stored in a dedicated database table or configuration file. Based on the position characteristics in the user role attributes, the corresponding standard data access permission list and permission validity period can be found in the division of responsibilities data.

[0042] The standard data access permissions list details the data resources a role can access and the actions it can perform. For example, a finance role might have access to the financial report database and permissions to query and print reports. The permission validity period specifies the time period during which these permissions are valid, such as weekdays from 9:00 AM to 6:00 PM.

[0043] To query division of responsibilities data, you can use database query operations or configuration file parsing operations. If the division of responsibilities data is stored in the database, you can use SQL statements to query it. For example, if the database table is named "job_responsibilities" and contains the fields "job_feature" (job feature information), "standard_permission_list" (standard data access permission list), and "permission_valid_time_range" (permission validity time range), you can use the following SQL statement to query: SELECT standard_permission_list, permission_valid_time_range FROM job_responsibilities WHERE job_feature = 'User job feature information'. If the division of responsibilities data is stored in a configuration file, such as a JSON or XML file, you can use the corresponding parsing library to parse and search it.

[0044] Step S250: Match the standard data access permission list with the data resource identifier, filter out the permission items corresponding to the data resource identifier, verify the validity of the filtered permission items in combination with the permission effective time range, and generate the user's initial permission set for the data resource identifier. The initial permission set includes the type of access operation allowed, the data access granularity and the validity period of the permission.

[0045] Matching the standard data access permission list with the data resource identifier is to check which permission items in the list are related to the data resource identifier that the user requests access to. For example, the standard data access permission list may list the access permissions for multiple data resources, and the user requests access to one of the data resources. In this case, it is necessary to filter out the permission items corresponding to the data resource. The screening process can be performed through string matching or regular expression matching. For example, if the data resource identifier is a file path, and the standard data access permission list lists the permissions for multiple file paths, the relevant permission items can be filtered out by comparing whether the path strings are identical or contain a relationship.

[0046] The validity of the selected permission items is checked against the permission effective time range. This means checking whether the current time is within the permission effective time range. If the current time is not within the range, the permission item is invalid. For example, if the permission effective time range is 9:00-18:00 on weekdays and the current time is Saturday, the permission item is invalid.

[0047] The types of access operations permitted in the generated initial permission set are those specified in the filtered and valid permission items, such as query and modify. Data access granularity refers to the size of the accessible data range, for example, whether access is granted to the entire table or only a subset of fields. The permission validity period is the remaining validity period of the permission, calculated by combining the permission's effective time range and the current time.

[0048] Step S300: Extract the user's historical access behavior records in the trusted computing environment to generate historical access behavior features, extract real-time status features in combination with environmental status information, perform correlation analysis on the historical access behavior features and real-time status features, and generate risk assessment results for the user's access behavior.

[0049] Historical access behavior records are a record of past user access operations within the trusted computing environment. They include historical access timestamps, which indicate the specific time of each access; historical access resource identifiers, which clearly identify the data resources accessed; historical access operation types, such as query, insert, and delete; and historical access environment status parameters, such as the device operating status and network connection status at the time. Extracting historical access behavior features involves mining these records to identify characteristics that reflect user access behavior patterns and regularities.

[0050] Real-time status features are extracted based on current environmental status information, including key features from physical layer device operating status, network layer connection status, and application layer access context information. Correlation analysis examines the relationship between historical access behavior features and real-time status features to determine whether the current user's access behavior poses a risk.

[0051] The risk assessment result is a quantification and description of the risk potential of the user's current access behavior. It includes a risk value, which is used to indicate the magnitude of the risk, and a description of abnormal feature components, which indicates which features deviate from normal behavior patterns.

[0052] As an implementation method, in step S300, the historical access behavior records of the user in the trusted innovation environment are extracted to generate historical access behavior features, which can specifically include the following steps S310~S360: Step S310: Retrieve the historical access behavior records corresponding to the user identity from the access log database of the trusted innovation environment. The historical access behavior records include the historical access timestamp, the historical access data resource identifier, the historical access operation type and the status parameters of the historical access environment.

[0053] The access log database is a database specifically used to record user access behavior in the trusted computing environment. The corresponding historical access behavior records can be accurately retrieved from the database through user identity identification. The historical access timestamp records the specific time when each access occurred, which helps to analyze the user's access time pattern, such as whether it is frequently accessed within a set time period. The data resource identifier of the historical access clarifies the specific data resources accessed by the user, which facilitates the analysis of the user's access preferences for different data resources. The historical access operation type indicates the operations performed by the user during the access process, such as query, modification, etc., reflecting the user's operating habits. The status parameters of the historical access environment record the device operation status, network connection status, etc. at the time. This information can help determine the impact of environmental factors on user access behavior.

[0054] Historical access behavior records can be retrieved using SQL queries. For example, if the access log database table is named "access_logs" and contains the fields "user_id" (user identity), "access_timestamp" (historical access timestamp), "data_resource_id" (historical access data resource identifier), "access_operation_type" (historical access operation type), and "environment_status_params" (historical access environment status parameters), you can use the following SQL query: SELECT access_timestamp,data_resource_id,access_operation_type,environment_status_params FROM access_logs WHERE user_id = 'user identity'.

[0055] Step S320: performing time window division processing on the historical access behavior records, dividing the historical access behavior records within a continuous preset time period into multiple historical access time periods, each historical access time period containing at least one historical access behavior record.

[0056] Time windowing is used to group historical access records into chronological order, facilitating subsequent feature extraction and analysis. The preset duration is a pre-set time span, and continuous historical access records are divided into multiple historical access periods based on this preset duration.

[0057] Step S330: for each historical access period, count the number of different data resource identifiers accessed in the historical access period and the access frequency of each data resource identifier to generate a data resource access distribution feature.

[0058] Counting the number of different data resource identifiers accessed during each historical access period can reflect the breadth of a user's access to data resources during that period. Counting the access frequency of each data resource identifier can help understand a user's preference for different data resources.

[0059] The data resource access distribution characteristics are a collection of these statistical results. They can be represented by a vector or matrix, where each element of the vector corresponds to the access frequency of a data resource identifier, or by a table listing different data resource identifiers and their access numbers and frequencies.

[0060] Step S340: extracting sequence information of historical access operation types within each historical access period, analyzing conversion relationships between adjacent access operation types, and generating operation type conversion features.

[0061] The sequence information of historical access operation types is a chronological sequence of access operation types within each historical access period. For example, the sequence of operation types within a historical access period might be "query-query-insert-delete." Analyzing the conversion relationship between adjacent access operation types is to study the probability and pattern of conversion from one operation type to another. For example, the number of conversions from query operations to insert operations, and the number of conversions from insert operations to delete operations, etc., across all historical access periods can be counted. These statistical data can be used to obtain an operation type conversion matrix, where the elements of the matrix represent the probability of conversion from one operation type to another. The operation type conversion feature is this operation type conversion matrix or related statistical information, which reflects the pattern of conversion of user operation types during the access process.

[0062] Step S350: Calculate the time interval between two adjacent historical access behavior records in combination with the historical access timestamps, count the occurrence frequencies of different time intervals, and generate access time interval features.

[0063] To calculate the time interval between two consecutive access records, combine historical access timestamps by subtracting the timestamp of the previous access from the timestamp of the latter. To count the frequency of occurrence of different time intervals, count the number of times each time interval appears in all historical access records and calculate its proportion to the total number of occurrences. The access time interval feature is a collection of these different time intervals and their frequencies, which can be represented by a histogram or probability distribution function. By analyzing this feature, we can understand the temporal patterns of user access behavior, such as whether users have regular intervals between visits.

[0064] Step S360: perform feature fusion processing on the data resource access distribution features, operation type conversion features and access time interval features to generate historical access behavior features with time series correlation. The dimension of the historical access behavior features corresponds to the number of historical access time periods.

[0065] Feature fusion processing integrates different types of features to form a comprehensive feature representation. Data resource access distribution features, operation type conversion features, and access time interval features each describe a user's historical access behavior from different perspectives, but they are independent of each other. Having temporal correlation means that this feature can reflect the changes and sequential relationships in user behavior within different historical access periods. For example, within different historical access periods, the data resource access distribution, operation type conversion, and access time interval may vary, and the fused features can reflect these temporal differences. The dimension of the historical access behavior feature corresponds to the number of historical access periods, meaning that each historical access period corresponds to a feature vector or feature value, which facilitates subsequent analysis and comparison. Feature fusion can use methods such as weighted summation and principal component analysis. For example, when using the weighted summation method, each feature is assigned a weight, and then they are added together according to the weight to obtain the fused feature.

[0066] As an implementation method, in step S300, real-time status features are extracted in combination with environmental status information, which can specifically include the following steps S370~S3100: Step S370: parse the physical layer device operation status information in the environmental status information, and extract the device's CPU usage characteristics, memory occupancy characteristics, and storage medium read and write speed characteristics. The CPU usage characteristics reflect the current occupancy of the device's computing resources, the memory occupancy characteristics reflect the current usage of the device's memory resources, and the storage medium read and write speed characteristics reflect the response performance of the device's storage resources.

[0067] Physical layer device operating status information includes various operating parameters and status data. Parsing this information involves extracting key features from the raw data. CPU usage refers to the proportion of computing resources currently being used by the device's central processing unit (CPU). Memory usage refers to the size or proportion of memory currently occupied on the device. Storage media read / write speed refers to the speed at which storage devices (such as hard drives and solid-state drives) perform data read and write operations, such as the amount of data read / written per second.

[0068] To analyze the operating status of physical layer devices, use system monitoring tools or device management interfaces. For example, in Windows, you can use Task Manager to view CPU usage and memory usage, and Performance Monitor to obtain more detailed storage media read and write speed data. In Linux, use the top command to view CPU and memory usage, and the iostat command to view storage media read and write speeds.

[0069] Step S380: parse the network layer connection status information in the environmental status information, and extract the transmission protocol type characteristics, data transmission rate characteristics and network delay characteristics of the network connection. The transmission protocol type characteristics reflect the communication protocol standard based on which the current network connection is based, the data transmission rate characteristics reflect the amount of data transmitted per unit time, and the network delay characteristics reflect the transmission time of data from the sending end to the receiving end.

[0070] Network layer connection status information describes network communication conditions. Parsing this information involves extracting key network features from raw data. The transport protocol type feature indicates the communication protocol used by the current network connection, such as TCP / IP or UDP. Different transport protocols have different characteristics and application scenarios. Understanding the transport protocol type can help determine the reliability and performance of the network connection. The data rate feature refers to the amount of data transmitted over the network per unit time, typically measured in bits per second (bps) or bytes per second (bps). For example, a data rate of 10 Mbps indicates that 10 megabits of data can be transmitted per second. The network latency feature refers to the transmission time from sender to receiver, typically measured in milliseconds (ms). Network monitoring software, such as Wireshark, can be used to parse network layer connection status information. It can capture network packets and analyze information such as the transport protocol type, data rate, and network latency. Alternatively, you can use network diagnostic tools provided by your operating system, such as the ping command to measure network latency and the netstat command to view network connection status and transport protocol type.

[0071] Step S390: parse the application layer access context information in the environment status information, extract the application identification features of the current access request, the interface element features of the user's current operation interface, and the initiation path features of the access request. The application identification features reflect the identity of the application that initiates the access request, the interface element features reflect the type of interface control operated by the user, and the initiation path features reflect whether the access request is initiated through a local client or a remote terminal.

[0072] Application-layer access context information is related to applications and user operations. Parsing this information is to extract key application-layer features from the raw data. The application identification feature is information used to uniquely identify the application that initiated the access request, such as the application name, version number, etc. This feature can be used to determine which application initiated the request, facilitating permission management and security audits. The interface element feature is the type of control on the user's current operating interface, such as buttons, text boxes, drop-down lists, etc. Understanding the interface element features can analyze user operating habits and behavior patterns. The initiation path feature indicates whether the access request was initiated through a local client or a remote terminal, for example, whether the user initiated the request using an application on the local computer or through an application on a remote server.

[0073] Parsing application-layer access context information allows for logging and analysis within the application. For example, logging statements can be added to the application code to record the application's identity, user interface elements, and the path through which the request was initiated. These records can then be parsed and extracted using log analysis tools.

[0074] Step S3100: Standardize the features extracted from the physical layer device operation status information, the network layer connection status information, and the application layer access context information to eliminate the dimensional differences between different types of features and generate real-time status features with a unified feature space representation.

[0075] Different types of features may have different dimensions and numerical ranges. For example, CPU utilization is expressed as a percentage, and data transmission rate is expressed in bits per second. Standardization converts these features to a unified numerical range and scale so that they can be compared and analyzed within the same feature space. Standardization can be performed using a variety of methods, such as the Z-score standardization method. This method first calculates the mean and standard deviation of each feature, then subtracts the mean from each feature value and divides it by the standard deviation. This transforms the feature value into a standard normal distribution with a mean of 0 and a standard deviation of 1. Through standardization, the dimensional differences between different types of features are eliminated, and the resulting real-time status features can more accurately reflect the overall state of the current environment.

[0076] As an implementation method, in step S300, historical access behavior features and real-time status features are correlated and analyzed to generate risk assessment results of user access behavior, which can specifically include the following steps S3110~S3150: Step S3110: Input historical access behavior features and real-time status features into a pre-trained feature association model, and perform dimension matching processing on the historical access behavior features and real-time status features through the feature alignment layer therein, so that the two are consistent in feature dimensions.

[0077] The pre-trained feature association model is a model pre-trained on a large amount of data. It can learn the relationship between historical access behavior features and real-time status features. The feature alignment layer is used to match the dimensions of the two input features.

[0078] Historical access behavior features and real-time status features may have different feature dimensions. Dimension matching involves adjusting the features through the feature alignment layer so that their dimensions are the same. This can be achieved by adding or removing certain feature dimensions or performing linear transformations on the features. For example, if a dimension of a historical access behavior feature has a similar meaning to a dimension of a real-time status feature, they can be merged. If a feature dimension does not exist in the other feature, a default value can be added or a value for that dimension can be generated through interpolation.

[0079] Step S3120: Call the cross-attention mechanism module of the feature association model, calculate the correlation strength between the dimensional features in the historical access behavior features and the dimensional features in the real-time status features, and generate a feature association weight matrix. The element values ​​in the feature association weight matrix represent the degree of mutual influence between the corresponding dimensional features.

[0080] The cross-attention mechanism module is a component of the feature association model that automatically learns the associations between different features. This module interacts and calculates historical access behavior features and real-time status features to find the strength of the association between them.

[0081] The process for calculating association strength is as follows: First, historical access behavior features and real-time status features are represented as vectors. Then, the cross-attention mechanism module performs attention calculations on these two vectors, calculating the correlation between each dimension feature and the features of other dimensions. Specifically, each dimension feature is assigned an attention weight, indicating the degree of correlation between that feature and the other features. These attention weights are combined to generate a feature association weight matrix. Larger element values ​​in the matrix indicate a stronger mutual influence between the corresponding dimension features.

[0082] Step S3130: Perform weighted fusion processing on the historical access behavior features and the real-time status features based on the feature association weight matrix to generate a fusion association feature vector. The fusion association feature vector contains comprehensive information of the user's historical behavior pattern and the current environment status.

[0083] Weighted fusion processing involves weighted summation of historical access behavior features and real-time status features based on the weights in the feature association weight matrix. Specifically, matrix multiplication is performed on the historical access behavior features and real-time status features with the feature association weight matrix to obtain weighted feature vectors. These two weighted feature vectors are then added together to obtain a fused association feature vector. This fused association feature vector contains comprehensive information about the user's historical behavior patterns and current environmental conditions. For example, historical access behavior features reflect a user's past access habits and patterns, while real-time status features reflect current environmental conditions. By combining these two types of information through weighted fusion, a more comprehensive assessment of user access behavior can be achieved.

[0084] As an implementation method, step S3130 may specifically include the following steps S3131 to S3135: Step S3131: perform feature standardization processing on the historical access behavior features, convert the feature values ​​of each dimension into a preset numerical range, and generate standardized historical behavior features.

[0085] Feature normalization converts the feature values ​​of each dimension of historical access behavior features to a preset numerical range, such as the [0, 1] range. This eliminates dimensional differences between features of different dimensions and makes them comparable. This can be done using the Min-Max normalization method. The steps are as follows: First, find the minimum and maximum values ​​of each dimension. Then, for each feature value, subtract the minimum value of that dimension and divide it by the difference between the maximum and minimum values. In this way, the feature values ​​are mapped to the [0, 1] range, generating standardized historical behavior features.

[0086] Step S3132: perform feature standardization processing on the real-time status features, and generate standardized real-time status features based on the same preset numerical range as the historical access behavior features; perform matrix multiplication operation on the standardized historical behavior features and the feature association weight matrix to generate weighted historical behavior features.

[0087] The Min-Max normalization method is also used to normalize the real-time status features, converting the feature values ​​of each dimension to the same preset numerical range as the historical access behavior features, such as the [0, 1] range. This ensures that the standardized historical access behavior features and real-time status features are on the same scale.

[0088] Performing matrix multiplication on the standardized historical behavior features and the feature association weight matrix involves multiplying the feature value of each dimension of the standardized historical behavior features by the corresponding weight value in the feature association weight matrix. In this way, the historical access behavior features are weighted according to the strength of the association between the features to generate weighted historical behavior features.

[0089] Step S3133: Perform matrix multiplication on the standardized real-time state feature and the feature association weight matrix to generate a weighted real-time state feature; perform element-level addition on the weighted historical behavior feature and the weighted real-time state feature to obtain an initial fused feature vector.

[0090] Perform matrix multiplication on the standardized real-time state features and the feature-association weight matrix. Similarly, multiply the feature value of each dimension of the standardized real-time state features by the corresponding weight value in the feature-association weight matrix to generate the weighted real-time state features. Perform element-wise addition on the weighted historical behavior features and the weighted real-time state features, adding the elements in corresponding positions in the two vectors.

[0091] Step S3134: Perform feature enhancement processing on the initial fused feature vector, and perform mapping transformation on each element in the initial fused feature vector through a nonlinear activation function to generate an enhanced fused feature vector with nonlinear expression capability.

[0092] Feature enhancement is used to improve the expressive power of the fused feature vector, enabling it to better capture complex feature relationships. Nonlinear activation functions can introduce nonlinear factors and perform nonlinear mapping transformations on the elements in the initial fused feature vector.

[0093] An example of a nonlinear activation function is the ReLU (Rectified Linear Unit) function, expressed as f(x) = max(0, x). Each element in the initial fused feature vector is substituted into the ReLU function to obtain the transformed value. This generates an enhanced fused feature vector with nonlinear expression capabilities.

[0094] Step S3135: Perform feature dimensionality reduction processing on the enhanced fusion feature vector, retain the main feature components of a preset proportion based on the principal component analysis method, and generate a dimensionally simplified fusion-related feature vector, where the dimension of the fusion-related feature vector is lower than that of the initial fusion feature vector.

[0095] Feature dimensionality reduction aims to reduce the dimensionality of the eigenvectors while preserving their essential information. When performing principal component analysis (PCA), the covariance matrix of the enhanced fused eigenvectors is first calculated. The eigenvalues ​​and eigenvectors of the covariance matrix are then calculated. The eigenvalues ​​indicate the importance of each eigenvector, while the eigenvectors represent the direction of the principal components of the data. The first N principal components with the largest eigenvalues ​​are selected as the principal eigencomponents, where N is the number corresponding to a preset ratio. The enhanced fused eigenvectors are then projected onto these principal eigencomponents to obtain a dimensionality-reduced fused correlation eigenvector.

[0096] Step S3140: Input the fused correlation feature vector into the risk assessment model, perform abnormal pattern detection on the fused correlation feature vector through the risk identification layer therein, and identify abnormal feature components that deviate from the normal access behavior pattern.

[0097] The risk assessment model is specifically designed to evaluate the risks of user access behavior, with the risk identification layer being its core component. Abnormal pattern detection uses the risk identification layer to analyze and fuse associated feature vectors to identify characteristic components that are inconsistent with normal access behavior patterns.

[0098] Normal access behavior patterns are derived through training on a large amount of normal user access behavior data. The risk identification layer compares the fused correlation feature vector with the normal access behavior pattern and calculates the similarity between the two. If the similarity between a feature component and the normal pattern falls below a preset threshold, the feature component is considered abnormal.

[0099] As an implementation method, step S3140 may specifically include the following steps S3141 to S3145: Step S3141: Load the pre-trained normal access behavior pattern feature library through the risk identification layer. The normal access behavior pattern feature library contains feature vectors of multiple normal access samples. The feature vector of each normal access sample has the same dimension as the fusion-associated feature vector.

[0100] The pre-trained normal access behavior pattern feature library is trained on a large amount of normal user access behavior data. It contains feature vectors for multiple normal access samples, which reflect the access behavior patterns of normal users. The feature vectors for each normal access sample have the same dimensions as the fused correlation feature vector, facilitating comparison and matching.

[0101] Step S3142: Calculate the similarity between the fused correlation feature vector and the feature vector of each normal access sample in the normal access behavior pattern feature library to generate a similarity set.

[0102] There are various methods for calculating similarity, such as cosine similarity. Cosine similarity measures the similarity between two vectors by calculating the cosine of the angle between them. Specifically, the fused correlation feature vector and the feature vector of the normal access sample are represented as vectors. The dot product between them is then calculated and divided by the product of the moduli of the two vectors. The closer the resulting cosine value is to 1, the more similar the two vectors are.

[0103] The cosine similarity calculation is performed on the fusion correlation feature vector and the feature vector of each normal access sample in the normal access behavior pattern feature library, and the obtained similarity values ​​are combined to generate a similarity set.

[0104] Step S3143: Filter out a preset number of feature vectors of normal access samples with the highest similarity from the similarity set as a reference feature vector set.

[0105] The preset number is a pre-set value, for example, the feature vectors of the first 10 normal access samples with the highest similarity are selected. The first preset number of samples with the largest similarity values ​​are found from the similarity set, and their feature vectors are extracted to form a reference feature vector set.

[0106] The screening process can be performed by sorting the similarity set and then selecting the feature vectors corresponding to the first preset number of elements. This ensures that the reference feature vector set is the feature vector set of the normal access sample that is most similar to the fusion associated feature vector.

[0107] Step S3144: Calculate the feature component difference between the fused associated feature vector and each reference feature vector in the reference feature vector set to generate a feature component difference matrix, where each element in the feature component difference matrix represents the difference of the corresponding dimensional feature.

[0108] Perform element-by-element subtraction between the fused correlated feature vector and each reference feature vector in the reference feature vector set to obtain the difference in each dimension. These differences are combined to form a feature component difference matrix. Each row of the matrix corresponds to the difference between a reference feature vector and the fused correlated feature vector, and each column corresponds to the difference in a feature dimension.

[0109] Step S3145: Compare each element in the feature component difference matrix with the preset component difference threshold. When the feature component difference of any dimension is greater than the component difference threshold, the feature component of that dimension is determined to be an abnormal feature component. Count the number of all abnormal feature components, and record the dimension identifier and difference size corresponding to each abnormal feature component to generate an abnormal feature component description. The abnormal feature component description is used to determine the influencing factors during subsequent permission adjustments.

[0110] The preset component difference threshold is a pre-set value used to determine whether a feature component of a dimension is abnormal. Each element in the feature component difference matrix is ​​compared with the threshold. If an element is greater than the threshold, the dimension feature component corresponding to the element is considered abnormal.

[0111] Count all abnormal feature components, specifically the number of elements in the feature component difference matrix that are greater than a threshold. Also, record the dimension identifier for each abnormal feature component, such as the dimension in which it occurs and the magnitude of the difference. Combine this information to generate a description of the abnormal feature component. This description can provide a basis for subsequent permission adjustments, such as determining which dimension's abnormalities lead to increased risk.

[0112] Step S3150: Calculate the risk value of the user's access behavior based on the number of abnormal feature components and the degree of deviation of each abnormal feature component, and generate a risk assessment result including the risk value and the description of the abnormal feature components. The risk value is used to indicate the possibility that the current access behavior is risky.

[0113] The risk value can be calculated using a weighted summation method, assigning a weight to each abnormal feature component. The weight is determined by the degree of deviation of the abnormal feature component, with the greater the deviation, the greater the weight. The weight of each abnormal feature component is multiplied by its corresponding difference value, and all the results are added together to obtain the risk value. The risk assessment result includes a risk value and a description of the abnormal feature component. The risk value intuitively indicates the likelihood that the current user access behavior is risky, with a larger risk value indicating a higher risk. The description of the abnormal feature component details which feature components deviate from the normal pattern, providing specific information for subsequent permission adjustments and risk management.

[0114] Step S400: According to the initial permission set and the risk assessment result, the user's access permission configuration for the data resource identifier is adjusted, and a permission control instruction is generated.

[0115] The initial permission set is generated in step S200 and specifies the user's initial access rights to the data resource identifier. The risk assessment result includes a risk value and a description of abnormal characteristic components, reflecting the risk level of the current user's access behavior. The user's access permission configuration is adjusted based on these two pieces of information in order to reduce potential risks while ensuring the user's normal access needs. The permission control instruction is a command used to control the user's access rights to the data resource identifier and contains adjusted permission parameters, such as the type of access operation allowed, the data access granularity, and the validity period of the permission.

[0116] As an implementation method, step S400 may specifically include the following steps S410 to S470: Step S410: Parse the initial permission set, extract the types of access operations allowed, data access granularity and validity period of the permissions, and use them as benchmark parameters for permission adjustment.

[0117] Parsing the initial permission set involves extracting key permission information from it. The permitted access operation types define the operations a user can perform on data resources, such as querying, inserting, and deleting. Data access granularity refers to the range of data a user can access, for example, whether they can access an entire table or just a subset of fields. The permission validity period specifies how long a user's access permissions are valid.

[0118] This information will be used as the baseline parameters for permission adjustments, and subsequent permission adjustments will be modified and optimized based on these parameters. For example, if the initial permission set allows a user to perform query and insert operations, the data access granularity is the entire data table, and the permission validity period is 1 day, then when adjusting permissions, this information will be used as the basis for adjustment.

[0119] Step S420: Analyze the risk assessment results, extract the risk value and abnormal feature component description, and when the risk value is lower than the preset risk threshold, maintain the permission configuration in the initial permission set unchanged.

[0120] Parsing risk assessment results involves extracting key risk information. The risk value indicates the likelihood that the current user's access behavior is risky, while the abnormal feature component description details which feature components deviate from the normal pattern.

[0121] The preset risk threshold is a value that is set in advance to determine whether permissions need to be adjusted. When the risk value is below the threshold, it indicates that the current user's access behavior is low risk and no permission adjustment is required. Therefore, the permissions in the initial permission set remain unchanged.

[0122] Step S430: When the risk value is higher than or equal to the preset risk threshold, the influencing factors causing the risk are determined based on the description of the abnormal feature components. The influencing factors include historical access behavior abnormal factors and real-time environment status abnormal factors.

[0123] When the risk value is higher than or equal to the preset risk threshold, the current user's access behavior presents a high risk and requires permission adjustment. Based on the description of the abnormal feature components, the factors contributing to the risk can be analyzed. Historical access behavior anomalies refer to deviations from normal user behavior patterns, such as frequent access to sensitive data resources or abnormal operation type conversions. Real-time environment status anomalies refer to deviations from normal environmental conditions, such as abnormal device operation or unstable network connections.

[0124] By analyzing the description of abnormal feature components, we can determine which abnormal historical access behavior characteristics and real-time environmental status characteristics lead to increased risks, providing targeted basis for subsequent permission adjustments.

[0125] Step S440: In response to abnormal factors in historical access behavior, the permission level of the corresponding access operation type in the initial permission set is reduced, the data access granularity is narrowed, and the validity period of the permission is shortened.

[0126] When historical access behavior is identified as abnormal, the permissions in the initial permission set need to be adjusted accordingly. This can be done by lowering the permission level for the corresponding access operation type, for example, reducing permissions that originally allowed insert and delete operations to only allow query operations. Reducing the granularity of data access means reducing the scope of data a user can access, for example, from accessing the entire table to only a subset of fields.

[0127] As an implementation method, step S440 may specifically include the following steps S441 to S447: Step S441: Analyze the abnormal factors of historical access behavior in the description of abnormal feature components, and determine the abnormal historical access behavior type. The abnormal historical access behavior type includes a behavioral feature type that reflects that the historical access pattern deviates from the normal range.

[0128] Parsing the abnormal factors of historical access behavior in the description of abnormal feature components involves extracting abnormal information related to the historical access behavior from the description. Abnormal historical access behavior types refer to those behavioral characteristics that differ from normal access patterns, such as frequent access to designated data resources or abnormal operation type conversions. For example, the abnormal feature component description may mention excessive frequency of user access to a sensitive data resource during a certain historical access period, or excessive abrupt changes in operation type from query to delete. By parsing this information, the abnormal historical access behavior type can be determined, providing a specific basis for subsequent permission adjustments.

[0129] Step S442: query the preset permission adjustment rule library according to the abnormal historical access behavior type, and extract the permission level adjustment range, data access granularity reduction ratio and permission validity period shortening ratio corresponding to the abnormal historical access behavior type.

[0130] The preset permission adjustment rule base is a set of pre-defined rules that contains permission adjustment rules for different types of abnormal historical access behavior. Based on the identified abnormal historical access behavior type, the rule base is searched to find the corresponding permission level adjustment range, data access granularity reduction ratio, and permission validity period reduction ratio.

[0131] Step S443: For the access operation types in the initial permission set, the permission level of the access operation type associated with the abnormal historical access behavior type is reduced by the permission level adjustment range.

[0132] Reduce the permission level of the access operation type associated with the abnormal historical access behavior by the permission level adjustment amount. For example, if the abnormal historical access behavior type is frequent data deletion, the permission level related to the deletion operation in the initial permission set will be reduced. If the original permission level is high, allowing operations such as deletion and modification, after reducing the permission level by one level, it may only allow query operations.

[0133] Step S444: adjusting the data access granularity in the initial permission set according to the data access granularity reduction ratio.

[0134] The data access granularity in the initial permission set is adjusted based on the reduction ratio of the data access granularity extracted from the rule base. For example, if the original data access granularity allows access to the entire data table, and the data access granularity is reduced by 50%, the adjusted data access granularity will only allow access to some fields in the data table.

[0135] Step S445: shortening the validity period of the permissions in the initial permission set according to the permission validity period shortening ratio.

[0136] Step S446: Perform compatibility check on the adjusted permission level, data access granularity, and permission validity period to ensure that there is no conflict between the adjusted permission parameters.

[0137] Compatibility checking checks for inconsistencies or conflicts between the adjusted permission level, data access granularity, and permission validity period. For example, if the permission level allows insert operations, but the data access granularity is reduced to querying only a subset of fields, a conflict may exist. Compatibility checking ensures that the adjusted permission parameters are consistent with each other and meet logical and security requirements.

[0138] Step S447: When the compatibility check passes, the adjusted permission parameters are updated to the initial permission set to generate an intermediate permission set adjusted for abnormal factors of historical access behavior. The intermediate permission set is used to further integrate the permission parameters adjusted for abnormal factors of real-time environmental status.

[0139] If the compatibility check passes, the adjusted permission parameters are reasonable and feasible. These adjusted permission parameters are then updated to the initial permission set, generating an intermediate permission set. This set represents the permission configuration after factoring in historical anomalies in access behavior. This set will then need to be integrated with the adjusted permission parameters based on anomalies in the real-time environment to arrive at the final permission configuration.

[0140] Step S450: In response to abnormal factors in the real-time environment status, suspend the access operation types involving highly sensitive data resources in the initial permission set, limit the data access granularity to the lowest level, and adjust the permission validity period to the temporary access period.

[0141] When there are abnormal factors in the real-time environment status, in order to ensure data security, it is necessary to make stricter adjustments to permissions. Suspend the access operation types involving highly sensitive data resources in the initial permission set, such as prohibiting the query, modification and other operations on sensitive data resources such as financial data and user personal information. Limit the granularity of data access to the lowest level, that is, only allow users to access the most basic data information, such as only being able to query the summary information of the data, but not to view the specific details. Adjust the validity period of the permission to the temporary access period, which can be set shorter to ensure that in abnormal environmental conditions, the user's access rights are strictly controlled.

[0142] As an implementation method, step S450 may specifically include the following steps S451 to S458: Step S451: Analyze the real-time environmental state abnormal factors in the abnormal feature component description, and determine the abnormal environmental state type. The abnormal environmental state type includes a state feature type that reflects that the current environmental operating state deviates from the normal range.

[0143] Parsing the abnormal real-time environmental status factors in the abnormal feature component description extracts abnormal information related to the real-time environmental status from the description. Abnormal environmental status types refer to those with status characteristics that differ from normal environmental operating conditions, such as excessive device CPU utilization or excessive network latency. By parsing this information, the abnormal environmental status type is determined, providing a specific basis for subsequent permission adjustments.

[0144] Step S452: querying a preset sensitive data resource list according to the abnormal environment state type, and identifying the access operation type corresponding to the highly sensitive data resource associated with the abnormal environment state type in the initial permission set.

[0145] The preset sensitive data resource list is a pre-defined list of highly sensitive data resources, such as financial statements and user privacy data. Based on the identified abnormal environmental status type, the list is searched for highly sensitive data resources associated with it. For example, if the abnormal environmental status type is unstable equipment operation, it may be related to access to important sensitive data resources such as financial data.

[0146] Identify the access operation types corresponding to these highly sensitive data resources in the initial permission set, such as query, insert, delete, etc. These operation types will be suspended in the future to ensure data security.

[0147] Step S453: Remove the identified access operation types involving highly sensitive data resources from the initial permission set, and generate an intermediate permission set that does not include highly sensitive data access rights.

[0148] Remove access operation types corresponding to highly sensitive data resources from the initial permission set. For example, remove operations such as query, insert, and delete from the permission set. Generate an intermediate permission set that does not include access rights to highly sensitive data. This set only allows users to access non-sensitive data resources.

[0149] Step S454: query the preset data access granularity classification standard to determine the specific access range restriction conditions corresponding to the lowest level of data access granularity. The specific access range restriction conditions include type restrictions on accessible data fields and quantity restrictions on data records.

[0150] The preset data access granularity classification standard is a pre-established rule that defines in detail the access scope corresponding to different levels of data access granularity. The lowest level of data access granularity means the most stringent restrictions on data access. By querying this standard, you can clarify the specific access scope restriction conditions corresponding to the lowest level of data access granularity. The type restriction of accessible data fields refers to the provision that users can only access data fields of set types, such as only allowing access to date fields, character type fields, etc. in the data, but not access to numeric key business data fields. The limit on the number of data records is to limit the number of data records that the user can obtain, such as only allowing the query of one or a few data records to prevent users from obtaining large amounts of data at one time.

[0151] For example, in a customer information database, the lowest level of data access granularity might dictate that only the customer's name (a character field) can be accessed, and each query allows only one customer record to be retrieved. This standard can be queried using a database query. If the standards are stored in a database table named "data_access_granularity_standards" and contain fields such as "granularity_level," "field_type_restrictions," and "record_count_restrictions," the following SQL statement can be used to query the lowest level of data access granularity restrictions: SELECT field_type_restrictions, record_count_restrictions FROM data_access_granularity_standards WHERE granularity_level = 'lowest level'.

[0152] Step S455: uniformly adjust the data access granularity in the intermediate permission set to the lowest level data access granularity, and apply specific access scope restriction conditions to update the permission configuration.

[0153] Adjusting the data access granularity in the intermediate permission set to the previously determined lowest level of data access granularity means that no matter what the original data access granularity is, it will be adjusted according to the lowest level. Apply specific access scope restrictions to update the permission configuration, that is, apply the type restrictions of accessible data fields and the number restrictions of data records to the permission configuration. For example, the original intermediate permission set allowed access to multiple data fields and a large number of data records, but now, according to the requirements of the lowest level of data access granularity, only access to fields of set types and a small number of data records is allowed. Updating the permission configuration can be achieved by modifying the corresponding data table in the permission management database, and updating the relevant permission records according to the new access scope restrictions.

[0154] Step S456: querying a preset temporary access duration rule library, and extracting a corresponding temporary access duration value according to the severity level corresponding to the abnormal environmental status type.

[0155] The preset temporary access duration rule base is a database table or configuration file that stores the temporary access duration values ​​corresponding to different abnormal environmental status types and their severity levels. The severity levels associated with abnormal environmental status types are determined based on the impact and urgency of the abnormal situation. For example, a device CPU usage of 90% might be classified as severe, while a CPU usage of 70% might be classified as moderate. Based on the abnormal environmental status type and its severity level, the corresponding temporary access duration value is queried in the rule base.

[0156] For example, the rule base specifies that if a device experiences a severe abnormality, the temporary access duration is one hour; if a device experiences a moderate abnormality, the temporary access duration is two hours. To query this rule base, you can use a database query statement. If the rule base is stored in a database table named "temporary_access_duration_rules" and contains fields such as "environment_status_type" (abnormal environment status type), "severity_level" (severity level), and "temporary_duration" (temporary access duration), you can use the following SQL statement to query: SELECT temporary_duration FROM temporary_access_duration_rules WHERE environment_status_type = 'Current abnormal environment status type' AND severity_level = 'Corresponding severity level'.

[0157] Step S457: Update the validity period of the permissions in the intermediate permission set to the extracted temporary access period value, and generate a temporary permission set that includes adjustments for abnormal factors in the real-time environment status.

[0158] The validity period of the permissions in the intermediate permission set is replaced with the temporary access duration value extracted from the rule base. This is done to strictly control the duration of user access rights in the event of an abnormal real-time environment state. The generated temporary permission set is the result of adjusting permissions after considering abnormal real-time environment state factors. Updating the validity period of permissions can be achieved by modifying the corresponding data table in the permission management database and updating the validity period field in the permission record corresponding to the intermediate permission set to the new temporary access duration value.

[0159] Step S458: Verify the validity of the temporary permission set so that the adjusted permission parameters meet the security policy requirements of the trusted innovation environment. When the verification is passed, the temporary permission set will be used as a component of the dynamic permission configuration information.

[0160] Validation is the process of checking whether the permission parameters in the temporary permission set comply with the security policy requirements of the trusted innovation environment. Security policy requirements may include aspects such as the legality of data access and the rationality of permissions. For example, it is necessary to check whether the adjusted data access granularity and the validity period of permissions are consistent with the security specifications of the trusted innovation environment, and whether there are situations where the permissions are too high or too low. The verification process can be implemented by writing a verification function, which will check and evaluate each permission parameter in the temporary permission set.

[0161] If the verification passes, the temporary permission set is safe and reasonable, and it will be used as part of the dynamic permission configuration information. Dynamic permission configuration information is the permission configuration that is adjusted in real time based on different risk factors and environmental conditions. More precise permission control will be based on this in the future.

[0162] Step S460: Combine the adjusted access operation type, data access granularity, and permission validity period to generate dynamic permission configuration information.

[0163] The access operation type, data access granularity, and permission validity duration, adjusted based on historical access behavior anomalies and real-time environmental status anomalies, are integrated. For example, after adjustment, the access operation type may only remain as a query operation, with the lowest data access granularity and the permission validity duration as the temporary access duration. These adjusted parameters are combined to form dynamic permission configuration information. This information reflects the user's current and latest permission configuration for data resources, taking into account various risk factors. This combination process can be implemented using data structures, such as storing these parameters in a dictionary or object.

[0164] Step S470: Generate permission control instructions containing user identity identification, data resource identification and adjusted permission parameters based on dynamic permission configuration information. The format of the permission control instructions is consistent with the interface requirements of the permission execution component in the trusted innovation environment.

[0165] Dynamic permission configuration information specifies the user's adjusted access rights. Based on this information, permission control instructions are generated. The user identity uniquely identifies the user initiating the access request, while the data resource identifier points to the data resource the user is requesting access to. Adjusted permission parameters include the adjusted access operation type, data access granularity, and permission validity period.

[0166] The format of the permission control instruction needs to be consistent with the interface requirements of the permission execution component in the trusted computing environment, so that the permission execution component can correctly parse and execute the instruction. For example, the interface of the permission execution component requires the instruction format to be "user identity identifier-data resource identifier-access operation type-data access granularity-permission validity period". Then the permission control instruction generated based on the above dynamic permission configuration information may be "User 123-Financial statement database-Query-Accessible field type: Date field; Data record quantity limit: 1 record-1 hour". The generation of this instruction can be achieved by string concatenation, combining the user identity identifier, data resource identifier and adjusted permission parameters in the format required by the interface.

[0167] Step S500: Based on the permission control instruction, perform permission control operations on the user's access to the data resource identifier, and record permission change information and access operation logs during the permission control process.

[0168] The permission control instruction specifies the latest permission configuration of the user for the data resource identifier. Based on this instruction, the permission control operation is performed. That is, when the user initiates an access request for the data resource identifier, the permission parameters in the instruction are checked and controlled.

[0169] As an implementation method, step S500 may specifically include the following steps S510~S560: Step S510: Send the permission control instruction to the permission execution component of the trusted innovation environment, parse the permission control instruction through the permission execution component, and extract the user identity, data resource identifier and adjusted permission parameters.

[0170] The permission execution component is a module specifically responsible for executing permission control in the trusted computing environment. Sending permission control instructions to the component can be achieved through network communication, such as using the HTTP protocol to send instructions to the specified interface of the permission execution component. After receiving the instruction, the permission execution component parses it. The parsing process is performed according to the format of the instruction. For example, if the instruction format is "user identity identifier-data resource identifier-access operation type-data access granularity-permission validity period", the permission execution component can use the string segmentation function to split the instruction into various parts and extract the user identity identifier, data resource identifier and adjusted permission parameters.

[0171] Step S520: The permission execution component configures permission control rules for the user identity to access the data resource identifier based on the adjusted permission parameters. The permission control rules include a list of allowed access operation types, data access granularity restriction conditions, and permission validity time intervals.

[0172] The permission enforcement component uses the extracted, adjusted permission parameters to configure permission control rules for user identities accessing data resource identifiers. The list of permitted access operations specifies the operations a user can perform on data resources, such as querying and modifying. Data access granularity restrictions define the scope of data a user can access, including the type of accessible data fields and the number of data records. The permission validity period defines the time period during which a user has these permissions.

[0173] Configuring permission control rules can be achieved by modifying the permission rule database within the permission execution component. The user identity, data resource identifier, and adjusted permission parameters are combined into a permission rule record and stored in the database. For example, if the database table is named "user_permission_rules" and contains fields such as "user_id" (user identity), "data_resource_id" (data resource identifier), "allowed_operations" (a list of allowed access operation types), "data_access_granularity" (data access granularity restrictions), and "permission_valid_time" (permission validity period), the following SQL statement can be used to insert a new permission rule record: INSERT INTOuser_permission_rules(user_id,data_resource_id,allowed_operations,data_access_granularity,permission_valid_time) VALUES('User identity','Data resource identifier','Permitted access operation type list','Data access granularity restrictions','Permission validity period').

[0174] Step S530: When the user initiates a specific access operation to the data resource identifier, the permission execution component checks whether the type of the specific access operation is in the list of allowed access operation types, and verifies whether the current time is within the permission validity time interval.

[0175] When a user initiates a specific access operation to a data resource identifier, the permission execution component starts to perform permission checks. First, check whether the type of the specific access operation is in the previously configured list of allowed access operation types. For example, if the list of allowed access operation types is "query", and the user initiates a modification operation, then the operation is not allowed. At the same time, verify whether the current time is within the permission validity time interval. Checking the operation type can be achieved through string matching, comparing the operation type initiated by the user with the list of allowed operation types. To verify whether the current time is within the permission validity time interval, you can obtain the current system time and compare it with the start and end time of the permission validity time interval.

[0176] Step S540: If the access operation type is not in the list of allowed operations or the current time exceeds the permission validity period, the user's specific access operation is denied and an access denial prompt message is generated.

[0177] If the check finds that the access operation type initiated by the user is not in the list of allowed operations, or the current time is outside the permission validity period, the permission enforcement component will deny the specific access operation. The denial operation can be achieved by returning an error code or a denial message to the user, and generating an access denial prompt.

[0178] Step S550: If the access operation type is in the list of allowed execution and the current time is within the permission validity time interval, the data range involved in the access operation is filtered according to the data access granularity restriction condition, and only the user is allowed to access data content that meets the granularity requirements.

[0179] If the type of access operation initiated by the user is in the list of permitted operations and the current time is within the permission validity period, the permission execution component will filter the data range involved in the access operation based on the data access granularity restriction conditions. For example, if the data access granularity restriction conditions stipulate that only date fields and one data record are allowed to be accessed, then when the user initiates a query operation, the permission execution component will filter the query results, returning only the data in the date field and only one record. Filtering can be achieved through conditional filtering of database query statements, adding restrictions on the data field type and the number of data records in the query statement.

[0180] Step S560: During the execution of the permission management operation, the permission change information is recorded. The permission change information includes the comparison of permission parameters before and after the permission adjustment, the permission adjustment timestamp, and the summary of the risk assessment results based on the adjustment; at the same time, the user's access operation log is recorded. The access operation log includes the access operation type, access time, accessed data content identification, and access result status. The permission change information and access operation log are stored in the audit log database of the trusted innovation environment.

[0181] During the execution of permission management operations, recording permission change information and user access operation logs are crucial security audit measures. The comparison of permission parameters before and after the permission change information clearly demonstrates how permissions have changed. For example, before the change, query and modify operations were allowed, while after the change, only query operations are allowed. The permission adjustment timestamp records the specific time of the permission adjustment, facilitating subsequent traceability. The summary of the risk assessment results that form the basis for the adjustment explains the reason for the permission adjustment, such as whether it was due to abnormal historical access behavior or abnormal real-time environment status.

[0182] The user's access operation log records the user's specific access behavior. The access operation type clarifies whether the user performed a query, insert, or other operation. The access time records the moment the operation occurred. The accessed data content identifier points to the data resource accessed by the user. The access result status indicates whether the access operation was successful or failed.

[0183] Storing permission change information and access operation logs in the audit log database of the trusted computing environment can be achieved through database insert operations. If the audit log database contains a "permission_change_logs" table for storing permission change information, including fields such as "before_permission_params" (permission parameters before permission adjustment), "after_permission_params" (permission parameters after permission adjustment), "adjustment_timestamp" (permission adjustment timestamp), and "risk_assessment_summary" (summary of the risk assessment results based on the adjustment), and a "user_access_logs" table for storing user access operation logs, including fields such as "access_operation_type" (access operation type), "access_time" (access time), "accessed_data_id" (accessed data content identifier), and "access_result_status" (access result status), the corresponding SQL insert statement can be used to store the information in the table.

[0184] It is understandable that the various algorithms involved in the above-mentioned introductions of the embodiments of the present invention, such as encryption algorithms, feature matching algorithms, distance algorithms, etc., can all be learned from the relevant content in the prior art. In order to save space, they will not be expanded too much in the embodiments of the present invention. In addition, when implementing the scheme of the present invention, those skilled in the art can supplement the details according to the common knowledge in this field. For example, according to the common knowledge in this field, normalization can be used to eliminate dimensional conflicts before feature fusion, interpolation can be used to eliminate dimensional differences, and thresholds can be reasonably set based on historical data, experience or business scenario requirements. The model can be trained based on a general model training method, and the number of layers in the model structure can be set based on actual needs, the activation function can be selected, etc. The present invention will no longer provide redundant introductions to the overly detailed implementation process.

[0185] See also Figure 2 , Figure 2This is a schematic diagram of the structure of a multi-level dynamic data access control device provided in an embodiment of the present invention. The multi-level dynamic data access control device can be a computer system, comprising at least a processor 101, a communication interface 102, and a memory 103. The processor 101, communication interface 102, and memory 103 can be connected via a bus or other means. The processor 101 (also known as a central processing unit (CPU)) is the computing and control core of the multi-level dynamic data access control device, capable of parsing various instructions within the multi-level dynamic data access control device and processing various data within the multi-level dynamic data access control device. The communication interface 102 can optionally include a standard wired interface or a wireless interface (such as Wi-Fi or a mobile communication interface), and can be used to send and receive data under the control of the processor 101. The communication interface 102 can also be used for data transmission and interaction within the multi-level dynamic data access control device. The memory 103 is a storage device within the multi-level dynamic data access control device, used to store programs and data. It is understood that the memory 103 herein may include either the built-in memory of the multi-level dynamic data access control device or the extended memory supported by the multi-level dynamic data access control device. The memory 103 provides storage space for storing the operating system of the multi-level dynamic data access control device, including but not limited to Android, iOS, and Windows Phone systems, etc., although this invention is not limited thereto.

[0186] In one embodiment, the processor 101 executes the multi-level dynamic data access control method based on the trusted innovation environment provided in the above embodiment of the present invention by running the computer program in the memory 103.

Claims

1. A multi-level dynamic data access control method based on a trusted environment, characterized in that: The method includes: obtaining a data access request initiated by a user and associated environmental status information, wherein the data access request includes a user identity and a data resource identifier requested for access, and the environmental status information includes device operation status information of the physical layer, connection status information of the network layer, and access context information of the application layer in the trusted computing environment; performing multi-factor authentication processing on the user identity, and generating an initial permission set for the user for the data resource identifier in combination with pre-stored user role attribute information and responsibility division data; extracting historical access behavior records of the user in the trusted computing environment to generate historical access behavior features, extracting real-time status features in combination with the environmental status information, performing correlation analysis on the historical access behavior features and the real-time status features, and generating a risk assessment result of the user's access behavior; adjusting the user's access permission configuration for the data resource identifier based on the initial permission set and the risk assessment result, and generating a permission control instruction; based on the permission control instruction, executing permission management operations for the user's access to the data resource identifier, and recording permission change information and access operation logs during the permission management process.

2. The method according to claim 1, characterized in that The multi-factor authentication processing of the user identity identifier is combined with pre-stored user role attribute information and responsibility division data to generate the user's initial permission set for the data resource identifier, including: parsing the user identity identifier and extracting the user identity subject information, the user identity subject information includes organizational affiliation information, job feature information and unique identity coding information related to the user identity; calling the multi-factor authentication component in the trust creation environment to perform authentication processing on the user identity subject information, the authentication processing includes collaborative verification of a first authentication credential generated based on a hardware authentication device held by the user, a second authentication credential generated based on the user's biometrics and a third authentication credential generated based on the user's knowledge information; when the first authentication credential, the second authentication credential and the third authentication credential are all verified, Retrieve user role attribute information associated with the user identity subject information from the authority management database of the trusted innovation environment, the user role attribute information including role hierarchy characteristics, data access scope characteristics and operation authority type characteristics; query preset duty division data based on the user role attribute information, the duty division data including a list of standard data access permissions and a time range for the effectiveness of permissions corresponding to characteristic information of different positions; match the list of standard data access permissions with the data resource identifier, filter out permission items corresponding to the data resource identifier, perform validity verification on the filtered permission items in combination with the time range for the effectiveness of permissions, and generate an initial permission set for the user for the data resource identifier, the initial permission set including the type of access operation allowed, data access granularity and the validity period of permissions.

3. The method according to claim 1, characterized in that The method of extracting the historical access behavior records of the user in the trusted environment to generate historical access behavior features includes: retrieving the historical access behavior records corresponding to the user identity identifier from the access log database of the trusted environment, the historical access behavior records including the historical access timestamp, the historical access data resource identifier, the historical access operation type and the status parameters of the historical access environment; performing time window division processing on the historical access behavior records, dividing the historical access behavior records within a continuous preset time period into multiple historical access time periods, each historical access time period including at least one historical access behavior record; for each historical access time period, counting the different data resource identifiers accessed within the historical access time period. The method comprises the following steps: first, calculating the number of identifications and the access frequency of each data resource identification to generate data resource access distribution characteristics; second, extracting the sequence information of historical access operation types in each historical access period, analyzing the conversion relationship between adjacent access operation types, and generating operation type conversion characteristics; third, calculating the time interval between two adjacent historical access behavior records in combination with the historical access timestamp, counting the occurrence frequency of different time intervals, and generating access time interval characteristics; fourth, performing feature fusion processing on the data resource access distribution characteristics, the operation type conversion characteristics, and the access time interval characteristics to generate historical access behavior characteristics with time series correlation, wherein the dimension of the historical access behavior characteristics corresponds to the number of historical access periods.

4. The method according to claim 1, wherein The method of extracting real-time status features in combination with the environmental status information includes: parsing the physical layer device operation status information in the environmental status information to extract the device's CPU usage characteristics, memory occupancy characteristics, and storage medium read and write speed characteristics; parsing the network layer connection status information in the environmental status information to extract the network connection's transmission protocol type characteristics, data transmission rate characteristics, and network delay characteristics; parsing the application layer access context information in the environmental status information to extract the application identification characteristics of the current access request, the interface element characteristics of the user's current operation interface, and the initiation path characteristics of the access request; and standardizing the features extracted from the physical layer device operation status information, the network layer connection status information, and the application layer access context information to eliminate dimensional differences between different types of features and generate real-time status features with a unified feature space representation.

5. The method according to claim 1, wherein The correlation analysis of the historical access behavior features and the real-time status features to generate a risk assessment result of the user access behavior includes: inputting the historical access behavior features and the real-time status features into a pre-trained feature correlation model, and performing dimension matching processing on the historical access behavior features and the real-time status features through the feature alignment layer therein, so that the two are consistent in feature dimensions; calling the cross-attention mechanism module of the feature correlation model, calculating the correlation strength of each dimensional feature in the historical access behavior features and each dimensional feature in the real-time status features, and generating a feature correlation weight matrix, wherein the element values ​​in the feature correlation weight matrix represent the degree of mutual influence between the corresponding dimensional features; based on the The feature association weight matrix performs weighted fusion processing on the historical access behavior features and the real-time status features to generate a fused association feature vector, which contains comprehensive information about the user's historical behavior pattern and the current environmental status; the fused association feature vector is input into the risk assessment model, and the fused association feature vector is subjected to abnormal pattern detection through the risk identification layer therein to identify abnormal feature components that deviate from the normal access behavior pattern; the risk value of the user's access behavior is calculated based on the number of the abnormal feature components and the degree of deviation of each abnormal feature component, and a risk assessment result containing the risk value and the abnormal feature component description is generated, and the risk value is used to indicate the possibility of risk in the current access behavior.

6. The method according to claim 1, characterized in that The method of adjusting the user's access permission configuration for the data resource identifier based on the initial permission set and the risk assessment result and generating a permission control instruction includes: parsing the initial permission set, extracting the type of access operation allowed to be executed, the data access granularity, and the validity period of the permission, and using them as benchmark parameters for permission adjustment; parsing the risk assessment result, extracting the risk value and the description of the abnormal characteristic component, and when the risk value is lower than a preset risk threshold, maintaining the permission configuration in the initial permission set unchanged; when the risk value is higher than or equal to the preset risk threshold, determining the influencing factors causing the risk based on the description of the abnormal characteristic component, and the influencing factors include historical access behavior abnormal factors and real-time environmental status abnormal factors; In response to abnormal factors in historical access behavior, the permission level of the corresponding access operation type in the initial permission set is lowered, the data access granularity is reduced, and the validity period of the permission is shortened; in response to abnormal factors in the real-time environmental status, the access operation type involving highly sensitive data resources in the initial permission set is suspended, the data access granularity is limited to the lowest level, and the validity period of the permission is adjusted to the temporary access period; the adjusted access operation type, data access granularity and validity period of the permission are combined to generate dynamic permission configuration information; based on the dynamic permission configuration information, a permission control instruction containing user identity identification, data resource identification and adjusted permission parameters is generated, and the format of the permission control instruction is consistent with the interface requirements of the permission execution component in the trusted innovation environment.

7. The method according to claim 1, characterized in that The method includes: sending the permission control instruction to the permission execution component of the trust creation environment, parsing the permission control instruction through the permission execution component, extracting the user identity, data resource identification and adjusted permission parameters; configuring the permission control rules for the user identity to access the data resource identification according to the adjusted permission parameters through the permission execution component, and the permission control rules include a list of access operation types allowed to be executed, data access granularity restriction conditions and permission validity time interval; when the user initiates a specific access operation to the data resource identification, checking through the permission execution component whether the type of the specific access operation is in the list of access operation types allowed to be executed, and verifying the current time Whether it is within the permission validity time interval; if the access operation type is not in the list of allowed execution or the current time exceeds the permission validity time interval, the user's specific access operation is denied; if the access operation type is in the list of allowed execution and the current time is within the permission validity time interval, the data range involved in the access operation is filtered according to the data access granularity restriction conditions, and only the user is allowed to access data content that meets the granularity requirements; during the execution of the permission management operation, the permission change information is recorded, and the permission change information includes the comparison of permission parameters before and after the permission adjustment, the permission adjustment timestamp and the summary of the risk assessment results based on the adjustment; at the same time, the user's access operation log is recorded, and the access operation log includes the access operation type, access time, accessed data content identifier and access result status, and the permission change information and the access operation log are stored in the audit log database of the trusted innovation environment.

8. The method according to claim 2, characterized in that The multi-factor authentication component in the trusted computing environment is called to perform authentication processing on the user identity subject information, including: sending an authentication request instruction to a hardware authentication device held by the user, the hardware authentication device generates a first authentication credential based on a built-in encryption algorithm, and returns the first authentication credential to the multi-factor authentication component; obtaining the user's biometric information through a biometric acquisition device in the trusted computing environment, pre-processing the biometric information, and generating a second authentication credential; prompting the user to input preset knowledge information, performing format verification and content matching on the knowledge information input by the user, and generating a third authentication credential; calling the authentication verification module through the multi-factor authentication component, comparing the first authentication credential with a pre-stored hardware device authentication reference value, and calculating a first matching degree; comparing the second authentication credential with a pre-stored biometric reference template, and calculating a second matching degree; comparing the third authentication credential with a pre-stored knowledge information reference value, and calculating a third matching degree; when the first matching degree, the second matching degree, and the third matching degree are all higher than their respective corresponding preset matching thresholds, the multi-factor authentication is determined to be passed; otherwise, the multi-factor authentication is determined to have failed.

9. The method according to claim 5, characterized in that The method of inputting the fused associated feature vector into the risk assessment model, performing abnormal pattern detection on the fused associated feature vector through the risk identification layer therein, and identifying abnormal feature components that deviate from the normal access behavior pattern, includes: loading a pre-trained normal access behavior pattern feature library through the risk identification layer, the normal access behavior pattern feature library containing feature vectors of multiple normal access samples, the feature vector of each normal access sample having the same dimension as the fused associated feature vector; calculating the similarity between the fused associated feature vector and the feature vector of each normal access sample in the normal access behavior pattern feature library to generate a similarity set; screening out the feature vectors of a preset number of normal access samples with the highest similarity from the similarity set as a reference feature vector set; calculating the feature component difference between the fused associated feature vector and each reference feature vector in the reference feature vector set to generate a feature component difference matrix, wherein each element in the feature component difference matrix represents the difference in the corresponding dimensional feature; comparing each element in the feature component difference matrix with a preset component difference threshold, and when the feature component difference of any dimension is greater than the component difference threshold, determining that the feature component of that dimension is an abnormal feature component.

10. A multi-level dynamic data access control device, characterized in that: include: A memory storing a computer program; a processor for loading the computer program to implement the multi-level dynamic data access control method based on the trusted innovation environment as described in any one of claims 1 to 9.

Images