Method, system, device and medium for dynamic security management of shared data

Abstract

The application discloses a shared data dynamic security management method, system, device and medium, and relates to the technical field of shared data management; the method comprises the following steps: step one, constructing a data cloud sea and performing domain storage; step two, when login is successful through an account verification mode, performing login authentication, and if the login authentication fails, generating a warning record; step three, after the login authentication, performing action authentication, and if the action authentication fails, generating a warning record; step four, summarizing all the warning records, performing warning analysis to obtain a warning correction coefficient, and updating the warning correction coefficient to step two; and step five, if the account needs to access data across domains, selecting a transition account from the corresponding data domain, generating an access link of the account by using the transition account, and performing cross-domain access according to the access link; the application constructs an end-to-end shared data dynamic security system, and realizes full-process coverage from data storage, access authentication to action monitoring.

Description

Technical Field

[0001] This invention relates to the field of shared data management technology, specifically to methods, systems, devices, and media for dynamic security management of shared data. Background Technology

[0002] Shared data refers to data that is authorized and used in a planned manner within an organization or between different organizations, systems, or individuals. Its core lies in breaking down data silos, transforming data from an asset used only by a single entity into a resource that can be jointly utilized by multiple parties under compliant conditions, thereby releasing greater value than when it exists alone. However, a secure data environment is the foundation for the development of the digital economy. Only by ensuring the security of data during its flow and sharing can the advantages of shared data be fully realized. Therefore, the security of shared data is of paramount importance.

[0003] Currently, when sharing data, de-identification is usually used to process the data, and then account verification methods (including passwords, fingerprints, facial recognition, etc.) are used to control whether the data is shared. This method of security control lacks flexibility and protection, and is easily attacked and impersonated, which makes the shared data have a great risk of leakage. Summary of the Invention

[0004] This invention provides a method, system, device, and medium for dynamic security management of shared data, which are used to solve the above-mentioned technical problems.

[0005] The first aspect of this invention provides a method for dynamic security management of shared data, comprising the following steps:

[0006] Step 1: Partition and store all data according to the pre-divided data domains to build a data cloud. Correspondingly, bind all user accounts to the corresponding data domains according to their work fields. Divide the data in each data domain into the smallest unit to form several data units, and identify the sensitivity of the data units to identify sensitive data.

[0007] Step 2: When the user successfully logs in via account verification, the login record for this login is collected and compared with historical login records to output the login authentication result. The login authentication result is corrected using a warning correction coefficient, and account permissions are controlled based on the corrected result. If the login authentication fails, a warning record is generated and sent to Step 4.

[0008] Step 3: After successful login authentication, the actions performed by the account are monitored in real time and compared with historical login actions to output the action authentication result. Based on the action authentication result, account permissions are controlled. If the action authentication fails, an alert record is generated and sent to Step 4.

[0009] Step 4: Summarize all warning records, analyze the warnings to obtain the warning correction coefficient, and update it to Step 2;

[0010] Step 5: If an account needs to access data across domains, a transition account is selected from the corresponding data domain. The transition account is used to generate an access link for the account, and cross-domain access is performed based on the access link.

[0011] Optional, login authentication is:

[0012] Retrieve the account's historical login records, including the number of logins, the login time, IP address, geographical location, and all actions performed for each login.

[0013] Retrieve the login record for this login, which includes login time, IP address, and geographical location; calculate the shortest distance by comparing the geographical location of this login with the geographical location of the most recent historical login; calculate the shortest interval by comparing the login time of this login with the login time of the most recent historical login; divide the shortest distance by the shortest interval to get the roaming speed; if the roaming speed is greater than or equal to the preset roaming speed, the login authentication fails, the account is forced offline, and a warning record is generated.

[0014] If the roaming speed is less than the preset roaming threshold, the login record of this login will be compared and analyzed with the historical login record to output the login authentication result, which is the habit index. Each account is preset to have a warning correction coefficient. The authentication index is obtained by dividing the habit index by the warning correction coefficient.

[0015] There is a preset authentication range. If the authentication index is greater than the maximum value in the authentication range, there is no need to restrict its permissions and the account is allowed to access the data in its corresponding data domain. If the authentication index is within the authentication range, it is restricted from accessing sensitive data in the data domain. If the authentication index is less than the minimum value in the authentication range, the login authentication fails, the account is forced offline, and a warning record is generated.

[0016] Optional, the process for outputting login authentication results:

[0017] 3-1. Extract all login times from historical login records, and parse them by weekday and time period to construct a login time set;

[0018] 3-2. Extract all IP addresses involved in the historical login records and remove duplicates to obtain a set of unique IP addresses. Count the number of historical logins according to their corresponding IP addresses and add them to each IP address in the IP address set. This gives the historical login count for each IP address in the IP address set. Then, divide the historical login count for each IP address in the IP address set by the number of historical logins to obtain the IP probability for each IP address in the IP address set.

[0019] 3-3. Extract all geographical locations from the historical login records and remove duplicates to obtain a set of unique geographical locations. Count the number of historical logins according to their corresponding geographical locations and add them to each geographical location in the set. Then divide the historical login count corresponding to each geographical location in the set by the number of historical logins to obtain the location probability of each geographical location in the set.

[0020] 3-4. The login time, IP address, and geographical location are compared with the login time set, IP address set, and geographical location set, respectively, to obtain the login probability, IP probability, and location probability corresponding to this login. The habit index of this login is then calculated by linear weighting.

[0021] Optional, login probability output process:

[0022] The historical login counts are then counted according to their corresponding login times and assigned to the corresponding week. Each day is then divided into several time periods, and the historical login counts for each week are assigned to each time period, thus constructing a login time set. All historical login counts belonging to Monday are then counted to their corresponding time periods, yielding the historical login counts for each week and for each time period. The first-order probability is obtained by dividing the weekly historical login count by the total number of logins. The second-order probability is obtained by dividing the historical login count for each time period by the historical login count for the week it belongs to. Finally, the login probability for each time period within each week is multiplied by the first-order probability for the week it belongs to.

[0023] Optional, the process for outputting action authentication results:

[0024] 5-1. Extract the actions of each login from the historical login records, sort them according to the action time, remove duplicates from all actions, count the number of times each action is performed, and use it as a superscript; thus, the historical action series of each login can be obtained.

[0025] 5-2. Obtain the actions taken by the account from login to the current time, and perform the same deduplication and statistical processing to obtain the action series for each login. Compare the action series with the historical action series. If there is a historical action series that completely includes the action series of this login, no other measures are needed, and the account's actions can be continuously monitored. Otherwise, calculate the correlation between the action series of this login and the historical action series.

[0026] 5-3. There is a preset correlation range. If the correlation is less than the minimum value in the correlation range, the action authentication will fail, the account will be taken offline, and a warning record will be generated. If the correlation is within the correlation range, the user will be restricted from accessing sensitive data in the data domain. If the correlation is greater than the maximum value in the correlation range, there is no need to restrict the user's permissions.

[0027] Optional, correlation calculation process:

[0028] The historical action series with the greatest overlap with the action series of this login is selected as the core series from the historical action series of the historical login records;

[0029] Intersecting and unioning actions are used as action attributes to identify each action in the central series. The number of actions identified as intersecting and unioning actions is counted separately. The frequency of each action identified as an intersecting action is extracted and summed to obtain the total number of intersections. The total number of intersections is then divided by the number of actions identified as intersecting actions to obtain the intersection frequency. Similarly, the frequency of each action identified as a unioning action is extracted and summed to obtain the total number of unions. The total number of unions is then divided by the number of actions identified as unioning actions to obtain the union frequency. The intersection frequency is then divided by the union frequency to obtain the intersection-union ratio. Finally, the intersection-union ratio is multiplied by the repetition degree between the central series and the current login action series to obtain the correlation degree.

[0030] Optional, selection of the central series:

[0031] Take any historical action series and perform intersection and union operations on it and the action series of this login to obtain the intersection actions and union actions between them. Count the number of intersection actions and union actions respectively, and divide the number of intersection actions by the number of union actions to obtain the repetition degree. From this, we can obtain the repetition degree between the action series of this login and all historical action series. Select the historical action series with the highest repetition degree as the central series of the action series of this login.

[0032] Optional, transition account output process:

[0033] 8-1. If an account needs to access data across domains, the numeric domain it crosses is taken as the target domain, and online accounts belonging to the target domain are selected as candidate accounts for this account.

[0034] 8-2. Select any candidate account, extract the historical login count and the result of each login, including offline processing, restricted access to sensitive data processing, and unrestricted processing. Count the number of times the login result is offline processing, restricted access to sensitive data processing, and unrestricted processing, and record them as offline result count, restricted result count, and unrestricted result count, respectively.

[0035] 8-3. Formulate the calculation of the number of offline results, the number of limited results, and the number of unlimited results to obtain the initial selection value of the candidate accounts. Sort all candidate accounts in ascending order of the initial selection value, and select the top m accounts as the re-selection accounts, where m is a positive integer.

[0036] 8-4. Extract the most recent warning correction coefficient for each selected account from the current time, and select the selected account with the smallest warning correction coefficient as the transition account for that account.

[0037] The second aspect of the present invention provides a shared data dynamic security management system, including: a data cloud database, an access control module, an action monitoring module, an update and iteration module, and a cross-domain access module, so that the shared data dynamic security management system performs the above-described shared data dynamic security management method;

[0038] The Data Cloud Repository is constructed by partitioning and storing all data according to pre-defined data domains. Correspondingly, all user accounts are bound to the corresponding data domains according to their work fields. The data in each data domain is divided into the smallest units to form several data units, and the sensitivity of the data units is identified to identify sensitive data.

[0039] The access control module is used to collect the user's login record when the login is successfully completed through account verification, and compare and analyze it with the historical login record to output the login authentication result. The login authentication result is corrected using an early warning correction coefficient, and the account permissions are controlled based on the corrected result. If the login authentication fails, an early warning record is generated and sent to the update iteration module.

[0040] The action monitoring module is used to monitor the actions performed by the account in real time after successful login authentication, compare them with the actions of historical logins, output the action authentication result, and control account permissions based on the action authentication result; if the action authentication fails, an early warning record is generated and sent to the update iteration module simultaneously.

[0041] The update and iteration module is used to summarize all warning records, analyze the warnings to obtain the warning correction coefficients, and update them to the access control module.

[0042] The cross-domain access module is used to select a transitional account from the corresponding data domain when an account needs to access data across domains, generate an access link for the account using the transitional account, and perform cross-domain access based on the access link.

[0043] A third aspect of the present invention provides an electronic device including a processor, a storage medium, and a computer program, wherein the computer program is stored in the storage medium and, when executed by the processor, implements the above-described dynamic security management method for shared data.

[0044] A fourth aspect of the present invention provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the above-described dynamic security management method for shared data.

[0045] The beneficial effects of the technical solution provided by this invention compared with the prior art are as follows:

[0046] 1. By collecting current login data during user login and combining it with multi-dimensional features such as login time, IP address, and geographical location to perform probability modeling, we obtain login probability, location probability, and IP probability. We then comprehensively analyze these to obtain a habit index, which is further corrected by a warning correction coefficient to obtain an authentication index. This can accurately identify the degree of consistency between account usage behavior and historical habits. Implementing differentiated access control based on the authentication index can effectively enhance account security and effectively resist threats such as session hijacking, credential abuse, and account sharing.

[0047] 2. By introducing real-time monitoring and historical action comparison mechanisms on the basis of user login permission control, a real-time detection and control capability is formed; a historical action series is established, and the degree of consistency between the current action series and historical habits is judged accordingly. If there is a significant deviation, access is immediately restricted or the user is forced offline. This can effectively identify data leakage or abnormal operation behaviors that attempt to be implemented after bypassing the entry defense through legitimate login, providing a third line of defense for data security and improving the overall anti-attack capability and the ability to perceive internal risks.

[0048] 3. By summarizing and analyzing all early warning events and modeling time decay, early warning correction coefficients are generated. The time decay mechanism ensures that recent early warnings have a greater impact on the results, while the impact of older early warnings gradually weakens. This makes account risk assessment more consistent with the actual situation, realizes dynamic characterization of the overall account risk level, and ensures that access control strategies can adaptively adjust with changes in account behavior patterns.

[0049] 4. By introducing a transition account as a proxy execution layer when an account user needs to access cross-domain data, the direct interaction between the account and the target domain data is avoided, fundamentally reducing the security risks brought about by cross-domain access. Based on the initial selection value calculation of the candidate accounts, a preliminary screening is performed to obtain the second-selection accounts, and then the one with the smallest warning correction coefficient is selected as the transition account. This ensures that the selected transition account is optimal in terms of security and trustworthiness, and forms a secure and reliable access link for the account, further protecting the security of shared data. Attached Figure Description

[0050] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. The following drawings are not deliberately drawn to scale according to the actual size, but are intended to show the main idea of ​​this application.

[0051] Figure 1 This is a block diagram illustrating the principle of the method of the present invention;

[0052] Figure 2 This is a schematic diagram of the module connection of the present invention. Detailed Implementation

[0053] This invention provides an energy dispatch management method, apparatus, device, and storage medium. The terms "first," "second," "third," "fourth," etc. (if present) in the specification, claims, and accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" or "having" and any variations thereof are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0054] Currently, data sharing typically involves de-identifying the data and then using account verification methods (including passwords, fingerprints, facial recognition, etc.) to control whether the data is shared. This method lacks flexibility and adequate protection, making it vulnerable to attacks and impersonation, resulting in a significant risk of data leakage. To address this technical problem, this invention adopts the following solution:

[0055] For ease of understanding, the specific process of the embodiments of the present invention is described below. Please refer to [link / reference]. Figure 1 In this embodiment of the invention, the shared data dynamic security management method includes the following steps:

[0056] Step one: Construct a data cloud by partitioning all data according to pre-defined data domains. For example, data domains include production data domain, process data domain, financial data domain, human resources data domain, and management data domain. Each domain stores production data, the process domain stores process data, the financial domain stores financial data, the human resources domain stores human resources data, and the management data domain stores management data. Correspondingly, bind all user accounts to their respective work areas and corresponding data domains, that is, bind user accounts and access permissions one-to-one.

[0057] For each data domain, a sensitive word library is set up, containing a large number of sensitive words, each with a corresponding sensitivity level. The sensitive words and sensitivity levels in the sensitive word library are set by those skilled in the art according to the company's needs. The data in the data domain is divided into the smallest units, forming several data units. Each data unit is compared with the sensitive word library to filter out the sensitive words and their corresponding sensitivity levels. The sensitivity levels of the sensitive words in each data unit are summed to calculate the sensitivity value of the data unit. A sensitivity threshold is preset. When the sensitivity value of a data unit is greater than or equal to the sensitivity threshold, the data unit is marked as sensitive data. This allows for the marking of data units in the data domain that belong to sensitive data.

[0058] By partitioning and storing data according to pre-defined data domains and constructing a data cloud, different types of data are isolated in relatively independent logical spaces, effectively reducing the risk of cross-contamination between data and the hidden danger of unauthorized access. At the same time, user accounts are bound to their respective domains for access permissions, achieving precise matching between users and data domains and reducing the possibility of users accessing irrelevant data domains. Through the setting of sensitive word libraries and the marking of sensitive units, granular-level security management of data is achieved, improving the precision and intelligence of security protection during data sharing and laying the foundation for subsequent dynamic security control.

[0059] Step two: When a user successfully logs in via account verification methods (including but not limited to password verification, fingerprint verification, facial recognition verification, and verification code verification), the user's login data for this login is collected and compared with historical login data to output a login confidence index. Based on this login confidence index, corresponding access control is implemented. Specifically:

[0060] Retrieve the account's historical login records, including the number of logins, the login time, IP address, geographical location, and all actions performed for each login (actions refer to data processing, including but not limited to importing, exporting, deleting, and modifying data). The login time includes the weekday and the specific time. Count the historical logins according to their corresponding login times to the corresponding weekday. Then divide the day into several time periods, and count the historical logins within each week into each time period to construct a login time set. For example, Monday is divided into 5 time periods: 8:00 to 12:00, 12:00 to 18:00, 18:00 to 20:00. 0. The time periods are divided according to the specific application scenario requirements, and are not limited to this. All historical logins belonging to Monday are counted into their respective time periods, thus obtaining the historical login count for each week and the historical login count for each time period. The historical login count for each week is divided by the number of historical logins to obtain the first-level probability. The historical login count for each time period is then divided by the historical login count for the week to obtain the second-level probability. The second-level probability for each time period in each week is multiplied by the first-level probability for the week to obtain the login probability for each time period.

[0061] Extract all IP addresses involved in the historical login records and remove duplicates to obtain a unique set of IP addresses. Count the number of historical logins according to their corresponding IP addresses and add them to each IP address in the IP address set. This gives the historical login count for each IP address in the IP address set. Then, divide the historical login count for each IP address in the IP address set by the number of historical logins to obtain the IP probability for each IP address in the IP address set.

[0062] Extract all geographical locations from the historical login records and remove duplicates to obtain a set of unique geographical locations. Count the number of historical logins according to their corresponding geographical locations and add them to each geographical location in the set. Then divide the historical login count corresponding to each geographical location in the set by the number of historical logins to obtain the location probability of each geographical location in the set.

[0063] Retrieve the login record for this login, which includes login time, IP address, and geographical location. Calculate the shortest distance between the geographical location of this login and the geographical location of the most recent historical login. Then, calculate the shortest interval by calculating the time difference between the login time of this login and the login time of the most recent historical login. Divide the shortest distance by the shortest interval to obtain the roaming speed. Set a roaming threshold. If the roaming speed is greater than or equal to the preset roaming speed, it indicates that the account user has engaged in unreasonable geographical roaming behavior (possible session theft, credential abuse, or multiple people sharing the account). In this case, the account will be forcibly logged out, and a warning record will be generated and sent to step four.

[0064] If the roaming speed is less than the preset roaming threshold, the login time, IP address, and geographical location are compared with the login time set, IP address set, and geographical location set, respectively, to obtain the login probability, IP probability, and location probability corresponding to this login. These probabilities are then linearly weighted to calculate the habit index for this login. It should be noted that the higher the login probability, IP probability, and location probability, the more consistent the login is with historical login habits, and the higher the corresponding habit index. Each account is preset to have a warning correction coefficient, which measures the degree of historical warnings for the account. The habit index is divided by the warning correction coefficient to obtain the authentication index. The warning correction coefficient is in the range of (1,2).

[0065] There is a preset authentication range, which can be set by those skilled in the art according to actual scenario requirements, and is usually set to [0.65, 0.85]. If the authentication index is greater than the maximum value in the authentication range, it means that this login is very close to historical habits and the risk is very small and can be ignored. In this case, there is no need to restrict its permissions and the account is allowed to access the data in its corresponding data domain. If the authentication index is within the authentication range, it restricts access to sensitive data in the data domain. If the authentication index is less than the minimum value in the authentication range, it means that this login has a relatively large security risk. In this case, the account is forced offline and an alert record is generated and sent to step four.

[0066] By collecting current login data during user login and combining it with multi-dimensional features such as login time, IP address, and geographical location to perform probabilistic modeling, the login probability, location probability, and IP probability are obtained. These are then comprehensively analyzed to obtain a habit index, which is further corrected with a warning correction coefficient to obtain an authentication index. This approach can accurately identify the degree of consistency between an account's usage behavior and historical habits. Implementing differentiated access control based on the authentication index can effectively enhance account security and effectively resist threats such as session hijacking, credential abuse, and account sharing.

[0067] Step three: After account login authentication, the actions performed on the data in the data domain are monitored in real time and compared with historical login actions to determine the security of account actions. This prevents account users from bypassing login verification and authentication and leaking data, achieving triple protection for shared data security; specifically:

[0068] Extract the actions from each login session in the historical login records, sort them chronologically by action time, remove duplicate actions, count the number of times each action is performed, and use this count as a superscript; this yields the historical action series for each login session, which is then labeled as follows. j = 1, 2, 3..., where j is a positive integer representing the index of any action, and n is a positive integer representing the number of times the action occurs. Specifically, if an account's login actions are T1, T2, T5, T1, T6, T2, T3, then its corresponding historical action series is represented as follows: ;

[0069] The system retrieves the account's actions from login until the current time, performs deduplication and statistical processing on these actions to obtain a series of actions for each login. This series is then compared to historical action series. If a historical action series completely encompasses the actions of this login, no further action is needed; continued monitoring of the account's actions is sufficient. Otherwise, the system calculates the maximum correlation between the current login's action series and historical action series.

[0070] Take any historical action series and perform intersection and union operations on it and the action series of this login respectively to obtain the intersection action and union action. The intersection action is the action that appears in both action series, and the union action is the action that appears at least once in both action series. Count the number of intersection action and union action respectively, and divide the number of intersection action by the number of union action to obtain the repetition rate. From this, we can obtain the repetition rate of the action series of this login with all historical action series. Select the historical action series with the highest repetition rate as the central series of the action series of this login.

[0071] Intersecting and unioning actions are used as action attributes to identify each action in the central series. The number of actions identified as intersecting and unioning actions is counted separately. The frequency n of each action identified as an intersecting action is extracted and summed to obtain the total number of intersections. The total number of intersections is then divided by the number of actions identified as intersecting actions to obtain the intersection frequency. Similarly, the frequency n of each action identified as a unioning action is extracted and summed to obtain the total number of unions. The total number of unions is then divided by the number of actions identified as unioning actions to obtain the union frequency. The intersection frequency is then divided by the union frequency to obtain the intersection-union ratio. Finally, the intersection-union ratio is multiplied by the repetition degree between the central series and the current login action series to obtain the correlation degree.

[0072] A pre-defined correlation range is established. The correlation score is compared with the pre-defined correlation range. If the correlation score is less than the minimum value in the correlation range, it indicates that the correlation between the current login action series and the actions in the historical login records is weak, posing a significant risk and not conforming to the account's historical action habits. In this case, the account is logged out, and an alert record is generated and simultaneously sent to step four. If the correlation score is within the correlation range, access to sensitive data in the data domain is restricted, i.e., sensitive data in the data domain is hidden. If the correlation score is greater than the maximum value in the correlation range, it indicates that the current login action series is strongly correlated with the actions in the historical login records, and no restrictions on the account's permissions are required.

[0073] By introducing real-time monitoring and historical action comparison mechanisms on top of user login permission control, a real-time detection and control capability is formed. A series of historical actions is established, and the degree of consistency between the current series of actions and historical habits is judged based on this. If there is a significant deviation, access is immediately restricted or the user is forced offline. This can effectively identify data leakage or abnormal operation behaviors that attempt to be carried out after bypassing the entry defense through legitimate login. It provides a third line of defense for data security and improves the overall anti-attack capability and the ability to perceive internal risks.

[0074] Step 4: Summarize all warning records. The warning records include the number of warnings and the corresponding warning time for each warning. Calculate the time interval by comparing the warning time with the current time, and record it as Δt. i i = 1, 2, 3..., where i is a positive integer and represents the index of any warning; according to the time decay formula w i =exp(-λ×Δt i The impact value corresponding to each warning is calculated, where λ is the decay number, controlling the rate at which a single warning decays over time. Its unit is the time interval Δt i Consistent; then sum the impact values ​​of each warning to obtain the total impact value, denoted as S. The total impact value is then mapped using the formula K = 1 + S / (S + k) to obtain the warning correction coefficient K, where k > 0, and k is a saturation constant. From the formula, it can be seen that the closer S is to 0, the milder the warning level of the account, and the closer the warning correction coefficient K is to 1; the larger S is, the higher the warning level of the account, and the closer the warning correction coefficient K is to 2. Furthermore, it monotonically increases with increasing S.

[0075] By summarizing and analyzing all early warning events and modeling time decay, early warning correction coefficients are generated. The time decay mechanism ensures that recent early warnings have a greater impact on the results, while the impact of older early warnings gradually weakens. This makes account risk assessment more consistent with the actual situation, enabling a dynamic characterization of the overall account risk level and ensuring that access control strategies can adaptively adjust as account behavior patterns change.

[0076] Step 5: If an account user needs to access data across domains, a transit account is selected from the corresponding data domain. This transit account is used to establish the access link, further ensuring the security of shared data. Specifically:

[0077] If an account user needs to access data across domains, and the numeric domain they cross is taken as the target domain, then an online account belonging to the target domain is selected and used as a candidate account for this account.

[0078] Select any candidate account, extract the historical login count and the result of each login, including offline processing, restricted access to sensitive data processing, and unrestricted processing. Count the number of times each login result was offline, restricted access to sensitive data processing, and unrestricted processing, and record them as offline result count M1, restricted access result count M2, and unrestricted access result count M3, respectively; according to the formula... Calculate the initial selection value of the candidate accounts, sort all candidate accounts in ascending order of the initial selection value, and select the top m accounts as the re-selection accounts, where m is a positive integer;

[0079] Extract the most recent warning correction coefficient of the selected accounts, and select the selected account with the smallest warning correction coefficient as the transition account for that account; generate a controlled proxy session for the selected transition account, send and bind the access request of the account to the transition account, forming an access link between the main account, the transition account and the target domain. Instead of directly accessing the target domain data, a controlled proxy session is established through the selected transition account. The main account's request is executed in the context of the transition account, and audit identifiers are injected throughout the process, and least privilege control is performed. The access results are isolated and de-identified before being sent back, ultimately forming a complete cross-domain access audit record.

[0080] By introducing a transitional account as a proxy execution layer when an account user needs to access cross-domain data, the direct interaction between the account and the target domain data is avoided, fundamentally reducing the security risks brought about by cross-domain access. Based on the initial selection value of the candidate accounts, a preliminary screening is performed to obtain a second-selection account, and then the one with the smallest warning correction coefficient is selected as the transitional account. This ensures that the selected transitional account is optimal in terms of security and trustworthiness, and forms a secure and reliable access link for the account, further protecting the security of shared data.

[0081] To enhance the real-time judgment capability and response accuracy of dynamic security management of shared data, this solution establishes a threshold standardization system based on multi-dimensional behavioral characteristics, with roaming judgment, login authentication, and action association as the core. This system takes core objectives, failure consequences, and design principles as the main line, and sets judgment criteria at three levels: geographical temporal consistency, login habit matching degree, and operation sequence similarity. It can quickly capture high-risk events such as session theft and credential abuse. The specific explanation is as follows: (1) Roaming threshold: It is used to identify unreasonable geographical displacement in a short period of time. The roaming threshold is obtained by combining physical and traffic realities (ground and air speed), enterprise risk tolerance, and historical login distribution statistics. (2) Authentication interval: It measures whether the current login conforms to the historical login habits of the account in order to achieve differentiated access control. It is determined by a person skilled in the art through multi-dimensional historical behavior baseline analysis. The results were obtained through multiple simulation experiments combining probability model calculation and dynamic risk correction; (3) Association interval: real-time comparison of the action sequence of this session with the account's historical action series to determine whether the operation is the account's normal behavior, thereby supplementing the judgment at the login level. It was obtained by those skilled in the art through multiple simulation experiments using a similarity algorithm based on sequence pattern matching and historical behavior consistency analysis; In summary, the three thresholds form a complementary and interconnected dynamic security criterion system: the roaming threshold prioritizes the identification of geographical anomalies, the authentication interval provides risk classification from the perspective of login habits and reflects the account's historical risk liabilities through early warning correction coefficients, and the association interval provides in-process detection and compensation from the perspective of execution actions. This system takes into account real-time performance, accuracy and robustness, and can provide multi-layered, adjustable and auditable protection measures for secure access to shared data in complex business and network environments.

[0082] Please see Figure 2 In this embodiment of the invention, based on the shared data dynamic security management method, a shared data dynamic security management system is provided, which includes:

[0083] The Data Cloud Repository is constructed by partitioning and storing all data according to pre-defined data domains. Correspondingly, all user accounts are bound to the corresponding data domains according to their work fields. The data in each data domain is divided into the smallest units to form several data units, and the sensitivity of the data units is identified to identify sensitive data.

[0084] The access control module is used to collect the user's login record when the login is successfully completed through account verification, and compare and analyze it with the historical login record to output the login authentication result. The login authentication result is corrected using an early warning correction coefficient, and the account permissions are controlled based on the corrected result. If the login authentication fails, an early warning record is generated and sent to the update iteration module.

[0085] The action monitoring module is used to monitor the actions performed by the account in real time after successful login authentication, compare them with the actions of historical logins, output the action authentication result, and control account permissions based on the action authentication result; if the action authentication fails, an early warning record is generated and sent to the update iteration module simultaneously.

[0086] The update and iteration module is used to summarize all warning records, analyze the warnings to obtain the warning correction coefficients, and update them to the access control module.

[0087] The cross-domain access module is used to select a transitional account from the corresponding data domain when an account needs to access data across domains, generate an access link for the account using the transitional account, and perform cross-domain access based on the access link.

[0088] The present invention also provides an electronic device, which includes a processor, a storage medium and a computer program, wherein the computer program is stored in the storage medium, and when the computer program is executed by the processor, it implements the above-described dynamic security management method for shared data.

[0089] The present invention also provides a computer-readable storage medium, which can be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium, wherein the computer-readable storage medium stores instructions that, when the instructions are executed on a computer, cause the computer to perform the steps of the shared data dynamic security management method.

[0090] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0091] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0092] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A shared data dynamic security management method, characterized in that: include: Step 1: Partition and store all data according to the pre-divided data domains to build a data cloud. Correspondingly, bind all user accounts to the corresponding data domains according to their work fields. Divide the data in each data domain into the smallest unit to form several data units, and identify the sensitivity of the data units to identify sensitive data. Step 2: When the user successfully logs in via account verification, the login record for this login is collected and compared with historical login records to output the login authentication result. The login authentication result is then corrected using a warning correction coefficient, and account permissions are controlled based on the corrected result. If login authentication fails, an alert record will be generated and sent synchronously to step four; Step 3: After successful login authentication, the actions performed by the account are monitored in real time and compared with historical login actions to output the action authentication result. Based on the action authentication result, account permissions are controlled. If the action authentication fails, an alert record is generated and sent to Step 4. Step 4: Summarize all warning records, analyze the warnings to obtain the warning correction coefficient, and update it to Step 2; Step 5: If an account needs to access data across domains, a transition account is selected from the corresponding data domain. The transition account is used to generate an access link for the account, and cross-domain access is performed based on the access link.

2. The shared data dynamic security management method according to claim 1, characterized in that, Login authentication is: Retrieve the account's historical login records, including the number of logins, the login time, IP address, geographical location, and all actions performed for each login. Retrieve the login record for this login, which includes login time, IP address, and geographical location; calculate the shortest distance by comparing the geographical location of this login with the geographical location of the most recent historical login; calculate the shortest interval by comparing the login time of this login with the login time of the most recent historical login; divide the shortest distance by the shortest interval to get the roaming speed; if the roaming speed is greater than or equal to the preset roaming speed, the login authentication fails, the account is forced offline, and a warning record is generated. If the roaming speed is less than the preset roaming threshold, the login record of this login will be compared and analyzed with the historical login records to output the login authentication result, which is the habit index. Each account is assigned a warning correction coefficient. The certification index is obtained by dividing the habit index by the warning correction coefficient. There is a preset authentication range. If the authentication index is greater than the maximum value in the authentication range, there is no need to restrict its permissions and the account is allowed to access the data in its corresponding data domain. If the authentication index is within the authentication range, it will restrict its access to sensitive data in the data domain. If the authentication index is less than the minimum value of the authentication range, the login authentication will fail, the account will be forced offline, and a warning record will be generated.

3. The shared data dynamic security management method according to claim 2, characterized in that, The process of outputting login authentication results: 3-1. Extract all login times from historical login records, and parse them by weekday and time period to construct a login time set; 3-2. Extract all IP addresses involved in the historical login records and remove duplicates to obtain a set of unique IP addresses. Count the number of historical logins according to their corresponding IP addresses and add them to each IP address in the IP address set. This gives the historical login count for each IP address in the IP address set. Then, divide the historical login count for each IP address in the IP address set by the number of historical logins to obtain the IP probability for each IP address in the IP address set. 3-3. Extract all geographical locations from the historical login records and remove duplicates to obtain a set of unique geographical locations. Count the number of historical logins according to their corresponding geographical locations and add them to each geographical location in the set. Then divide the historical login count corresponding to each geographical location in the set by the number of historical logins to obtain the location probability of each geographical location in the set. 3-4. The login time, IP address, and geographical location are compared with the login time set, IP address set, and geographical location set, respectively, to obtain the login probability, IP probability, and location probability corresponding to this login. The habit index of this login is then calculated by linear weighting.

4. The shared data dynamic security management method according to claim 3, characterized in that, Login probability output process: The historical login counts are then counted according to their corresponding login times and assigned to the corresponding week. Each day is then divided into several time periods, and the historical login counts for each week are assigned to each time period, thus constructing a login time set. All historical login counts belonging to Monday are then counted to their corresponding time periods, yielding the historical login counts for each week and for each time period. The first-order probability is obtained by dividing the weekly historical login count by the total number of logins. The second-order probability is obtained by dividing the historical login count for each time period by the historical login count for the week it belongs to. Finally, the login probability for each time period within each week is multiplied by the first-order probability for the week it belongs to.

5. The shared data dynamic security management method according to claim 1, characterized in that, The process of outputting action authentication results: 5-1. Extract the actions of each login from the historical login records, sort them according to the action time, remove duplicates from all actions, count the number of times each action is performed, and use it as a superscript; thus, the historical action series of each login can be obtained. 5-2. Obtain the actions taken by the account from login to the current time, and perform the same deduplication and statistical processing to obtain the action series for each login. Compare the action series with the historical action series. If there is a historical action series that completely includes the action series of this login, no other measures are needed, and the account's actions can be continuously monitored. Otherwise, calculate the correlation between the action series of this login and the historical action series. 5-3. There is a preset correlation range. If the correlation is less than the minimum value in the correlation range, the action authentication will fail, the account will be taken offline, and a warning record will be generated. If the correlation is within the correlation range, the user will be restricted from accessing sensitive data in the data domain. If the correlation is greater than the maximum value in the correlation range, there is no need to restrict the user's permissions.

6. The shared data dynamic security management method according to claim 5, characterized in that, The process of calculating correlation: The historical action series with the greatest overlap with the action series of this login is selected as the core series from the historical action series of the historical login records; Intersecting and unioning actions are used as action attributes to identify each action in the central series. The number of actions identified as intersecting and unioning actions is counted separately. The frequency of each action identified as an intersecting action is extracted and summed to obtain the total number of intersections. The total number of intersections is then divided by the number of actions identified as intersecting actions to obtain the intersection frequency. Similarly, the frequency of each action identified as a unioning action is extracted and summed to obtain the total number of unions. The total number of unions is then divided by the number of actions identified as unioning actions to obtain the union frequency. The intersection frequency is then divided by the union frequency to obtain the intersection-union ratio. Finally, the intersection-union ratio is multiplied by the repetition degree between the central series and the current login action series to obtain the correlation degree.

7. The shared data dynamic security management method according to claim 6, characterized in that, Selection of the central series: Take any historical action series and perform intersection and union operations on it and the action series of this login to obtain the intersection actions and union actions between them. Count the number of intersection actions and union actions respectively, and divide the number of intersection actions by the number of union actions to obtain the repetition degree. From this, we can obtain the repetition degree between the action series of this login and all historical action series. Select the historical action series with the highest repetition degree as the central series of the action series of this login.

8. The shared data dynamic security management method according to claim 1, characterized in that, Transition account output process: 8-1. If an account needs to access data across domains, the numeric domain it crosses is taken as the target domain, and online accounts belonging to the target domain are selected as candidate accounts for this account. 8-2. Select any candidate account, extract the historical login count and the result of each login, including offline processing, restricted access to sensitive data processing, and unrestricted processing. Count the number of times the login result is offline processing, restricted access to sensitive data processing, and unrestricted processing, and record them as offline result count, restricted result count, and unrestricted result count, respectively. 8-3. Formulate the calculation of the number of offline results, the number of limited results, and the number of unlimited results to obtain the initial selection value of the candidate accounts. Sort all candidate accounts in ascending order of the initial selection value, and select the top m accounts as the re-selection accounts, where m is a positive integer. 8-4. Extract the most recent warning correction coefficient for each selected account from the current time, and select the selected account with the smallest warning correction coefficient as the transition account for that account.

9. A shared data dynamic security management system, characterized in that, The system, applied to the shared data dynamic security management method as described in any one of claims 1-8, comprises: The Data Cloud Repository is constructed by partitioning and storing all data according to pre-defined data domains. Correspondingly, all user accounts are bound to the corresponding data domains according to their work fields. The data in each data domain is divided into the smallest unit to form several data units, and the sensitivity of the data units is identified to identify sensitive data. The access control module is used to collect the user's login record when the login is successfully completed through account verification, and compare and analyze it with the historical login record to output the login authentication result. The login authentication result is corrected using an early warning correction coefficient, and the account permissions are controlled based on the corrected result. If the login authentication fails, an early warning record is generated and sent to the update iteration module. The action monitoring module is used to monitor the actions performed by the account in real time after successful login authentication, compare them with the actions of historical logins, output the action authentication result, and control account permissions based on the action authentication result; if the action authentication fails, an early warning record is generated and sent to the update iteration module simultaneously. The update and iteration module is used to summarize all warning records, analyze the warnings to obtain the warning correction coefficients, and update them to the access control module. The cross-domain access module is used to select a transitional account from the corresponding data domain when an account needs to access data across domains, generate an access link for the account using the transitional account, and perform cross-domain access based on the access link.

10. An electronic device comprising a processor, a storage medium, and a computer program, wherein the computer program is stored in the storage medium, characterized in that... When the computer program is executed by the processor, it implements the shared data dynamic security management method according to any one of claims 1 to 8.

11. A computer-readable storage medium storing instructions thereon, characterized in that, When the instruction is executed by the processor, it implements the shared data dynamic security management method as described in any one of claims 1-8.

Images