Data Access Control Method and System Based on Information Security

Abstract

This invention relates to the field of information security technology and discloses a data permission allocation method and system based on information security. The method preprocesses a pre-collected set of user identity information and a set of resource information to obtain a subset of user security levels and a subset of resource sensitivity. The user identity information set contains user authentication data, and the resource information set contains resource classification data. It obtains a dataset of user access behavior corresponding to the user security level subset and a dataset of resource access environment corresponding to the resource sensitivity subset, and constructs a topology graph of permission relationships between users and resources based on these two datasets. It extracts a set of permission relationship features from the topology graph to obtain multiple permission evaluation result sets containing permission levels and permission types. It merges these multiple result sets according to a preset fusion strategy to obtain a target permission allocation result set, and generates access permission configurations for each user for each resource based on this result set.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to a data access control method and system based on information security. Background Technology

[0002] In the digital age, data, as a core production factor, is receiving increasing attention for its security and rational use. Data access control, as a crucial component of information security systems, directly impacts the controllability and availability of data resources. With the proliferation of various information systems, the number of users has surged, their identities have become increasingly complex, and resource types have become more diverse with significantly varying levels of sensitivity. Traditional data access control methods are gradually revealing numerous problems.

[0003] Traditional methods often rely on static permission rules, primarily dividing permissions based on fixed attributes such as a user's department and job title, lacking consideration for dynamic user behavior. For example, determining long-term permissions solely based on a user's initial employment registration information ignores changes in user access behavior during actual use, potentially leading to a disconnect between permissions and actual needs. Furthermore, traditional methods for classifying resource sensitivity often employ single-dimensional, static categorization, such as simply labeling resources as public, internal, or confidential, without considering dynamic factors like real-time usage scenarios and dissemination scope, making it difficult to accurately reflect the sensitivity of resources in different environments.

[0004] In the permission assessment phase, traditional methods often employ a single model for permission determination. The limitations of this model can lead to biased assessment results. A single model can often only capture one type of feature, such as focusing solely on user authentication results or considering only static classification labels of resources. It cannot comprehensively consider multi-dimensional information such as user behavior and access environment, resulting in permission allocation that is either too lenient, posing a risk of data leakage, or too strict, affecting the normal data access efficiency of legitimate users.

[0005] In existing permission allocation processes, the relationship between users and resources lacks an intuitive and systematic presentation, making it difficult to effectively extract key permission relationship features and resulting in a lack of reliable basis for subsequent permission assessments. Furthermore, the lack of a scientific and reasonable integration mechanism for the outputs of different assessment models prevents the full utilization of each model's strengths, further impacting the accuracy and applicability of permission allocation results. These problems make existing data permission allocation methods inadequate to meet increasingly complex information security needs, necessitating a more comprehensive, dynamic, and accurate permission allocation scheme. Summary of the Invention

[0006] The purpose of this invention is to provide a data access control method based on information security to solve the problems mentioned in the background art.

[0007] To achieve the above objectives, the present invention provides a data access control method based on information security, the method comprising:

[0008] Data preprocessing is performed on the pre-collected user identity information set and resource information set to obtain user security level subset and resource sensitivity subset, wherein the user identity information set includes user identity authentication data and the resource information set includes resource classification data;

[0009] Obtain the user access behavior dataset corresponding to the user security level subset and the resource access environment dataset corresponding to the resource sensitivity subset;

[0010] For the user access behavior dataset and resource access environment dataset, construct a permission relationship topology graph between users and resources, wherein the nodes of the permission relationship topology graph include user nodes and resource nodes, and the edges represent access relationships;

[0011] For the constructed permission relationship topology graph, extract the permission relationship feature set;

[0012] For the permission relationship feature set, the permission relationship feature set is input into multiple pre-trained permission evaluation models to obtain multiple permission evaluation result sets, wherein each permission evaluation result set includes permission level and permission type;

[0013] For the multiple permission evaluation result sets, they are merged according to a preset fusion strategy to obtain the target permission allocation result set;

[0014] Based on the target permission allocation result set, generate access permission configurations for each user in the user identity information set to each resource in the resource information set.

[0015] Preferably, the step of preprocessing the user identity information set and resource information set to obtain a subset of user security levels and a subset of resource sensitivity includes:

[0016] Extract key attribute features from the user identity information set to generate a user security level feature vector;

[0017] Extract the key attribute features of the resource information set to generate a resource sensitivity feature vector;

[0018] Based on preset security threshold conditions, the user security level feature vector is filtered to obtain a subset of user security levels;

[0019] Based on a preset sensitivity threshold, the resource sensitivity feature vector is filtered to obtain a resource sensitivity subset.

[0020] Preferably, the construction of the permission relationship topology graph between users and resources includes:

[0021] Based on the historical access records of the user access behavior dataset, the initial connection relationship between user nodes and resource nodes is determined;

[0022] The weight values ​​of the initial connection relationships are adjusted based on the environmental security parameters of the resource access environment dataset.

[0023] Based on the adjusted weight values, the access strength features of each edge in the permission relationship topology graph are generated.

[0024] Preferably, the extracted permission relationship feature set includes:

[0025] The access strength features of each edge in the permission relationship topology graph are normalized to obtain a standardized access strength feature set.

[0026] Extract dependency features between nodes from the standardized access strength feature set to generate a permission dependency feature vector;

[0027] Extract conflict relationship features between nodes from the standardized access strength feature set to generate a permission conflict feature vector;

[0028] The permission dependency feature vector and the permission conflict feature vector are merged to obtain the permission relationship feature set.

[0029] Preferably, the step of inputting the permission relationship feature set into multiple permission evaluation models to obtain multiple permission evaluation result sets includes:

[0030] The permission relationship feature set is input into the first permission evaluation model, and the first permission evaluation result set is output, wherein the first permission evaluation result set includes permission level and permission type based on role attributes;

[0031] The permission relationship feature set is input into the second permission evaluation model, and the second permission evaluation result set is output. The second permission evaluation result set includes permission levels and permission types based on behavior patterns.

[0032] The permission relationship feature set is input into the third permission evaluation model, and the third permission evaluation result set is output. The third permission evaluation result set includes permission level and permission type based on environmental risk.

[0033] Preferably, the step of fusing according to a preset fusion strategy to obtain a target permission allocation result set includes:

[0034] Priority weights are assigned to the permission levels in the first permission evaluation result set, the second permission evaluation result set, and the third permission evaluation result set, respectively.

[0035] Calculate the overall weight value for each permission level based on the priority weights;

[0036] Filter permission levels whose comprehensive weight values ​​meet the preset threshold as candidate permission levels;

[0037] Merge all candidate permission levels and their corresponding permission types to generate the target permission allocation result set.

[0038] Preferably, the allocation of priority weights to permission levels includes:

[0039] Based on the permission types in the first permission evaluation result set, determine the priority coefficient of the role attribute;

[0040] Based on the permission types in the second permission evaluation result set, determine the priority coefficient of the behavior pattern;

[0041] Based on the permission type of the third permission assessment result set, determine the priority coefficient of the environmental risk;

[0042] Based on the priority coefficient, the weight allocation of the permission level in each permission evaluation result set is dynamically adjusted.

[0043] Preferably, after generating the access permission configuration, the method further includes:

[0044] Real-time monitoring of users' actual access behavior data to resources;

[0045] Update the user access behavior dataset based on the actual access behavior data;

[0046] Based on the updated user access behavior dataset, the steps of constructing the permission relationship topology graph, extracting the permission relationship feature set, inputting the permission evaluation model, and fusing the data are re-executed to generate an optimized access permission configuration.

[0047] Preferably, after updating the user access behavior dataset, the method further includes:

[0048] Based on the deviation between the actual access behavior data and the target permission allocation result set, adjust the parameters of multiple permission evaluation models;

[0049] Based on the adjusted parameters, the multiple permission evaluation models were retrained.

[0050] Preferably, a data access control system based on information security, used to implement the above-mentioned data access control method based on information security, includes:

[0051] The preprocessing module is used to preprocess the user identity information set and resource information set to generate a subset of user security level and a subset of resource sensitivity.

[0052] The data acquisition module is used to obtain user access behavior datasets corresponding to subsets of user security levels and resource access environment datasets corresponding to subsets of resource sensitivity.

[0053] The topology building module is used to construct a topology diagram of permission relationships between users and resources based on user access behavior datasets and resource access environment datasets.

[0054] The feature extraction module is used to extract the permission relationship feature set from the permission relationship topology graph;

[0055] The model processing module is used to input the permission relationship feature set into multiple permission evaluation models to obtain multiple permission evaluation result sets;

[0056] The fusion module is used to execute fusion strategies on multiple permission evaluation result sets to generate a target permission allocation result set;

[0057] The configuration generation module is used to generate user access permission configurations for resources based on the target permission allocation result set;

[0058] The update module is used to update the user access behavior dataset based on actual access behavior data and trigger the topology building module to run again;

[0059] The optimization module is used to adjust the parameters of the permission assessment model based on actual access behavior data and retrain the model.

[0060] Compared with the prior art, the beneficial effects of the present invention are:

[0061] This method, through a multi-stage collaborative design, demonstrates significant advantages in the comprehensiveness, dynamism, and accuracy of data permission allocation. In the data preprocessing stage, both user identity information sets and resource information sets are processed simultaneously, yielding subsets of user security levels and resource sensitivity, respectively. This two-dimensional preprocessing approach overcomes the limitations of traditional methods that rely solely on fixed user attributes or static resource labels, enabling a more comprehensive capture of the essential characteristics of users and resources, thus laying a more solid foundation for subsequent permission allocation.

[0062] The steps of acquiring user access behavior datasets and resource access environment datasets extend the considerations for permission allocation from static to dynamic. User access behavior changes with time, tasks, and other factors, and the resource access environment also affects the actual performance of its sensitivity. By incorporating this dynamic data, permission allocation is no longer limited to the initially set rules, but can better adapt to complex scenarios in real-world applications, allowing permission configurations to match real-time user behavior and environmental states.

[0063] The construction of the permission relationship topology graph provides an intuitive and systematic representation of the access relationships between users and resources. The nodes and edges in the topology graph clearly show the association between users and resources. This structured presentation not only facilitates subsequent feature extraction but also helps to discover potential relationships that are easily overlooked in traditional methods, resulting in a deeper and more comprehensive understanding of permission relationships and providing richer material for feature extraction.

[0064] Extracting a set of permission relationship features from the topology graph ensures that the features used for permission assessment are more relevant and representative. These features cover multiple aspects of users, resources, and their interrelationships, avoiding the problems of single or one-sided features in traditional assessments. This allows subsequent model assessments to be based on more comprehensive information, improving the reliability of the assessment.

[0065] Using multiple pre-trained permission assessment models allows for the full utilization of the strengths of different models. Different models have their own strengths in handling different types of data or capturing different features. Parallel evaluation of multiple models can synthesize the outputs of each model, compensating for the limitations of a single model, avoiding evaluation biases caused by model defects, and ensuring that each permission assessment result set reflects a reasonable permission configuration direction from different perspectives.

[0066] By fusing multiple evaluation result sets based on a preset fusion strategy, the rationality of the permission allocation results is further improved. The fusion process can comprehensively consider the outputs of different models, balance the advantages and disadvantages of each model, avoid the one-sidedness of a single result, and the final target permission allocation result set can better fit the actual permission requirements. It takes into account multi-dimensional evaluation opinions and forms a unified and coordinated allocation scheme through the fusion mechanism.

[0067] Based on the target permission allocation result set, access permission configurations for each user to each resource are generated, achieving precise implementation of permission allocation. This precise configuration ensures that users obtain permissions that match their security level and behavioral characteristics, while also setting appropriate access restrictions based on the sensitivity of the resource and the access environment. This allows data access to both meet users' normal needs and effectively maintain data security, thereby improving the efficiency of data resource utilization while ensuring information security. Attached Figure Description

[0068] Figure 1 This is a timing diagram of the data access control method based on information security described in this invention;

[0069] Figure 2 A flowchart for generating subsets of user security levels and resource sensitivity for data preprocessing;

[0070] Figure 3A flowchart for extracting the feature set of permission relationships;

[0071] Figure 4 A flowchart for merging the permission assessment result set to generate the target permission allocation result set. Detailed Implementation

[0072] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0073] Please see Figure 1 This invention provides a data access control method and system based on information security, the method comprising:

[0074] The system collects user identity information sets and resource information sets. The user identity information set includes user authentication data, while the resource information set includes resource classification data. Data preprocessing is performed on these two datasets: key attribute features are extracted to generate user security level feature vectors and resource sensitivity feature vectors, respectively. Subsets of user security level and resource sensitivity are formed through pre-defined security and sensitivity threshold conditions. Next, user access behavior datasets associated with the user security level subsets and resource access environment datasets associated with the resource sensitivity subsets are obtained. Based on these two datasets, a topology graph of permission relationships between user nodes and resource nodes is constructed. Edges in the graph represent access relationships, and their weights are dynamically adjusted by access behavior and environment parameters. A permission relationship feature set is extracted from the topology graph, including normalized access strength features, node dependency features, and conflict relationship features. The feature set is input into three pre-trained permission evaluation models, outputting an evaluation result set containing permission levels and types. The three result sets are integrated using a fusion strategy: dynamic priority weights are assigned, the comprehensive weight value of each permission level is calculated, candidate permission levels that meet pre-defined thresholds are selected, and their permission types are merged to generate the target permission allocation result set. Ultimately, based on this result set, each user's access permissions to resources are configured to achieve fine-grained control.

[0075] Example 1: See Figure 2During the data preprocessing stage, user identity information sets and resource information sets are loaded into system memory as input data. The user identity information set contains structured fields such as user ID, department, job level, historical access records, and authentication method. The resource information set covers resource ID, resource type, storage path, creator information, and access logs. The system first cleans these two datasets, removing duplicate records, filling in missing values, and standardizing unstructured fields. For example, job levels might be stored as text; the system maps this to a numerical security level.

[0076] The generation process of the user security level feature vector involves multi-dimensional attribute extraction. The system selects key attributes from the user's identity information set, including but not limited to job title weight, department security level, historical violation count, and multi-factor authentication strength. Each attribute is quantified: job title weight is calculated based on the organizational structure tree diagram, with higher-level positions assigned higher values; department security level is matched according to a preset department sensitivity table, such as the finance department having a higher security level than the administration department; historical violation count is obtained by statistically analyzing the user's security incident records over the past year; and multi-factor authentication strength is assigned scores based on the authentication method. These attribute values ​​are normalized and concatenated into a fixed-length feature vector, with each dimension of the vector corresponding to the security contribution value of a specific attribute.

[0077] The construction of the resource sensitivity feature vector adopts a similar method. The system analyzes key attributes in the resource information set, including resource type, confidentiality tag, access frequency, and modification history. Resource type is matched with sensitivity coefficients through a predefined classification system; for example, the sensitivity of database tables is usually higher than that of log files. Confidentiality tags are directly converted into numerical values: public is 0, internal is 1, and confidential is 2. Access frequency is calculated by counting recent accesses and smoothing the logarithm. Modification history is checked by examining the number of recent changes and the operator's permission level. These attribute values ​​are scaled and combined to form the resource sensitivity feature vector, whose dimensions remain independent of the user security level feature vector.

[0078] Preset security threshold conditions apply to user security level feature vectors. The system sets a minimum security entry value and filters out users whose overall feature vector score is below this value. For example, if a user's overall score for attributes such as job weight, departmental security level, and authentication strength does not meet the organization's minimum security threshold, that user will be excluded from the user security level subset. Similarly, the resource sensitivity subset is filtered using sensitivity threshold conditions, retaining only resources whose sensitivity scores exceed a preset threshold. This step ensures that subsequent processing targets only high-value users and resources, reducing computational overhead while improving the accuracy of permission allocation.

[0079] The construction of the permission relationship topology graph relies on two dynamic datasets: a user access behavior dataset and a resource access environment dataset. The user access behavior dataset is extracted from the log system, recording the user's operation history on resources, including access time, operation type (read, write, delete), and operation result (success, failure). The system parses these records and initializes the connections between user nodes and resource nodes. For example, if the logs show that user A successfully read resource X 10 times in the past 30 days, a directed edge from user A node to resource X node is added to the topology graph, with an initial weight of 10.

[0080] The resource access environment dataset provides environmental security parameters, including the geographic location of the access source IP, device fingerprint, network protocol type, and timestamp. The system adjusts the weights of the edges in the topology graph based on these parameters. Geographic location information is used to determine whether the access originates from a trusted area; for example, IPs from the company's intranet are given increased weight, while those from overseas are given decreased weight. Device fingerprints check the device registration status; registered devices are given increased weight, while unknown devices are given decreased weight. In terms of network protocol type, HTTPS connections are given higher weight, while HTTP connections are given lower weight. Timestamps are used to identify access during abnormal periods; operations outside of working hours may have their weight reduced. The adjusted weights are normalized to a uniform range using linear interpolation, ultimately forming the access strength characteristics of the edges.

[0081] The nodes in the topology graph are divided into two categories: user nodes and resource nodes, both carrying metadata tags. User nodes store summary information of security level feature vectors, while resource nodes store key values ​​of sensitivity feature vectors. Edge access strength features are stored in floating-point form, with high or low values ​​directly reflecting the tendency of permission allocation. The system periodically scans the topology graph structure, merging duplicate edges, removing long-term idle edges, and detecting abnormal connection patterns through graph traversal algorithms, triggering real-time alarms.

[0082] The access strength feature of edges is not only used for permission calculation but also supports dynamic permission adjustment. When a new record is added to the user access behavior dataset, the system updates the weight of the corresponding edge in real time. For example, if a user frequently accesses a resource, the edge weight will gradually accumulate; if the user subsequently does not access the resource for a long period, the weight will decay over time. Changes in the resource access environment dataset also trigger weight recalculation; for instance, if a device is marked as stolen, the weights of all access edges passing through that device are reset to zero. This dynamic mechanism ensures that the permission relationship topology always reflects the latest security status, providing real-time data support for subsequent feature extraction.

[0083] The entire implementation process utilizes a distributed computing framework to handle large-scale data. User identity information sets and resource information sets are loaded in parallel using a sharding strategy, and feature vector generation tasks are scheduled to execute across multiple worker nodes. The permission relationship topology graph is stored in a graph database, supporting high-concurrency read and write operations. The computation task of access strength features is processed in real time by a stream processing engine, ensuring low-latency response. The system reserves expansion interfaces, allowing for the subsequent integration of new data sources or adjustments to the weight calculation logic to adapt to changes in the security policies of different organizations.

[0084] Example 2: See Figure 3 The extraction process of the permission relationship feature set begins with the access strength features of edges in the topological graph. These features are stored numerically in the edge attributes of the graph, representing the tightness of the access relationship between users and resources. The system first standardizes these original weight values ​​to make them fall into a uniform numerical range. The standardization process uses a linear transformation method to proportionally map all edge weight values ​​to the range of zero to one. For example, if the original weight values ​​are distributed between ten and one hundred, the system converts them into an interval of zero to one. This processing allows weight values ​​from different sources and with different dimensions to be directly compared and calculated, eliminating biases caused by differences in numerical scales.

[0085] After standardization, the system generates a standardized access strength feature set. This feature set is organized in matrix form, with rows representing user nodes and columns representing resource nodes. The matrix elements are the standardized access strength values. This structured representation facilitates subsequent feature extraction algorithms. The system maintains a feature version control system to record the parameters and results of each standardization process, allowing for backtracking or recalculation when needed. Outliers detected during standardization are marked and handled separately. For example, extremely high or low weight values ​​may trigger a manual review process to confirm whether the access was legitimate or if the data is abnormal.

[0086] Dependency features between nodes are extracted by analyzing a standardized access strength feature set. The system employs a graph traversal algorithm to identify multi-hop association paths between users and resources. For example, if user A accesses resource X, and resource X is associated with resource Y, then there is an indirect dependency between user A and resource Y. The system calculates the weighted sum of all such paths to quantify the strength of the dependency. During traversal, path length limitations are considered, typically setting a maximum number of hops to balance computational complexity and feature effectiveness. Path weighting uses a decay strategy, where the weight decreases by a fixed proportion with each additional hop to reflect the weakening effect of long-distance dependencies.

[0087] The vectorization process of dependency features compresses complex graph structure information into a fixed-dimensional numerical representation. The system pre-defines a set of typical dependency pattern templates, such as direct access, second-level indirect access, and shared resource access. For each user node, the dependency strength with all resource nodes under different patterns is calculated, generating a multi-dimensional vector. Each dimension in the vector corresponds to a dependency pattern, and its value reflects the significance of that pattern in the current user-resource relationship. This representation method preserves the structural information of the topological graph while reducing data dimensionality, facilitating subsequent model processing. The system periodically evaluates the effectiveness of the dependency pattern templates and dynamically adjusts the template set based on the actual data distribution to capture more accurate dependency features.

[0088] Conflict relationship feature extraction focuses on identifying mutually exclusive access patterns between users and resources. The system maintains a resource conflict rule base, defining which resource combinations have mutually exclusive relationships. For example, financial data and personnel data may be marked as mutually exclusive resources, and the same user should not have access to both types of data simultaneously. The system scans the topology graph to detect whether user nodes are connected to mutually exclusive resource groups through edges. For each detected conflict instance, the system records the identifier of the conflicting resource, the conflict type, and the conflict intensity. The conflict intensity is calculated based on a standardized access intensity value, reflecting the severity of the conflict.

[0089] The vectorization of conflict relationship features employs binary encoding. The system defines a set of conflict types, each corresponding to a binary bit in the vector. When a specific type of conflict is detected, the corresponding bit is set to one; otherwise, it is set to zero. This sparse representation effectively reduces data dimensionality while clearly identifying the types of conflicts. The system generates a conflict feature vector for each user node, summarizing the conflicts present in all its resource accesses. The conflict rule base supports dynamic updates; administrators can add new conflict rules at any time based on changes in organizational policies, and the system will automatically rescan the topology and update the feature vectors.

[0090] The final generation of the permission relationship feature set is achieved by merging dependency feature vectors and conflict feature vectors. The merging operation uses vector concatenation, simply connecting the two types of features in terms of dimension. For example, if the dependency feature vector is fifty-dimensional and the conflict feature vector is ten-dimensional, the merged permission relationship feature vector will be sixty-dimensional. This merging method preserves the independence of the original features and avoids mutual interference between features of different natures. The system performs a secondary standardization on the merged feature set to ensure that the numerical range of each dimension is consistent, preventing certain features with large dimensions from dominating the model training process.

[0091] The permission relationship feature set is input into three pre-trained models for processing. The first permission assessment model is based on role attributes; its input layer receives the dependency portion of the feature vector, focusing on analyzing access patterns formed by inherent attributes such as user position and department. Internally, the model employs a hierarchical decision-making mechanism, first determining the user's broad role category, and then refining the assessment of specific permission levels and types. The second permission assessment model focuses on behavioral pattern analysis, processing dimensions related to access frequency and timing in the feature vector. This model uses sequence analysis methods to identify typical user access habits and abnormal operation patterns. The third permission assessment model addresses environmental risk factors, primarily processing the portion of the feature vector reflecting access environment security. The model combines real-time environmental parameters to assess the appropriate permission level under current network and device conditions.

[0092] The output of all three models is a permission evaluation result set, containing two types of information: permission level and permission type. The permission level is represented numerically, ranging from zero to one hundred, with higher values ​​indicating higher permission levels. The permission type is an enumeration value, including predefined operation types such as read, write, execute, and manage. The system retains the evaluation results of the three models for each user-resource pair, forming an intermediate result set. These result sets are stored in a structured format, containing fields such as model identifier, evaluation timestamp, permission level, and permission type. The system records complete evaluation pipeline information, supporting auditing and traceability of the permission decision-making process.

[0093] Multiple verification mechanisms are implemented during model processing. Integrity checks on input feature vectors ensure the absence of missing or outlier values; resource monitoring during model runtime prevents computation from exceeding predetermined limits; and output validity verification filters out obviously illogical evaluation values. When a processing anomaly is detected, the system automatically triggers a backup evaluation process, such as rolling back to a rule-based simple evaluation mode, ensuring high availability of the permission allocation service. Model version management is strict; each model update retains historical versions, allowing for rapid rollback to previous evaluation logic when necessary.

[0094] The entire implementation process emphasizes the transparency and interpretability of features. The system provides detailed source descriptions for each generated permission relationship feature, annotating its corresponding original data items and calculation paths. The decision logic of the permission evaluation model is displayed through visualization tools, helping administrators understand the reasons behind specific permission allocation results. This transparent design not only meets the requirements of security auditing but also facilitates the discovery and correction of potential problems in the system. Detailed log data is generated at each stage of feature extraction and model evaluation, recording operational metrics such as processing time, data volume, and abnormal events, providing data support for system performance optimization.

[0095] The system's scalable design allows for the flexible addition of new feature types or evaluation models. When new permission-influencing factors need to be introduced, simply add a new feature calculation module after the existing feature extraction process and concatenate the new feature dimensions into the original feature vectors. The evaluation model adopts a plug-in architecture; new models only need to implement standardized input and output interfaces to be added to the evaluation process. This design enables the system to adapt to constantly changing security needs and policy requirements, maintaining the timeliness and accuracy of the permission allocation mechanism. The system provides feature importance analysis tools to help identify the feature dimensions that have the greatest impact on the evaluation results, guiding the direction of subsequent feature engineering optimization.

[0096] Example 3: See Figure 4 The fusion process of the permission assessment result set employs a dynamic weight allocation mechanism, processing assessment results from three models. The role attribute result set output by the first permission assessment model contains permission suggestions based on the user's job title and organizational structure; the behavior pattern result set from the second permission assessment model reflects the user's historical operational characteristics; and the environmental risk result set from the third permission assessment model reflects access restrictions under the current security environment. The system first assigns a priority weight to the permission level in each result set, which is determined by both the permission type and the context.

[0097] The priority coefficient α of the role attribute model is determined by analyzing the permission type. The system maintains a role coefficient mapping table, associating different types of permissions with preset coefficients. For example, the α value for administrator permissions is 0.6, for audit permissions it is 0.5, and for ordinary user permissions it is 0.4. When the permission type involves cross-departmental access, the coefficient is adjusted according to the organizational structure distance: the coefficient for access from a higher-level department to a lower-level department increases by 0.1, and for access between departments at the same level it decreases by 0.05. These adjustment values ​​are set empirically and stored in the configuration library, allowing administrators to modify them according to actual needs.

[0098] The priority coefficient β of the behavioral pattern model is calculated considering operation frequency and temporal characteristics. The system defines a base coefficient of 0.5 and dynamically adjusts it based on the number of visits in the most recent week. After comparing the access frequency f with the standard frequency threshold f0, adjustments are made according to the following rules:

[0099]

[0100] in: This indicates the actual number of times a user accesses the resource. This represents the average number of visits per user of the same type. The tanh function limits the adjustment range to a reasonable level, avoiding the impact of extreme values. For periodic operation patterns, the system adds an additional coefficient of 0.1 to compensate for important visits that conform to the expected cycle but have a low overall frequency.

[0101] The priority coefficient γ of the environmental risk model is determined by real-time security parameters. The base value is set to 0.4, and it is dynamically calculated based on the device security score s (range 0-100) and the network environment risk value r (range 0-10). When the device score is below 60 or the risk value is above 5, the coefficient decreases proportionally, with a minimum value of 0.2; in a secure environment, the coefficient can increase to 0.6. The system uses a piecewise linear function to process these parameters, ensuring smooth coefficient changes that comply with security policy requirements. In special cases, such as detecting an ongoing network attack, all access requests through that network connection will temporarily set γ to 0, completely prohibiting permission granting.

[0102] The overall weight value is calculated using a weighted summation method. For each permission level... (i represents the model number), its comprehensive weight for:

[0103]

[0104] in: , , These correspond to the adjustment coefficients for the i-th permission level in the three models. The calculation results are rounded to two decimal places to avoid floating-point errors. The system maintains a weight matrix for each user-resource pair, recording the evaluation results of each model and their corresponding comprehensive weights, forming a complete set of candidate permissions.

[0105] The generation of the target permission allocation result set adopts a hierarchical merging strategy. Candidate permissions, after filtering, are sorted from highest to lowest level, and permissions of the same level are merged based on type priority. The system defines type priority rules: administrative permissions take precedence over read-write permissions, and read-write permissions take precedence over read-only permissions. Conflicts are detected and resolved during the merging process; for example, when mutually exclusive permission types exist at the same level, the one with the higher overall weight is retained. The final result set is stored in a tree structure, with the root node representing the user-resource pair and the child nodes representing the granted permission items. Each permission item includes attributes such as level, type, and effective time.

[0106] A dynamic weight adjustment mechanism continuously monitors actual access. The system compares users' actual operations with their assigned permissions and calculates a compliance index. When the actual usage rate of a certain permission type consistently falls below expectations, its corresponding model coefficient is appropriately lowered; conversely, frequently used permission types receive a coefficient increase. The adjustment range is controlled within ±0.1 to avoid drastic fluctuations. The coefficient update cycle is set to 24 hours to ensure the system has sufficient time to collect statistically significant behavioral data. Historical coefficient changes are recorded in a dedicated log, supporting backtracking analysis and anomaly detection.

[0107] Permission conflict detection is performed in real time during the integration process. The system loads the resource conflict rule base and checks whether the target permission allocation result set contains mutually exclusive permissions. The detection algorithm traverses all permission combinations in the result set and matches them against predefined conflict patterns. When a conflict is detected, the system automatically handles it according to the conflict resolution strategy: retaining high-weight permissions, retaining frequently used permissions, or completely revoking conflicting permissions. The processing results are recorded in the audit log, including conflict details, resolution methods, and operation timestamps. For complex conflicts that cannot be resolved automatically, a pending task is generated and submitted to the administrator for manual adjudication.

[0108] The result set validation phase implements multiple validations. Syntax checks ensure all fields conform to predefined data formats; logical validation confirms the reasonable correspondence between permission levels and types; consistency checks compare the current allocation with historical records. Entries failing validation trigger a re-evaluation process, potentially rolling back to the last valid allocation scheme. The system maintains a temporary storage area to hold a copy of the result set being validated, updating the main database only after all checks have passed.

[0109] The final generated permission configuration information is converted into a standardized access control language. The system maps permission levels to specific operation permissions; for example, levels 70-79 correspond to read and write permissions, while levels 80 and above include administrative permissions. Each configuration item contains a precise scope, such as column-level permissions for database tables or directory-level permissions for file systems. The configuration information is distributed to each execution node through a secure channel, enforcing specific access control rules on the target system. The distribution process uses an incremental update strategy, transmitting only the changed parts to reduce network load.

[0110] The version control mechanism manages the historical evolution of permission allocation results. Each major update creates a new version branch, recording the complete change context. The system supports point-in-time rollback, allowing restoration of permission configurations for any historical version. Version information is integrated with the user identity management system, ensuring that rollback operations do not disrupt existing authentication relationships. The auditing interface provides version comparison functionality, visually displaying permission differences between different versions to aid in security analysis and decision-making.

[0111] Example 4: The dynamic update mechanism of the permission configuration system achieves closed-loop optimization through continuous monitoring of users' actual access behavior. Taking a financial institution's customer data access system as an example, the system initially configured read and write permissions for Wang, an analyst in the risk management department, to the customer's credit record table, with the permission level set to 65. During actual operation, the system collects all of Wang's operation records through embedded points, forming a detailed access behavior log. After cleaning and structuring, this log data is stored in a dedicated access behavior data warehouse, whose core fields include operation time, user ID, resource type, operation type, and execution result.

[0112] Table 1: The following is a record of Wang's typical visiting behavior in the past week.

[0113] Record ID Operation time User ID Resource types Operation type Execution result Device fingerprint Network environment 1001 2025-08-14 U1005 Customer Credit Record Form Read success DEV-8765 Intranet 1002 2025-08-14 U1005 Customer Credit Record Form Write success DEV-8765 Intranet 1003 2025-08-15 U1005 Customer Transaction Flow Sheet Read fail DEV-9201 VPN 1004 2025-08-16 U1005 Customer Credit Record Form Write success DEV-8765 Intranet 1005 2025-08-17 U1005 Customer Asset Information Sheet Read success MOBILE-1122 4G

[0114] The system performs data analysis tasks every day at midnight, aggregating raw access records into user behavior characteristics. In Wang's case, the analysis revealed three abnormal patterns: Wang frequently accessed unauthorized resources (the customer asset information table) on his mobile device; multiple operation failures occurred when connecting via VPN; and attempts to access the customer transaction log exceeded his current permissions. These behavioral characteristics were quantified into new metrics and updated in the user access behavior dataset. These metrics include dimensions such as cross-resource access rate, non-standard device usage rate, and number of operations during abnormal periods, with each dimension assigned a corresponding weight score.

[0115] The reconstruction of the permission relationship topology graph employs an incremental update strategy. The system retains the basic framework of the original graph structure, modifying only the changed nodes and edges. The edge weight between the Wang node and the customer credit record table node is adjusted from the initial value of 65 to 68 based on the actual access frequency, reflecting its normal usage pattern. Newly added abnormal access edges are marked in red, with an initial weight of 30, indicating a low-confidence temporary relationship. Regarding environmental factors, edges corresponding to VPN connections are marked with a risk flag, and edges accessed by mobile devices are appended with a device security score. These adjustments ensure data consistency through the graph database's transaction mechanism, ensuring that other query operations are not affected during the update process.

[0116] The feature extraction module performs a difference analysis on the updated topology map. It compares the permission relationship feature sets of the old and new versions and calculates the magnitude of change in each dimension. In Wang's case, the dependency relationship feature vector shows a newly added cross-resource access feature value of 0.15, and the conflict relationship feature vector detects a device environment conflict value of 0.2. These changes exceed the preset sensitivity thresholds, triggering the parameter adjustment process of the permission assessment model. The system initiates model diagnostic mode to analyze the current parameters' ability to identify such abnormal behavior, focusing on checking the decision boundaries of the behavior pattern model and the environmental risk model.

[0117] Model parameter adjustments employed a progressive learning approach. New input nodes were added to the neural network layers of the behavioral pattern model, corresponding to newly added unconventional device usage features. The connection weights of existing nodes were fine-tuned based on false alarms, improving the sensitivity for identifying mobile device access patterns by 15%. The environmental risk model updated its risk rule base, adding a combined risk entry for "4G network + mobile device," and incorporating VPN connection failures into the risk assessment metrics. The role attribute model remained relatively stable, with only adjustments made to the strictness of inter-departmental access rules. All parameter changes were recorded in the model version control system, noting the reasons for the adjustments and the expected scope of impact.

[0118] The retraining process uses a dataset containing new behavioral features. The system retrieves similar cases from the past three months of historical storage to construct a balanced training sample set. A 10% validation set is retained during training to prevent overfitting to newly emerging anomalous patterns. Wang's case is marked as a sample requiring focused learning and assigned a higher sample weight during training. The model evaluation phase checks the balance between recall and false positive rates to ensure that parameter adjustments do not lead to excessive restrictions on legitimate permissions. The trained model is deployed to a shadow environment, where its decision consistency is first tested using historical requests before being gradually rolled out to the production environment.

[0119] The optimized permission configuration generation process takes into account multiple factors. In Mr. Wang's case, the system first lowered his permission level on his mobile device, reducing the mobile access permission for the customer credit record table from 65 to 50. Secondly, addressing the issue of unstable VPN connections, batch operation functions were temporarily restricted, while basic query permissions were retained. Finally, for unauthorized access requests to the customer asset information table, a permission upgrade approval work order was generated and forwarded to the department head for review. These adjustments take effect in real time through the configuration management interface, and a detailed permission change notification is sent to the user, explaining the basis for the adjustment and the appeal channel.

[0120] The system establishes a complete feedback loop to handle edge cases. After receiving a permission change notification, Mr. Wang submitted a user manual through the system, explaining that his mobile device access was for urgently handling a customer complaint. This feedback was entered into the case database, and after review, his mobile device permission level was partially restored to 60, but a second authentication requirement was added. The entire feedback processing process took an average of 2 hours, but important and urgent requests could be accelerated to a response time of within 30 minutes. The system continuously tracks user behavior after feedback processing to verify the rationality of permission adjustments and initiates a secondary optimization loop when necessary.

[0121] The audit trail mechanism records the entire lifecycle of permission changes. In Wang's case, detailed audit logs were generated for every intermediate step from initial permission configuration to the final optimization plan, including each automatic adjustment and manual intervention. The logs contain key information such as operation time, executor (system or administrator), change content, and decision basis. Auditors can trace the permission evolution process through a timeline view and check whether each decision point complies with security policies. The system generates a monthly permission change report, statistically analyzing the distribution of reasons for various adjustments and processing timelines, which is used for continuous improvement and optimization of the algorithm.

[0122] Example 5: The hardware architecture of the data access control system adopts a distributed microservice design, with each functional module deployed independently in a containerized environment. The preprocessing module runs on computing nodes with large memory configurations, specifically handling the initial loading and cleaning of user identity and resource information. This module receives change notifications from the data source system via an asynchronous message queue, triggering an incremental update process. When a new user joins or a resource is created, the preprocessing module completes feature extraction and subset filtering within five minutes and writes the processing results to a distributed cache layer. The cached data adopts a sharded storage strategy, with user security level subsets and resource sensitivity subsets stored in different key-value storage areas, and load balancing achieved through a consistent hashing algorithm.

[0123] The data acquisition module consists of multiple collector instances deployed on edge nodes close to the data source. Each collector is responsible for collecting a specific type of data; for example, an operation log collector listens for system audit logs, while an environmental data collector interfaces with a network monitoring system. The collectors implement an adaptive sampling mechanism, automatically reducing the sampling frequency when the system load is high to ensure no impact on core business operations. After initial filtering, the collected raw data is transmitted to the central processing cluster via a dedicated data channel. End-to-end encryption is used during transmission, and data packets include timestamps and digital signatures to prevent man-in-the-middle tampering. The receiving service of the central processing cluster verifies the data integrity, stores it in a time-series database, and adds metadata tags indicating the data source and collection time.

[0124] The topology building module is implemented based on a graph computing framework and runs on GPU-accelerated nodes. This module periodically pulls the latest subsets of user security levels and resource sensitivity from the cache layer, and combines this with real-time information provided by the data acquisition module to construct an in-memory permission relationship graph. Graph node objects contain rich attribute fields; user nodes store organizational information such as department and position, while resource nodes are labeled with classification features such as type and sensitivity. Edge object weights are calculated using a dynamic adjustment algorithm, considering multiple variables such as historical access frequency, recent operation time decay factor, and environmental risk score. The graph structure is fully persisted to the graph database every hour, and incremental updates are recorded using change data capture technology, supporting rapid rollback to any historical version.

[0125] The feature extraction module runs as an independent service, interacting with the topology building module via remote procedure calls. Upon startup, this service loads predefined feature extraction rules, including standardized processing methods, dependency detection algorithms, and conflict identification patterns. When a request arrives, the service loads the corresponding subgraph from the graph database and performs feature computation in memory. The computation results are serialized and stored in the feature repository, while a feature update event is published to the message bus. The feature repository implements version control, retaining snapshots of the ten most recent computation results for subsequent analysis and comparison. Abnormal feature values ​​trigger an alarm process, notifying the administrator to check data quality or adjust the extraction rules.

[0126] The model processing module is deployed as a scalable prediction service cluster, with each permission evaluation model running in an isolated container environment. Upon service startup, the latest trained model parameters and feature mapping tables are loaded from the model repository. Request processing employs a pipelined design; feature vectors first undergo dimensionality consistency checks at the input validation layer before being distributed to three models for parallel evaluation. Each model instance is equipped with resource isolation mechanisms to prevent computationally intensive tasks from impacting overall service response time. Model output results are standardized and formatted before being written to the results database, along with diagnostic information such as model version and evaluation time. Service health is monitored via a heartbeat mechanism; abnormal instances are automatically restarted or removed from the load balancer pool.

[0127] The fusion module implements multi-strategy decision-making logic and runs on an application server with high availability. This service subscribes to update events from the model processing module, triggering the fusion computation process. Internally, the service maintains a weighted rule library, storing priority coefficient configurations for different scenarios. The rule matching process considers factors such as the current system mode, resource sensitivity level, and user risk profile. The fusion computation employs a multi-stage screening strategy, first eliminating obviously conflicting results, then weighting and ranking the remaining candidate solutions. The final decision result generates a structured document containing detailed explanations and justifications for granting permissions, which is submitted to the authorization terminal through the approval workflow engine.

[0128] The configuration generation module interfaces with the management interfaces of various target systems, translating abstract permission descriptions into concrete access control rules. Internally, the module implements an adapter pattern, developing dedicated converters for different types of resource systems. For example, the converter for database systems generates SQL authorization statements, while the converter for file systems produces ACL configuration documents. The conversion process retains complete audit trail information, recording the mapping relationship between the original permission decisions and the final system configuration. Configuration deployment employs a blue-green deployment strategy, first verifying the correctness of the configuration in the test environment before pushing it to the production environment in batches. After each configuration change, the module automatically triggers verification tests to confirm that the actual permissions implemented on the target system are consistent with expectations.

[0129] The update module acts as the system's nerve center, coordinating the collaborative work of all modules. This module implements a state machine engine, managing the various stages of the permission allocation lifecycle. The engine listens for change events from the data source and manual intervention commands, determining which processing flows to trigger based on the current system state. Critical operations such as model retraining and topology reconstruction require health checks and security assessments before execution. The module maintains operation logs and performance metrics for the operations team to monitor system status. A scheduled task triggers routine maintenance jobs, such as weekly data archiving and monthly model evaluation.

[0130] The optimization module runs on a dedicated management cluster, providing model training and parameter tuning capabilities. The training data pipeline extracts labeled samples from the feature repository and historical decision records, performs balancing and augmentation transformations, and then feeds them into the training process. Model training supports multiple algorithm frameworks and is flexibly extensible through a plug-in mechanism. The training process records metadata such as hyperparameters, feature importance, and validation metrics for easy analysis and comparison later. Newly trained models are only marked as production candidates after their performance has been verified through A / B testing. The parameter tuning interface allows security experts to interactively adjust decision thresholds and observe the impact on the test dataset in real time.

[0131] The system implements fine-grained access control to ensure its security. Each module's service account is configured with minimum necessary permissions, and inter-module communication uses two-way TLS authentication. Management operations require multi-factor authentication, and critical configuration changes require double approval. Audit logs are synchronized to the security information and event management system in real time, and abnormal behavior triggers automatic response rules. The system undergoes regular penetration testing and architecture reviews, and potential vulnerabilities are promptly patched.

[0132] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0133] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A data access control method based on information security, characterized in that, include: Data preprocessing is performed on the pre-collected user identity information set and resource information set to obtain user security level subset and resource sensitivity subset, wherein the user identity information set includes user identity authentication data and the resource information set includes resource classification data; Obtain the user access behavior dataset corresponding to the user security level subset and the resource access environment dataset corresponding to the resource sensitivity subset; For the user access behavior dataset and resource access environment dataset, construct a permission relationship topology graph between users and resources, wherein the nodes of the permission relationship topology graph include user nodes and resource nodes, and the edges represent access relationships; For the constructed permission relationship topology graph, extract the permission relationship feature set; For the permission relationship feature set, the permission relationship feature set is input into multiple pre-trained permission evaluation models to obtain multiple permission evaluation result sets, wherein each permission evaluation result set includes permission level and permission type; For the multiple permission evaluation result sets, they are merged according to a preset fusion strategy to obtain the target permission allocation result set; Based on the target permission allocation result set, generate access permission configurations for each user in the user identity information set to each resource in the resource information set; The process of fusing according to a preset fusion strategy to obtain a target permission allocation result set includes: Priority weights are assigned to the permission levels in the first permission evaluation result set, the second permission evaluation result set, and the third permission evaluation result set, respectively. Calculate the overall weight value for each permission level based on the priority weights; Filter permission levels whose comprehensive weight values ​​meet the preset threshold as candidate permission levels; Merge all candidate permission levels and their corresponding permission types to generate the target permission allocation result set; Priority weights are assigned to the permission levels in the first permission evaluation result set, the second permission evaluation result set, and the third permission evaluation result set, respectively, including: Based on the permission types in the first permission evaluation result set, determine the priority coefficient of the role attribute; Based on the permission types in the second permission evaluation result set, determine the priority coefficient of the behavior pattern; Based on the permission type of the third permission assessment result set, determine the priority coefficient of the environmental risk; Based on the priority coefficient, the weight allocation of the permission level in each permission evaluation result set is dynamically adjusted.

2. The data access control method based on information security according to claim 1, characterized in that, Data preprocessing is performed on the user identity information set and resource information set to obtain a user security level subset and a resource sensitivity subset, including: Extract key attribute features from the user identity information set to generate a user security level feature vector; Extract the key attribute features of the resource information set to generate a resource sensitivity feature vector; Based on preset security threshold conditions, the user security level feature vector is filtered to obtain a subset of user security levels; Based on a preset sensitivity threshold, the resource sensitivity feature vector is filtered to obtain a resource sensitivity subset.

3. The data access control method based on information security according to claim 1, characterized in that, The construction of the permission relationship topology diagram between users and resources includes: Based on the historical access records of the user access behavior dataset, the initial connection relationship between user nodes and resource nodes is determined; The weight values ​​of the initial connection relationships are adjusted based on the environmental security parameters of the resource access environment dataset. Based on the adjusted weight values, the access strength features of each edge in the permission relationship topology graph are generated.

4. The data access control method based on information security according to claim 3, characterized in that, The extracted permission relationship feature set includes: The access strength features of each edge in the permission relationship topology graph are normalized to obtain a standardized access strength feature set. Extract dependency features between nodes from the standardized access strength feature set to generate a permission dependency feature vector; Extract conflict relationship features between nodes from the standardized access strength feature set to generate a permission conflict feature vector; The permission dependency feature vector and the permission conflict feature vector are merged to obtain the permission relationship feature set.

5. The data access control method based on information security according to claim 1, characterized in that, The permission relationship feature set is input into multiple pre-trained permission evaluation models to obtain multiple permission evaluation result sets, including: The permission relationship feature set is input into the first permission evaluation model, and the first permission evaluation result set is output, wherein the first permission evaluation result set includes permission level and permission type based on role attributes; The permission relationship feature set is input into the second permission evaluation model, and the second permission evaluation result set is output. The second permission evaluation result set includes permission levels and permission types based on behavior patterns. The permission relationship feature set is input into the third permission evaluation model, and the third permission evaluation result set is output. The third permission evaluation result set includes permission level and permission type based on environmental risk.

6. The data access control method based on information security according to claim 1, characterized in that, After generating the access permission configuration, it also includes: Real-time monitoring of users' actual access behavior data to resources; Update the user access behavior dataset based on the actual access behavior data; Based on the updated user access behavior dataset, the steps of constructing the permission relationship topology graph, extracting the permission relationship feature set, inputting the permission evaluation model, and fusing the data are re-executed to generate an optimized access permission configuration.

7. The data access control method based on information security according to claim 6, characterized in that, After updating the user access behavior dataset, the following is also included: Based on the deviation between the actual access behavior data and the target permission allocation result set, adjust the parameters of multiple permission evaluation models; Based on the adjusted parameters, the multiple permission evaluation models were retrained.

8. A data access control system based on information security, used to implement the data access control method based on information security as described in any one of claims 1 to 7, characterized in that, include: The preprocessing module is used to preprocess the user identity information set and resource information set to generate a subset of user security level and a subset of resource sensitivity. The data acquisition module is used to obtain user access behavior datasets corresponding to subsets of user security levels and resource access environment datasets corresponding to subsets of resource sensitivity. The topology building module is used to construct a topology diagram of permission relationships between users and resources based on user access behavior datasets and resource access environment datasets. The feature extraction module is used to extract the permission relationship feature set from the permission relationship topology graph; The model processing module is used to input the permission relationship feature set into multiple permission evaluation models to obtain multiple permission evaluation result sets; The fusion module is used to execute fusion strategies on multiple permission evaluation result sets to generate a target permission allocation result set; The configuration generation module is used to generate user access permission configurations for resources based on the target permission allocation result set; The update module is used to update the user access behavior dataset based on actual access behavior data and trigger the topology building module to run again; The optimization module is used to adjust the parameters of the permission assessment model based on actual access behavior data and retrain the model.

Images