A system security and data protection mechanism method

Abstract

This invention discloses a system security and data protection mechanism, comprising the following steps: receiving a user access request; performing permission verification based on a fusion mechanism of RBAC and ABAC to obtain session information; querying a field sensitivity level table based on the session information, generating a field risk weight vector and combining it with access behavior features to obtain a weighted feature vector; calling an improved LOF model to obtain a comprehensive outlier factor score; obtaining a mask level and encryption flag based on the comprehensive outlier factor score; obtaining de-identified response data based on the mask level; performing transparent encryption on the target field based on the encryption flag to obtain the encryption status; generating structured de-identified audit entries based on session information, mask level, comprehensive outlier factor score, de-identified response data, and encryption status to obtain audit records. This invention employs an improved LOF model to achieve system security and data protection.

Description

Technical Field

[0001] This invention relates to the field of computer information security technology, and in particular to a system security and data protection mechanism. Background Technology

[0002] With the widespread application of information systems in government, finance, and education, user access requests are increasing daily, revealing shortcomings in system access control and data protection. Existing technologies generally employ Role-Based Access Control (RBAC), which determines permissions based on the mapping relationship between roles and resources. However, in scenarios with multi-region concurrency and large-scale users, frequent configuration is required, easily leading to unauthorized access and redundant authorization. To improve flexibility, some systems have introduced Attribute-Based Access Control (ABAC), utilizing user attributes, access time, device type, and region for judgment. However, the lack of integration mechanisms with RBAC results in insufficient authorization efficiency in complex environments.

[0003] In terms of data protection, existing solutions mostly employ fixed de-identification and encryption strategies, statically processing sensitive fields such as mobile phone numbers, ID card numbers, and bank account numbers, which are difficult to dynamically adjust based on the access context. Log records are often stored in plaintext for operation details, which, while convenient for auditing, increases the risk of internal misuse. Furthermore, transparent encryption at the database level is insufficient, meaning sensitive information can still be leaked when the storage layer is attacked.

[0004] In anomaly detection, traditional methods often rely on fixed thresholds or rule matching. Some studies have introduced Local Outlier Factor (LOF) models, but conventional LOF is based solely on uniform distance and single density estimation, without weighting based on field sensitivity or multi-dimensional density modeling of contextual pathways, resulting in limited accuracy in complex access scenarios. More critically, existing solutions have not yet integrated anomaly detection results with de-identification, encryption, and log auditing, making it difficult to build an integrated mechanism from risk assessment to security strategy. Therefore, there is still room for improvement.

[0005] Therefore, how to provide a system security and data protection mechanism is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0006] One objective of this invention is to propose a system security and data protection mechanism. This invention generates session information by integrating role determination and attribute determination during the access control phase. During the risk assessment phase, it uses an improved LOF model to introduce field sensitivity weights and context path multi-density estimation to obtain a comprehensive outlier factor score. The score results are then linked with a threshold mapping table to determine de-identification, encryption, and auditing strategies. This invention details an integrated technical process from access authentication and risk identification to data processing, which has the advantages of flexible access control, high anomaly detection accuracy, broad data protection scope, and strong audit traceability.

[0007] A system security and data protection mechanism method according to an embodiment of the present invention includes the following steps:

[0008] Receive user access requests, complete identity authentication, extract user identifier, resource identifier and context information, and perform permission verification based on the RBAC and ABAC fusion mechanism to obtain session information;

[0009] Based on the session information, query the field sensitivity level table, generate a field risk weight vector, and combine it with access behavior features to obtain a weighted feature vector;

[0010] The improved LOF model is invoked, and outlier calculation and path weighted fusion are performed on the weighted feature vector based on session information and field risk weight vector to obtain a comprehensive outlier factor score.

[0011] The field protection action is determined based on the comprehensive outlier factor score and threshold mapping table, and the mask level and encryption flag are obtained.

[0012] Based on the mask level, perform template-based de-identification on the target fields in the interface response to obtain de-identified response data;

[0013] Based on the encryption flag, the target field is transparently encrypted in the persistent write path and transparently decrypted in the read path to obtain the encrypted state;

[0014] Based on session information, mask level, comprehensive outlier factor score, de-identification response data, and encryption status, structured de-identification audit entries are generated to obtain audit records.

[0015] Optionally, the steps of receiving user access requests, completing identity authentication, extracting user identifiers, resource identifiers, and context information, and performing permission verification based on the RBAC and ABAC fusion mechanism to obtain session information specifically include:

[0016] Receive user access requests, parse the user identifier request field, target resource identifier request field, and environment context field set to obtain the raw request data;

[0017] The system performs an authentication operation on the user identifier request field, compares and verifies the user identifier with the authentication server, generates a corresponding unique user identifier when the authentication result is successful, and outputs a failure flag and terminates the access request processing flow when the authentication result is unsuccessful.

[0018] The environmental context field set is standardized by converting role information into role identifiers, access time information into standardized timestamps, device information into unique device numbers, and geographic area information into area codes. The role identifier, standardized timestamp, unique device number, and area code are then combined sequentially to form an access context attribute vector.

[0019] The system parses the received target resource identifier request field, converts the resource name, resource path, or resource number into a unified encoding format according to the system's preset rules, and generates a corresponding resource code for each access request.

[0020] The role-based access control mechanism is invoked, and the user's unique identifier and resource code are used as input parameters for matching and retrieval. Based on the preset role permission mapping relationship, it is determined whether the user has the permission to access the resource. When the matching result is allowed, a pass sign is generated; when the matching result is denied, a fail sign is generated, and the RBAC judgment result is obtained.

[0021] The attribute-based access control mechanism is invoked, taking the context attribute vector, user unique identifier and resource code as input, setting the attribute judgment predicate, calculating the attribute judgment predicate, and outputting a value of 1 if the judgment condition is met, and outputting a value of 0 if the judgment condition is not met, thereby generating the ABAC judgment result.

[0022] The RBAC and ABAC judgment results are merged. Specifically, the value status of the RBAC and ABAC judgment results is detected simultaneously. Only when both are in the pass state is the permission verification result generated as pass state; otherwise, the permission verification result is generated as fail state.

[0023] When the permission verification result is passed, the user's unique identifier, resource code, and context attribute vector are combined to generate complete session information. When the permission verification result is failed, an access denial flag is output and the access request processing flow is terminated immediately.

[0024] Optionally, the step of querying the field sensitivity level table based on session information, generating a field risk weight vector, and combining it with access behavior features to obtain a weighted feature vector specifically includes:

[0025] The user's unique identifier, resource code, and target field content from the access context information are extracted sequentially from the session information. The target field content includes data fields involved in the access request, specifically user account, order number, recipient's name, ID number, contact number, bank account, address information, and product information. The target field content is then grouped according to field name to form a target field set.

[0026] Each field in the target field set is retrieved one by one from the preset field sensitivity level table. According to the sensitivity level label of the field, the corresponding risk weight value is assigned to the field. The risk weight value of the public field is recorded as the lowest level, the risk weight value of the restricted field is recorded as the middle level, and the risk weight value of the sensitive field is recorded as the highest level. The risk weight values ​​of each field are arranged and combined in sequence to form a field risk weight vector.

[0027] The access context information in the session information is expanded and processed, the role information is converted into role features, the access time information is converted into standardized time features, the device identification information is converted into device features, the geographic area information is converted into regional features, and the role features, standardized time features, device features and regional features are combined in sequence to form an access behavior feature set.

[0028] The risk weight vector of the field and the access behavior feature set are combined and concatenated in a predetermined order. First, the risk weights corresponding to the target field are arranged in order to form the risk weight part. Then, the access behavior features such as role attributes, time attributes, device attributes and regional attributes are arranged in order to form the behavior feature part. Finally, the risk weight part and the behavior feature part are merged into a single data structure to generate a complete weighted feature vector.

[0029] Optionally, the step of calling the improved LOF model, which calculates outlier degree and performs path-weighted fusion on the weighted feature vector based on session information and field risk weight vectors to obtain a comprehensive outlier factor score, specifically includes:

[0030] An improved LOF model is invoked. This improved LOF model constructs a weighted Euclidean distance function based on the field risk weight vector. The difference in sensitivity level of different fields affects the distance calculation result, and a weighted distance result is obtained.

[0031] In the improved LOF model, multiple density estimation paths are dynamically selected based on the context attribute vector, and the local reachability density is calculated based on the weighted distance results to obtain the local reachability density results of the paths.

[0032] In the improved LOF model, the path local reachability density result is used as input, and the outlier factor score under the current weighted feature vector is calculated. Specifically, the path local reachability density corresponding to each weighted feature vector in the neighborhood set is compared with the path local reachability density of the current weighted feature vector, and then the average of all ratios is taken to generate the path outlier factor score result.

[0033] In the improved LOF model, the outlier factor scores of multiple pathways are weighted and fused, and the pathway weight coefficients determined by the context attribute vector are used to obtain the comprehensive outlier factor score.

[0034] Optionally, in the improved LOF model, dynamically selecting multiple density estimation paths based on the context attribute vector and calculating the local reachability density based on the weighted distance results to obtain the path local reachability density results specifically includes:

[0035] The context attribute vector in the session information is parsed, and role attribute, time attribute, device attribute and region attribute are extracted in sequence. A set of context paths is established based on the extraction results, and the corresponding neighborhood size parameter, time window parameter and region constraint identifier are determined for each context path, thereby generating a set of path parameters that match the context attribute vector.

[0036] For each context path, the improved LOF model uses the weighted feature vector as the center. Based on the neighborhood size parameter, time window parameter, and region constraint label in the path parameter set, sample points that meet the conditions are selected from the reference sample set. First, the time difference between the sample point and the current weighted feature vector is limited to no more than the corresponding time window range. At the same time, the region to which the sample point belongs is consistent with the region constraint label. Then, the sample points that meet the conditions are sorted in ascending order according to the size of the weighted Euclidean distance, and the first few sample points corresponding to the neighborhood size parameter are selected to form the path neighborhood set.

[0037] In the neighborhood set formed under each context path, sample points in the neighborhood set are selected one by one as reference points. The k-th nearest neighbor of the reference point is determined after sorting the reference point with other sample points according to the weighted Euclidean distance. The distance between the reference point and the k-th nearest neighbor is calculated and defined as the k-distance of the reference point under the path. The path k-nearest distance result is obtained in this way.

[0038] In the neighborhood set formed under each context path, reference points are selected one by one, the weighted Euclidean distance between the reference point and the current weighted feature vector is calculated, and the weighted Euclidean distance is compared with the k distance of the reference point under the path. The larger value is taken as the path reachable distance of the reference point relative to the current weighted feature vector, and the path reachable distance result is obtained.

[0039] Based on the path reachability distance results, all samples in the path neighborhood set are traversed and calculated. First, the number of elements in the path neighborhood set is counted as the set cardinality. Then, with the weighted feature vector as the center, the path reachability distances corresponding to each neighborhood sample are accumulated and averaged. Finally, the reciprocal of the average value is taken to generate the path local reachability density results.

[0040] Optionally, the step of determining the field protection action based on the comprehensive outlier factor score and threshold mapping table to obtain the mask level and encryption flag specifically includes:

[0041] The comprehensive outlier factor score is called, and a preset threshold mapping table is read at the same time. The threshold mapping table defines multiple thresholds, which are arranged in order of numerical value, and satisfy the condition that the first threshold is less than the second threshold, and the second threshold is less than the third threshold.

[0042] When the comprehensive outlier factor score is less than the first threshold in the threshold mapping table, the mask level is set to zero, the encryption flag is set to zero, and a processing result without any field protection actions is generated.

[0043] When the comprehensive outlier factor score is greater than or equal to the first threshold in the threshold mapping table and less than the second threshold, the mask level is determined to be one, the encryption flag is zero, and the interface layer generates a field protection action to desensitize the target field.

[0044] When the comprehensive outlier factor score is greater than or equal to the second threshold in the threshold mapping table and less than the third threshold, the mask level is determined to be two, the encryption flag is one, and a combined field protection result including interface layer field desensitization processing and database field encryption processing is generated.

[0045] When the comprehensive outlier factor score is greater than or equal to the third threshold in the threshold mapping table, the mask level is set to three, the encryption flag is set to one, and a joint field protection processing result including interface layer field desensitization, database field encryption, and log mandatory auditing is generated.

[0046] Optionally, template-based de-identification can be performed on the target fields in the interface response according to the mask level, resulting in de-identified response data including:

[0047] Call the mask level and select the corresponding field masking template set from the field masking template set according to the mask level. When the mask level is zero, it corresponds to an empty template; when the mask level is one, it corresponds to a level one masking template; when the mask level is two, it corresponds to a level two masking template; and when the mask level is three, it corresponds to a level three masking template.

[0048] When the mask level is zero, an empty template is selected, and the target field in the interface response is kept as the original data without any desensitization processing, and desensitized response data consistent with the original field data is directly generated.

[0049] When the mask level is one, select the first-level masking template, process the target fields in the interface response in turn, partially replace or hide each target field according to the preset first-level masking rules, retain some valid information and block the rest of sensitive content, generate a set of fields after first-level masking, and combine the field set to form masked response data.

[0050] When the masking level is two, the second-level desensitization template is selected, and the target fields in the interface response are processed one by one. Each target field is hidden or replaced with a higher intensity according to the preset second-level desensitization rules. Only the necessary field structure is retained while most of the sensitive information is masked, forming a set of fields that have been processed by the second level of desensitization. The field set is then combined to generate desensitized response data that is consistent with the original response data structure.

[0051] When the masking level is three, the three-level desensitization template is selected, and the target fields in the interface response are subjected to the highest level of desensitization processing in sequence. All sensitive information is processed by completely hiding, symbol replacement or fixed format masking, and only the basic structural identifier of the field is retained. No recognizable original content is retained, forming a set of fields after three-level desensitization processing. The field set is then combined to generate the final desensitized response data.

[0052] Optionally, the step of performing transparent encryption on the target field in the persistent write path and transparent decryption in the read path based on the encryption flag to obtain the encryption state specifically includes:

[0053] Call the encryption flag. When the encryption flag is one, perform transparent encryption on the target field in the persistent write path. When the encryption flag is zero, write the original field data directly.

[0054] When performing transparent encryption, a key derivation parameter set is formed by combining the user's unique identifier, resource code, and target field identifier. The parameter set is then submitted to the key management system, which calls the preset key derivation function to generate the corresponding field-level key.

[0055] When performing transparent encryption, the target field data is processed using a preset symmetric encryption algorithm with the field-level key as the encryption parameter. The target field data is then used as the input plaintext for encryption to generate the corresponding ciphertext field data.

[0056] In the database persistent write path, the encrypted field data is stored to replace the original field data, while maintaining the data structure consistent with the original table structure;

[0057] During the reading process, the fields are transparently decrypted based on the encryption flags. The corresponding field-level key is called to execute the decryption function, obtain the decrypted field data, replace the ciphertext field data with the decrypted field data, and return it to the upper-layer application to generate an encrypted state.

[0058] Optionally, the generation of structured de-identification audit entries based on session information, mask level, comprehensive outlier factor score, de-identification response data, and encryption status, resulting in audit records, specifically includes:

[0059] The log input parameter set is obtained by retrieving session information, mask level, comprehensive outlier factor score, desensitization response data, and encryption status.

[0060] Based on the set of log input parameters, the session information is parsed to extract the user's unique identifier, resource code, and context attribute vector, which are then combined with the mask level and encryption status to form session protection attribute entries.

[0061] The desensitized response data is correlated with the comprehensive outlier factor score to establish response audit entries. These response audit entries are used to characterize the one-to-one correspondence between the interface returned data and the dynamic risk assessment results.

[0062] In log processing, session protection attribute entries and response audit entries are recorded in a unified manner according to a preset structured format to generate complete audit entries, which are then written to the log database to generate audit records.

[0063] The beneficial effects of this invention are:

[0064] This invention overcomes the limitations of traditional single-model access control, which suffers from complex configuration and insufficient flexibility in environments with large-scale users and multi-regional concurrency, by simultaneously introducing RBAC and ABAC mechanisms. By integrating role-based and attribute-based judgments, this invention achieves finer-grained permission management while maintaining access efficiency, avoiding redundant authorization and unauthorized access issues, and making permission control more suitable for complex business scenarios.

[0065] In anomaly detection, this invention utilizes an improved LOF model, incorporating field sensitivity weights into distance calculations and dynamically selecting multiple density estimation paths based on contextual attributes. A comprehensive outlier factor score is then generated through weighted fusion. Compared to traditional detection methods that rely solely on uniform distance and a single neighborhood, this model more comprehensively reflects the degree of anomaly in access requests under sensitive field and contextual conditions, thereby improving the accuracy and robustness of risk identification.

[0066] At the data protection layer, this invention uses a threshold mapping mechanism to link the comprehensive outlier factor score with desensitization and encryption actions, enabling dynamic adjustment of field protection strategies. Under different access risk levels, the system can flexibly choose a combination of interface response desensitization, database field encryption, and mandatory log auditing, avoiding the problems of insufficient or excessive desensitization caused by static strategies, and strengthening the security of sensitive information during storage and transmission.

[0067] In the auditing phase, this invention unifies session information, anonymized response data, encryption status, and risk scoring results into structured audit entries. This ensures that logs not only record user behavior but also correspond one-to-one with risk assessment results. This design improves the integrity and traceability of audit data, providing reliable support for post-event compliance checks and security forensics, and overall enhancing the system's data security and compliance management capabilities in complex environments. Attached Figure Description

[0068] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0069] Figure 1 This is a flowchart of a system security and data protection mechanism proposed in this invention;

[0070] Figure 2 This is a schematic diagram of the RBAC and ABAC fusion permission verification mechanism of the system security and data protection mechanism proposed in this invention;

[0071] Figure 3 This is a schematic diagram of the structure of an improved LOF model for a system security and data protection mechanism proposed in this invention;

[0072] Figure 4 This is a schematic diagram of the field protection strategy linkage mechanism of a system security and data protection mechanism proposed in this invention. Detailed Implementation

[0073] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0074] refer to Figure 1-4 A system security and data protection mechanism method includes the following steps:

[0075] Receive user access requests, complete identity authentication, extract user identifier, resource identifier and context information, and perform permission verification based on the RBAC and ABAC fusion mechanism to obtain session information;

[0076] Based on the session information, query the field sensitivity level table, generate a field risk weight vector, and combine it with access behavior features to obtain a weighted feature vector;

[0077] The improved LOF model is invoked, and outlier calculation and path weighted fusion are performed on the weighted feature vector based on session information and field risk weight vector to obtain a comprehensive outlier factor score.

[0078] The field protection action is determined based on the comprehensive outlier factor score and threshold mapping table, and the mask level and encryption flag are obtained.

[0079] Based on the mask level, perform template-based de-identification on the target fields in the interface response to obtain de-identified response data;

[0080] Based on the encryption flag, the target field is transparently encrypted in the persistent write path and transparently decrypted in the read path to obtain the encrypted state;

[0081] Based on session information, mask level, comprehensive outlier factor score, de-identification response data, and encryption status, structured de-identification audit entries are generated to obtain audit records.

[0082] This invention introduces a fusion mechanism of RBAC and ABAC into access request processing to achieve multi-dimensional permission verification based on identity and context, ensuring refined access control. Based on this, a field risk weight vector is generated by combining a field sensitivity level table and fused with access behavior characteristics. An improved LOF model is used for outlier calculation and multi-path weighted fusion to obtain a comprehensive outlier factor score, thereby achieving dynamic quantitative judgment of access risk. The mask level and encryption flag are determined according to the score and threshold mapping table, driving interface de-identification and transparent database encryption operations, ensuring that data is under controlled protection during transmission and storage. Finally, by recording session information, mask level, comprehensive outlier factor score, de-identified response data, and encryption status, structured de-identification audit entries are generated, achieving traceability and auditability of the entire access process.

[0083] In this embodiment, the steps of receiving user access requests, completing identity authentication, extracting user identifiers, resource identifiers, and context information, and performing permission verification based on the RBAC and ABAC fusion mechanism to obtain session information specifically include:

[0084] Receive user access requests, parse the user identifier request field, target resource identifier request field, and environment context field set to obtain the raw request data;

[0085] The system performs an authentication operation on the user identifier request field, compares and verifies the user identifier with the authentication server, generates a corresponding unique user identifier when the authentication result is successful, and outputs a failure flag and terminates the access request processing flow when the authentication result is unsuccessful.

[0086] The environmental context field set is standardized by converting role information into role identifiers, access time information into standardized timestamps, device information into unique device numbers, and geographic area information into area codes. The role identifier, standardized timestamp, unique device number, and area code are then combined sequentially to form an access context attribute vector.

[0087] The system parses the received target resource identifier request field, converts the resource name, resource path, or resource number into a unified encoding format according to the system's preset rules, and generates a corresponding resource code for each access request.

[0088] The role-based access control mechanism is invoked, and the user's unique identifier and resource code are used as input parameters for matching and retrieval. Based on the preset role permission mapping relationship, it is determined whether the user has the permission to access the resource. When the matching result is allowed, a pass sign is generated; when the matching result is denied, a fail sign is generated, and the RBAC judgment result is obtained.

[0089] The attribute-based access control mechanism is invoked, taking the context attribute vector, user unique identifier and resource code as input, setting attribute judgment predicates to describe the constraints of user role, access time, device identifier and geographical region on access behavior, calculating the attribute judgment predicates, and outputting a value of 1 if the judgment conditions are met, and outputting a value of 0 if the judgment conditions are not met, thereby generating the ABAC judgment result.

[0090] The RBAC and ABAC judgment results are merged. Specifically, the value status of the RBAC and ABAC judgment results is detected simultaneously. Only when both are in the pass state is the permission verification result generated as pass state; otherwise, the permission verification result is generated as fail state.

[0091] When the permission verification result is passed, the user's unique identifier, resource code, and context attribute vector are combined to generate complete session information. When the permission verification result is failed, an access denial flag is output and the access request processing flow is terminated immediately.

[0092] In this embodiment, the step of querying the field sensitivity level table based on session information, generating a field risk weight vector, and combining it with access behavior features to obtain a weighted feature vector specifically includes:

[0093] The user's unique identifier, resource code, and target field content from the access context information are extracted sequentially from the session information. The target field content includes data fields involved in the access request, specifically user account, order number, recipient's name, ID number, contact number, bank account, address information, and product information. The target field content is then grouped according to field name to form a target field set.

[0094] Each field in the target field set is retrieved one by one from the preset field sensitivity level table. According to the sensitivity level label of the field, the corresponding risk weight value is assigned to the field. The risk weight value of the public field is recorded as the lowest level, the risk weight value of the restricted field is recorded as the middle level, and the risk weight value of the sensitive field is recorded as the highest level. The risk weight values ​​of each field are arranged and combined in sequence to form a field risk weight vector.

[0095] The access context information in the session information is expanded and processed, the role information is converted into role features, the access time information is converted into standardized time features, the device identification information is converted into device features, the geographic area information is converted into regional features, and the role features, standardized time features, device features and regional features are combined in sequence to form an access behavior feature set.

[0096] The risk weight vector of the field and the access behavior feature set are combined and concatenated in a predetermined order. First, the risk weights corresponding to the target field are arranged in order to form the risk weight part. Then, the access behavior features such as role attributes, time attributes, device attributes and regional attributes are arranged in order to form the behavior feature part. Finally, the risk weight part and the behavior feature part are merged into a single data structure to generate a complete weighted feature vector.

[0097] In this embodiment, the step of calling the improved LOF model, calculating the outlier degree and performing path-weighted fusion on the weighted feature vector based on session information and field risk weight vectors to obtain a comprehensive outlier factor score specifically includes:

[0098] An improved LOF model is invoked. This improved LOF model constructs a weighted Euclidean distance function based on the field risk weight vector, taking into account the influence of the sensitivity level differences of different fields on the distance calculation result, to obtain the weighted distance result:

[0099] ;

[0100] in, This represents the weighted feature vectors corresponding to two access requests in the improved LOF model. and The weighted Euclidean distance between them , These represent instances of the weighted feature vector under different access requests. This indicates the total number of fields in the target field set. This represents the field index in the target field set. This represents the risk weight value of the target field in the field risk weight vector. Represents the weighted eigenvector In the Numerical values ​​for each field dimension Represents the weighted eigenvector In the Numerical values ​​for each field dimension;

[0101] In the improved LOF model, multiple density estimation paths are dynamically selected based on the context attribute vector, and the local reachability density is calculated based on the weighted distance results to obtain the local reachability density results of the paths.

[0102] In the improved LOF model, the path local reachability density result is used as input, and the outlier factor score under the path is calculated for the current weighted feature vector. Specifically, the path local reachability density corresponding to each weighted feature vector in the neighborhood set is compared with the path local reachability density of the current weighted feature vector, and then the average of all ratios is taken to generate the path outlier factor score result. The path outlier factor score result is used to characterize the degree of abnormality of the current weighted feature vector relative to the neighborhood set under the selected path.

[0103] In the improved LOF model, the outlier scores of multiple pathways are weighted and fused, and the pathway weight coefficients determined by the context attribute vector are used to obtain the comprehensive outlier score:

[0104] ;

[0105] in, This represents the comprehensive outlier score obtained by weighted fusion of outlier score results from multiple contextual pathways for weighted feature vectors in the improved LOF model. Index symbols representing contextual paths, Represents the weighted eigenvector In the pathway The weighting coefficients below, Represents the weighted eigenvector In the pathway The outlier factor scores of the pathways were calculated below. This represents the weighted eigenvector.

[0106] In this embodiment, the step of dynamically selecting multiple density estimation paths based on the context attribute vector in the improved LOF model and calculating the local reachability density based on the weighted distance results to obtain the path local reachability density results specifically includes:

[0107] The context attribute vector in the session information is parsed, and role attribute, time attribute, device attribute and region attribute are extracted in sequence. A set of context paths is established based on the extraction results, and the corresponding neighborhood size parameter, time window parameter and region constraint identifier are determined for each context path, thereby generating a set of path parameters that match the context attribute vector.

[0108] For each context path, the improved LOF model uses the weighted feature vector as the center. Based on the neighborhood size parameter, time window parameter, and region constraint label in the path parameter set, sample points that meet the conditions are selected from the reference sample set. First, the time difference between the sample point and the current weighted feature vector is limited to no more than the corresponding time window range. At the same time, the region to which the sample point belongs is consistent with the region constraint label. Then, the sample points that meet the conditions are sorted in ascending order according to the size of the weighted Euclidean distance, and the first few sample points corresponding to the neighborhood size parameter are selected to form the path neighborhood set.

[0109] In the neighborhood set formed under each context path, sample points in the neighborhood set are selected one by one as reference points. The k-th nearest neighbor of the reference point is determined after sorting the reference point with other sample points according to the weighted Euclidean distance. The distance between the reference point and the k-th nearest neighbor is calculated and defined as the k-distance of the reference point under the path. The path k-nearest distance result is obtained in this way.

[0110] In the neighborhood set formed under each context path, reference points are selected one by one, the weighted Euclidean distance between the reference point and the current weighted feature vector is calculated, and the weighted Euclidean distance is compared with the k distance of the reference point under the path. The larger value is taken as the path reachable distance of the reference point relative to the current weighted feature vector, and the path reachable distance results corresponding to all reference points in the path are obtained.

[0111] Based on the path reachability distance results, all samples in the path neighborhood set are traversed and calculated. First, the number of elements in the path neighborhood set is counted as the set cardinality. Then, with the weighted feature vector as the center, the path reachability distances corresponding to each neighborhood sample are accumulated and averaged. Finally, the reciprocal of the average value is taken to generate the path local reachability density result. The path local reachability density result is used to characterize the density level of the current weighted feature vector relative to the neighborhood set in the selected context path.

[0112] In this embodiment, the step of determining the field protection action based on the outlier factor score and threshold mapping table to obtain the mask level and encryption flag specifically includes:

[0113] The comprehensive outlier factor score is called, and a preset threshold mapping table is read at the same time. The threshold mapping table defines multiple thresholds, which are arranged in order of numerical value, and satisfy the condition that the first threshold is less than the second threshold, and the second threshold is less than the third threshold.

[0114] When the comprehensive outlier factor score is less than the first threshold in the threshold mapping table, the mask level is set to zero, the encryption flag is set to zero, and a processing result without any field protection actions is generated.

[0115] When the comprehensive outlier factor score is greater than or equal to the first threshold in the threshold mapping table and less than the second threshold, the mask level is determined to be one, the encryption flag is zero, and the interface layer generates a field protection action to desensitize the target field.

[0116] When the comprehensive outlier factor score is greater than or equal to the second threshold in the threshold mapping table and less than the third threshold, the mask level is determined to be two, the encryption flag is one, and a combined field protection result including interface layer field desensitization processing and database field encryption processing is generated.

[0117] When the comprehensive outlier factor score is greater than or equal to the third threshold in the threshold mapping table, the mask level is set to three, the encryption flag is set to one, and a joint field protection processing result including interface layer field desensitization, database field encryption, and log mandatory auditing is generated.

[0118] In this embodiment, template-based desensitization is performed on the target fields in the interface response according to the mask level, and the desensitized response data specifically includes:

[0119] Call the mask level and select the corresponding field masking template set from the field masking template set according to the mask level. When the mask level is zero, it corresponds to an empty template; when the mask level is one, it corresponds to a level one masking template; when the mask level is two, it corresponds to a level two masking template; and when the mask level is three, it corresponds to a level three masking template.

[0120] When the mask level is zero, an empty template is selected, and the target field in the interface response is kept as the original data without any desensitization processing, and desensitized response data consistent with the original field data is directly generated.

[0121] When the mask level is one, select the first-level masking template, process the target fields in the interface response in turn, partially replace or hide each target field according to the preset first-level masking rules, retain some valid information and block the rest of sensitive content, generate a set of fields after first-level masking, and combine the field set to form masked response data.

[0122] When the masking level is two, the second-level desensitization template is selected, and the target fields in the interface response are processed one by one. Each target field is hidden or replaced with a higher intensity according to the preset second-level desensitization rules. Only the necessary field structure is retained while most of the sensitive information is masked, forming a set of fields that have been processed by the second level of desensitization. The field set is then combined to generate desensitized response data that is consistent with the original response data structure.

[0123] When the masking level is three, the three-level desensitization template is selected, and the target fields in the interface response are subjected to the highest level of desensitization processing in sequence. All sensitive information is processed by completely hiding, symbol replacement or fixed format masking, and only the basic structural identifier of the field is retained. No recognizable original content is retained, forming a set of fields after three-level desensitization processing. The field set is then combined to generate the final desensitized response data.

[0124] In this embodiment, the step of performing transparent encryption on the target field in the persistent write path and transparent decryption in the read path based on the encryption flag to obtain the encryption state specifically includes:

[0125] Call the encryption flag. When the encryption flag is one, perform transparent encryption on the target field in the persistent write path. When the encryption flag is zero, write the original field data directly.

[0126] When performing transparent encryption, a key derivation parameter set is formed by combining the user's unique identifier, resource code, and target field identifier. The parameter set is then submitted to the key management system, which calls the preset key derivation function to generate the corresponding field-level key.

[0127] When performing transparent encryption, the target field data is processed using a preset symmetric encryption algorithm with the field-level key as the encryption parameter. The target field data is then used as the input plaintext for encryption to generate the corresponding ciphertext field data.

[0128] In the database persistent write path, the encrypted field data is stored to replace the original field data, while maintaining the data structure consistent with the original table structure;

[0129] During the reading process, the fields are transparently decrypted based on the encryption flags. The corresponding field-level key is called to execute the decryption function, obtain the decrypted field data, replace the ciphertext field data with the decrypted field data, and return it to the upper-layer application to generate an encrypted state.

[0130] In this embodiment, the generation of structured de-identification audit entries based on session information, mask level, comprehensive outlier factor score, de-identification response data, and encryption status to obtain audit records specifically includes:

[0131] The log input parameter set is obtained by retrieving session information, mask level, comprehensive outlier factor score, desensitization response data, and encryption status.

[0132] Based on the set of log input parameters, the session information is parsed to extract the user's unique identifier, resource code, and context attribute vector, which are then combined with the mask level and encryption status to form session protection attribute entries.

[0133] The desensitized response data is correlated with the comprehensive outlier factor score to establish response audit entries. These response audit entries are used to characterize the one-to-one correspondence between the interface returned data and the dynamic risk assessment results.

[0134] In log processing, session protection attribute entries and response audit entries are recorded uniformly according to a preset structured format to generate complete audit entries. The audit entries include user unique identifier, resource code, context attribute vector, mask level, encryption status, comprehensive outlier factor score, and desensitized response data. The audit entries are then written to the log database to generate audit records.

[0135] Example 1:

[0136] To verify the feasibility of this invention in practice, it was applied to a sensitive data access and log auditing scenario in an enterprise information management system. This system includes multiple modules such as user management, procurement approval, contract management, and supplier information, involving numerous sensitive fields, including ID card numbers, mobile phone numbers, and bank accounts. It also supports cross-regional concurrent access from subordinate units across multiple business areas.

[0137] In its traditional design, the system uses the RBAC model for access control. However, when the system expanded to over 2000 users and was deployed in parallel across 30+ regions, the number of role configurations reached hundreds, resulting in redundant authorization rules, high configuration difficulty, and frequent instances of users accessing content beyond their authorized scope. Furthermore, the log system's recorded fields were not anonymized, and the database only used communication encryption, posing a risk of information leakage and audit failure. A routine inspection revealed that nearly 8% of access operations failed to restrict access to sensitive fields according to permissions, and the logs contained plaintext information such as complete ID cards and bank account numbers, severely impacting compliance.

[0138] After deploying this invention into the system, access control is jointly executed by RBAC and ABAC. By extracting user attributes (job title, region, access terminal) and access context (time, location, device type), the system can achieve dynamic access control for the same role in different contexts. For example, when a user accesses the contract information module using a personal device outside of office hours, the system will mark this as low-trust behavior and deny access requests to sensitive fields. In actual testing, the number of permission configurations was reduced by approximately 42%, and the workload of role permission reconstruction was reduced by more than half.

[0139] During the risk assessment process, the system constructs a weighted feature vector for each access request and calls an improved LOF model to evaluate the degree of anomaly. Based on field risk levels (e.g., "ID number" is 1.0, "recipient's name" is 0.6) and user behavior characteristics (nighttime access, cross-regional access), the system generates density estimation scores for multiple pathways and merges them into a comprehensive outlier factor score. For example, a request initiated at 2:14 AM from area A to access and read contract and payment account information across regions has a comprehensive score of 0.87, exceeding the high-risk threshold of 0.8. It is marked as mask level 3 and encryption flag 1, automatically performing three levels of field desensitization, database field encryption, and generating a complete audit record.

[0140] Within two months of its actual deployment, this invention processed a total of 184,236 access requests, of which:

[0141] The number of requests that triggered the score calculation was 58,972.

[0142] 9,436 requests were identified as "high-risk behavior" and subjected to de-identification / encryption / auditing.

[0143] Compared with the original system, the integrity of audit records was improved by 34%, and the plaintext leakage rate of sensitive fields was reduced to below 0.1%.

[0144] Multi-region permission misconfiguration events were reduced by 78%, and the overall system access response time was kept within 0.4 seconds, maintaining good business performance.

[0145] As can be seen from the above practical application examples, this invention not only improves the system's permission flexibility and access risk identification capabilities in complex environments, but also achieves dynamic desensitization and transparent encryption linkage at the field level, and significantly enhances the availability and security of log auditing.

[0146] Table 1. Access Request Scenarios, Risk Scoring, and Policy Response Results

[0147] ;

[0148] As can be seen from the table above, this invention demonstrates significant advantages in implementing linked field protection strategies across multiple contexts, particularly in its ability to dynamically identify and protect against abnormal access requests, outperforming traditional security mechanisms based on fixed rules or static field configurations. Firstly, regarding access request identification, the system processed 184,236 access requests, of which 58,972 triggered risk scoring based on the improved LOF model, indicating that the system has the ability to trigger assessments on demand and reduce redundant computation. In the scoring results, 9,436 requests were identified as high-risk behaviors, accurately triggering masking, encryption, and auditing processes, with a trigger rate of approximately 16.0%. This reflects the system's strong ability to identify potential abnormal behaviors and the absence of significant misjudgment generalization.

[0149] Secondly, regarding the accuracy of field protection, this invention constructs a weighted feature vector by combining field risk level and user behavior characteristics, and introduces a contextual path for density estimation, making the comprehensive outlier factor score more consistent with actual security needs. For example, the second and fourth access requests were both remote access to sensitive fields outside of office hours, with system scores of 0.81 and 0.88 respectively, both accurately triggering the three-level desensitization and transparent encryption linkage strategy and generating audit records. In contrast, the score of the third normal access request was only 0.13, without triggering any intervention, demonstrating the model's good separation between high-risk identification and normal request access.

[0150] Regarding de-identification and encryption processing, the system implements a multi-level dynamic strategy selection mechanism. For scenarios with scores in the middle threshold range (such as the first request with a score of 0.22), only level one de-identification processing is triggered, avoiding excessive interference with the displayed business content. For requests with scores higher than 0.8, the system automatically triggers interface response de-identification, database field encryption, and log auditing, ensuring end-to-end security control of data during transmission, storage, and recording. Furthermore, the table data shows that at the log auditing layer, the system can accurately associate user identifiers, access contexts, score values, and field processing statuses to form traceable and structured audit entries, improving the legal usability and compliance of logs.

[0151] In summary, the dynamic field protection system constructed by this invention through the improved LOF model and the RBAC+ABAC permission fusion mechanism outperforms traditional rule systems in terms of anomaly identification accuracy, response strategy flexibility, and log auditability, demonstrating its practical value in highly data-sensitive industries such as government affairs and finance.

[0152] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A system security and data protection mechanism, characterized in that, Includes the following steps: Receive user access requests, complete identity authentication, extract user identifier, resource identifier and context information, and perform permission verification based on the RBAC and ABAC fusion mechanism to obtain session information; Based on the session information, query the field sensitivity level table, generate a field risk weight vector, and combine it with access behavior features to obtain a weighted feature vector; The improved LOF model is invoked, and outlier calculation and path weighted fusion are performed on the weighted feature vector based on session information and field risk weight vector to obtain a comprehensive outlier factor score. The field protection action is determined based on the comprehensive outlier factor score and threshold mapping table, and the mask level and encryption flag are obtained. Based on the mask level, perform template-based de-identification on the target fields in the interface response to obtain de-identified response data; Based on the encryption flag, the target field is transparently encrypted in the persistent write path and transparently decrypted in the read path to obtain the encrypted state; Based on session information, mask level, comprehensive outlier factor score, de-identification response data, and encryption status, structured de-identification audit entries are generated to obtain audit records.

2. The system security and data protection mechanism method according to claim 1, characterized in that, The process of receiving user access requests, completing identity authentication, extracting user identifiers, resource identifiers, and context information, and performing permission verification based on a fusion mechanism of RBAC and ABAC to obtain session information specifically includes: Receive user access requests, parse the user identifier request field, target resource identifier request field, and environment context field set to obtain the raw request data; The system performs an authentication operation on the user identifier request field, compares and verifies the user identifier with the authentication server, generates a corresponding unique user identifier when the authentication result is successful, and outputs a failure flag and terminates the access request processing flow when the authentication result is unsuccessful. The environment context field set is standardized to form an access context attribute vector, and the target resource identifier request field is parsed to generate resource code; The role-based access control mechanism is invoked, and the user's unique identifier and resource code are used as input parameters for matching and retrieval to obtain the RBAC decision result. Invoke the attribute-based access control mechanism, taking the context attribute vector, user unique identifier and resource code as input, set the attribute judgment predicate and perform calculation to generate ABAC judgment result; The system checks the status of the RBAC and ABAC judgment results. Only when both are in a pass state is the permission verification result generated as pass state; otherwise, the permission verification result generated as fail state is generated. When the permission verification result is passed, the user's unique identifier, resource code, and context attribute vector are combined to generate complete session information. When the permission verification result is failed, an access denial flag is output and the access request processing flow is terminated immediately.

3. The system security and data protection mechanism method according to claim 1, characterized in that, The step of querying the field sensitivity level table based on session information, generating a field risk weight vector, and combining it with access behavior features to obtain a weighted feature vector specifically includes: Extract the user's unique identifier, resource code, and target field content from the access context information sequentially from the session information to form a target field set; Retrieve each field in the target field set from the preset field sensitivity level table, and assign a risk weight value to the field according to the sensitivity level label corresponding to the field to form a field risk weight vector; Expand the access context information in the session information to form an access behavior feature set; The field risk weight vector and the access behavior feature set are combined and concatenated in a predetermined order to generate a weighted feature vector.

4. The system security and data protection mechanism method according to claim 1, characterized in that, The aforementioned invocation of the improved LOF model, based on session information and field risk weight vectors, calculates outlier degree and performs path-weighted fusion on the weighted feature vector to obtain a comprehensive outlier factor score, specifically including: An improved LOF model is invoked. This improved LOF model constructs a weighted Euclidean distance function based on the field risk weight vector. The difference in sensitivity level of different fields affects the distance calculation result, and a weighted distance result is obtained. In the improved LOF model, multiple density estimation paths are dynamically selected based on the context attribute vector, and the local reachability density is calculated based on the weighted distance results to obtain the local reachability density results of the paths. In the improved LOF model, the local reachability density of the pathway is used as input, and the outlier factor score of the pathway is calculated for the current weighted feature vector to generate the pathway outlier factor score result. In the improved LOF model, the outlier factor scores of multiple pathways are weighted and fused, and the pathway weight coefficients determined by the context attribute vector are used to obtain the comprehensive outlier factor score.

5. The system security and data protection mechanism method according to claim 4, characterized in that, In the improved LOF model, multiple density estimation paths are dynamically selected based on the context attribute vector, and the local reachability density is calculated based on the weighted distance results. The specific results of the local reachability density of the paths include: The context attribute vector in the session information is parsed to establish a set of context paths. For each context path, the corresponding neighborhood size parameter, time window parameter and regional constraint identifier are determined to generate a path parameter set. For each context path, in the improved LOF model, a path neighborhood set is formed centered on the weighted feature vector and based on the weighted distance result and the path parameter set; Select sample points in the neighborhood set of the pathway as reference points, calculate the distance between the reference point and the k-th nearest neighbor point, and obtain the k-th nearest distance result of the pathway; Based on the path k proximity results, the path reachability distance is defined, and the path reachability distance results corresponding to all reference points in the path are obtained. Based on the path reachability distance results, all samples in the path neighborhood set are traversed and calculated to generate the path local reachability density results.

6. The system security and data protection mechanism method according to claim 1, characterized in that, The process of determining field protection actions based on the comprehensive outlier factor score and threshold mapping table, and obtaining the mask level and encryption flag, specifically includes: The comprehensive outlier factor score is called and the preset threshold mapping table is read. When the comprehensive outlier factor score is less than the first threshold in the threshold mapping table, the mask level is set to zero, the encryption flag is set to zero, and a processing result without any field protection action is generated. When the comprehensive outlier factor score is greater than or equal to the first threshold in the threshold mapping table and less than the second threshold, the mask level is determined to be one, the encryption flag is zero, and the interface layer generates a field protection action to desensitize the target field. When the comprehensive outlier factor score is greater than or equal to the second threshold in the threshold mapping table and less than the third threshold, the mask level is determined to be two, the encryption flag is one, and the combined field protection result is generated. When the comprehensive outlier factor score is greater than or equal to the third threshold in the threshold mapping table, the mask level is set to three, the encryption flag is set to one, and the joint field protection processing result is generated.

7. The system security and data protection mechanism method according to claim 1, characterized in that, Based on the mask level, template-based de-identification is performed on the target fields in the interface response, resulting in de-identified response data, which specifically includes: Invoke the mask level and select the corresponding field masking template from the field masking template set according to the mask level. When the mask level is zero, select an empty template and generate masked response data that is consistent with the original field data. When the mask level is one, select the level one de-identification template, generate the field set after level one de-identification processing, and combine them to form de-identified response data; When the mask level is two, select the level two masking template to form a set of fields that have undergone level two masking processing, and combine them to generate masked response data; When the mask level is three, select the three-level masking template to form a set of fields after three-level masking processing, and combine them to generate masked response data.

8. The system security and data protection mechanism method according to claim 1, characterized in that, The process of performing transparent encryption on the target field in the persistent write path and transparent decryption in the read path based on the encryption flag to obtain the encryption state specifically includes: Call the encryption flag. When the encryption flag is one, perform transparent encryption on the target field in the persistent write path. When the encryption flag is zero, write the original field data directly. When performing transparent encryption, a key derivation parameter set is formed by combining the user's unique identifier, resource code, and target field identifier, and submitted to the key management system to generate the corresponding field-level key; Using the field-level key as the encryption parameter, the target field data is encrypted as the input plaintext to generate ciphertext field data. The ciphertext field data is then stored in the database persistent write path to replace the original field data. Based on the encryption flag, the field is transparently decrypted, the corresponding field-level key is called to execute the decryption function, the decrypted field data is obtained, the decrypted field data is replaced with the ciphertext field data and returned to the upper layer application to generate an encrypted state.

9. The system security and data protection mechanism method according to claim 1, characterized in that, The structured de-identification audit entries generated based on session information, mask level, comprehensive outlier factor score, de-identification response data, and encryption status result in audit records that specifically include: Based on session information, mask level, comprehensive outlier factor score, desensitization response data, and encryption status, the set of log input parameters is obtained; Based on the set of log input parameters, the session information is parsed to form session protection attribute entries; The desensitized response data is correlated with the comprehensive outlier factor score to establish response audit items; In log processing, session protection attribute entries and response audit entries are recorded in a unified manner according to a preset structured format to generate complete audit entries, which are then written to the log database to generate audit records.

Images