Big data security access control method

Abstract

The invention discloses a big data security access control method. The method comprises the following steps: collecting multi-dimensional information of an access request, including time, place, equipment, network environment and historical behaviors, and generating a risk score in combination with a weight; and converting the risk score into a risk probability by using a probability mapping model, and dividing risk levels according to a preset threshold. And the system forms a dynamically adjustable permission set according to the basic permission of the user role and the limit permission corresponding to the risk level, and calculates a security strength index. And further combining the risk score with the security strength to generate a comprehensive risk coefficient and recording the comprehensive risk coefficient in an audit log. And when the risk coefficient exceeds a threshold value and exceeds the limit continuously for multiple times, triggering a security response mechanism, including account freezing, session blocking, alarm pushing and global strategy tightening. According to the method, real-time evaluation, fine-grained control and linkage response of big data access are realized, and the dynamic defense capability and the overall security of the system are improved.

Description

Technical Field

[0001] This invention relates to the field of big data management technology, and more specifically, to a method for secure access control of big data. Background Technology

[0002] With the rapid development of big data technology in finance, healthcare, e-commerce, government affairs, and other fields, data has become a key factor of production. The efficient sharing and mining of massive amounts of data has brought enormous economic and social value to various industries; however, at the same time, data security issues are becoming increasingly prominent. Especially in complex environments with multiple users, roles, and terminals, ensuring the legality and compliance of data access has become a core problem that big data platforms urgently need to solve.

[0003] Existing access control technologies mainly fall into three categories: Discretionary Access Control (DAC), Mandatory Access Control (MAC), and Role-Based Access Control (RBAC). DAC relies on data owners to set permissions themselves, offering high flexibility but lacking global consistency, which can easily lead to fragmented permissions and security vulnerabilities. MAC mandates unified permission allocation by the system, providing high security, but its coarse-grained nature makes it difficult to adapt to flexible business changes. RBAC achieves unified management through the binding of roles and permissions, making it the most widely used, but it faces the following shortcomings in big data environments:

[0004] First, existing methods are mostly static authorization, lacking real-time awareness of access context. For example, access requests initiated by users outside of working hours, in different locations, or on abnormal devices often cannot be dynamically identified and blocked, leading to potential unauthorized or unauthorized access.

[0005] Second, access control lacks granularity. Big data environments contain complex data types, including structured data as well as unstructured text, images, logs, etc. Traditional control methods can usually only operate at the table or database level, making it difficult to achieve fine-grained control at the field, record, or even content feature level, thus increasing the risk of sensitive data leakage.

[0006] Third, there is a lack of risk-driven mechanisms. Existing controls are mostly based on predefined static policies, which cannot combine user behavior profiles, network environment characteristics, historical access patterns, etc., to conduct real-time risk assessments. As a result, the system cannot detect high-risk requests in time when they occur, thus creating the risk of internal personnel abusing their privileges and attackers posing as legitimate individuals to bypass controls.

[0007] Furthermore, existing auditing mechanisms generally suffer from a tendency to focus on post-event accountability rather than real-time intervention. While log records can be used for compliance checks and security tracing, they often lack a correlation between quantitative risk indicators and protection strength, making it difficult to support dynamic decision-making.

[0008] In summary, existing technologies suffer from insufficient dynamism, inadequate granularity, and a lack of risk perception and real-time intervention when facing complex and ever-changing access scenarios on big data platforms, thus failing to effectively meet the needs of high-security scenarios.

[0009] Therefore, there is an urgent need for a big data security access control method to solve these problems. Summary of the Invention

[0010] The purpose of this invention is to solve the technical problems mentioned in the background section and to provide a big data security access control method, comprising the following steps:

[0011] S1. Upon receiving an access request, collect the context information of the accessing subject and construct an access feature vector F. The vector consists of a time factor f1, a location factor f2, a device factor f3, a network factor f4, and a historical behavior factor f5. Assign a corresponding weight parameter wi to each factor so that different dimensions have differentiated contributions to the overall risk assessment.

[0012] S2. Based on the feature vector F and weight parameter wi, the access request is risk-measured to generate a risk score R, and a correspondence is established between the R score and the request identifier and the time t when the request is generated, so as to facilitate subsequent tracking and auditing.

[0013] S3. Input the risk score R into the probability mapping model, and combine it with the model parameters α and β to obtain the risk probability P, which is used to measure the probability that the access request is statistically a high-risk behavior.

[0014] S4. Based on the risk probability P and the system's preset thresholds θ1, θ2, and θ3, the request is divided into risk levels L, which include at least four levels: low risk, medium risk, relatively high risk, and high risk.

[0015] S5. Combining the user role U and risk level L of the accessing entity, retrieve the basic permission set A corresponding to each role. base (U) The set of restrictions corresponding to the risk level A limit (L), a dynamic permission set A is obtained through permission trimming, and the set will gradually tighten as the risk level increases;

[0016] S6. Calculate the security strength index S based on the size of the dynamic permission set A and the proportional adjustment parameter λ. This index is used to characterize the degree of control of user access by the system under the current risk environment.

[0017] S7. Combine the risk score R with the safety intensity index S to form a risk coefficient Q, and then combine Q with R and S to form a triplet.<R,S,Q> This coefficient reflects the actual level of danger of a request under access restrictions;

[0018] S8. Write the triplet and related parameters to the audit log. When the risk coefficient Q reaches or exceeds the threshold Q... max Furthermore, if the number of occurrences exceeds the threshold T consecutively within the sliding time window, the system triggers a security response mechanism, including freezing the account or session, sending an alarm notification, and tightening and adjusting the global access policy.

[0019] As a preferred technical solution of the present invention, the components of the access feature vector F have the following functions: the time factor f1 is used to determine whether the access occurs in an abnormal time period; the location factor f2 is used to compare whether the geographical location matches the user's commonly used area; the device factor f3 is used to identify whether the terminal device is trustworthy or registered; the network factor f4 is used to determine whether the access comes from a public network, intranet, or virtual private network environment; and the historical behavior factor f5 is used to characterize the user's past access patterns and operating habits in order to detect abnormal deviations.

[0020] As a preferred technical solution of the present invention, the risk score R is obtained by analyzing each factor f of the access feature vector F. i According to the weight parameter w i Obtained through weighted summation, it reflects the overall risk level of the current request; the weight parameter w. i It can be configured based on industry security standards, historical data analysis results, or machine learning model training results, and can be dynamically adjusted during operation.

[0021] As a preferred technical solution of the present invention, the risk probability P is obtained by transforming the risk score R through a probability mapping model combined with parameters α and β. The value range of the risk probability P is between 0 and 1. The closer it is to 1, the more risky the request is. Parameter α is used to control the risk sensitivity, and parameter β is used to calibrate the overall probability distribution so that the model can adapt to the risk distribution characteristics under different business scenarios.

[0022] As a preferred technical solution of the present invention, the risk level L is determined based on the comparison results of the risk probability P and the thresholds θ1, θ2, and θ3. The thresholds θ1, θ2, and θ3 are preset according to the risk management policy and satisfy the relationship of increasing from low to high. The risk level L includes at least four levels: low, medium, relatively high, and high, which can realize the hierarchical control of access requests.

[0023] As a preferred technical solution of the present invention, the dynamic permission set A consists of the basic permission set A of user role U. base (U) and the constraint set A corresponding to risk level L limit The intersection of (L) is determined, and the basic permission set A is determined. base (U) Granted based on user identity attributes, limiting set A limit (L) gradually tightens as the risk level increases, thereby achieving dynamic permission trimming and risk adaptive control.

[0024] As a preferred technical solution of the present invention, the security strength index S is determined based on the size and proportion parameter λ of the dynamic permission set A, and is used to measure the degree of protection of the system for access requests. The smaller the size of the permission set and the lower the security strength index S, the higher the risk of the request is considered by the system, and the access delay will be increased, the access rate will be reduced, or secondary verification will be forcibly triggered accordingly.

[0025] As a preferred technical solution of the present invention, the risk coefficient Q is obtained by combining the risk score R and the security strength index S, and is used to measure the degree of danger of the access request under the current protection level. When the risk score R is high and the security strength S is low, the risk coefficient Q will increase significantly, indicating that the request is in a high-risk situation.

[0026] As a preferred technical solution of the present invention, the audit log generated by the system includes a risk score R, a security strength index S, and a risk coefficient Q, and stores them together with the request identifier and request time information in an immutable log database to support subsequent security incident investigations, compliance audits, and model retraining.

[0027] As a preferred technical solution of the present invention, when the risk coefficient Q reaches or exceeds a preset threshold Q max Furthermore, if the number of occurrences exceeds a threshold T consecutively within a set sliding time window, the system triggers a security response mechanism. This mechanism includes, but is not limited to: freezing or suspending the user account, blocking suspicious sessions, pushing real-time alerts to the security administrator, automatically tightening the global access policy, updating the blacklist and whitelist, and adjusting parameters α, β, and w. i θ1, θ2, θ3, and λ are dynamically retrained and adjusted to improve the overall security level of the system.

[0028] Compared with the prior art, the present invention has the following beneficial effects:

[0029] This invention collects multi-dimensional contextual information, including access time, location, device, network environment, and historical behavior, and calculates risk scores based on weights. These scores are then converted into risk probabilities using a probability mapping model, enabling dynamic identification and classification of access behavior. Compared to existing static authorization methods, this approach can perceive changes in the access environment in real time and automatically adjust permissions based on risk probabilities and levels. This solves the problems of fixed permissions, outdated policies, and inability to handle abnormal scenarios in traditional access control, significantly improving the system's responsiveness to abnormal access.

[0030] This invention introduces a dynamic pruning mechanism into access control, combining basic permissions corresponding to user roles with restricted permissions corresponding to risk levels to form a dynamic permission set that can be adjusted according to changes in risk. This achieves fine-grained control at the field, record, and even content feature levels. Compared with existing coarse-grained control methods, this method not only ensures access efficiency in normal scenarios but also automatically tightens the permission scope under high-risk conditions, effectively reducing the risk of sensitive data leakage and improving the fine-grainedness and practicality of access control.

[0031] This invention further proposes a security strength index and a comprehensive risk coefficient, combining risk scores with access control levels to form a quantifiable risk measurement standard. The risk score, security strength, and risk coefficient triple are recorded in an immutable audit log. When the risk coefficient continuously exceeds limits, the system automatically triggers a security response mechanism, including freezing accounts, blocking sessions, sending alerts, and adjusting global policies, achieving a closed loop of "real-time monitoring—risk warning—dynamic response—continuous optimization." Compared to traditional post-event auditing, this invention can intervene immediately when risks occur, improving the system's risk prevention and control capabilities and overall security. Attached Figure Description

[0032] Figure 1 This is a flowchart of the big data security access control method proposed in this invention;

[0033] Figure 2 This is a logic block diagram of the big data security access control method proposed in this invention. Detailed Implementation

[0034] To make the objectives, technical solutions, and advantages of this invention clearer, the following description is provided in conjunction with the appendix. Figure 1-2 The present invention will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0035] Example 1: This invention proposes a big data security access control method. This method combines context feature collection, risk modeling, permission pruning, strength assessment, and risk response to achieve a complete chain-like closed-loop access control process. Its principle and implementation process are described below.

[0036] Upon receiving an access request, the system first performs feature collection and construction. Specifically, the system collects contextual information from multiple dimensions, including time, location, device, network, and historical behavior, and organizes it into an access feature vector:

[0037] F = {f1, f2, f3, f4, f5}

[0038] Wherein, f1: time factor, representing the time when the access request occurred; f2: location factor, representing the geographical location or IP mapping location from which the request was initiated; f3: device factor, representing the unique identifier of the accessing device; f4: network factor, representing the network environment type, such as public network, intranet, or VPN; f5: behavioral factor, representing the user's historical access habits and operational characteristics. Each factor is assigned a weight parameter w according to its importance. i And satisfy the constraints. The system then calculates the risk score R using the following formula:

[0039]

[0040] Where R: risk score, representing the overall risk level of the access request; w i : The weight parameters corresponding to each factor; f i This refers to the components in the access feature vector. A higher score indicates a more potentially dangerous access request. To convert the risk score into a more intuitive probability, the system uses a logistic regression model for normalization mapping:

[0041]

[0042] Where P: risk probability, ranging from 0 to 1; ·R: risk score; α: coefficient of the logistic regression model, used to adjust risk sensitivity; β: bias term of the logistic regression model, used to shift the center of the function. After obtaining the risk probability, the system classifies it according to a preset threshold to determine the risk level L.

[0043]

[0044] Where L: risk level, with values ​​of 0, 1, 2, and 3, representing low, medium, relatively high, and high risk, respectively; P: risk probability; θ1, θ2, θ3: risk classification thresholds, satisfying 0 < θ1 < θ2 < θ3 < 1.

[0045] Based on risk levels, the system dynamically adjusts access permissions. Specifically, it first obtains the basic permission set A corresponding to the user role. base (U), then obtain the constraint set A determined by the risk level. limit (L), the intersection of the two forms the final set of available permissions:

[0046] A = A base (U)∩A limit (L)

[0047] Where A: dynamic permission set; A base (U): The set of basic permissions corresponding to user role U; A limit(L): The set of restricted permissions corresponding to risk level L. As the risk level increases, the restricted set tightens the permission space, for example, by prohibiting the export of sensitive data or reducing access frequency. After obtaining the dynamic permission set, the system calculates the security strength index S, defined as:

[0048] S=λ·|A|

[0049] Where S: security strength index, representing the contribution of the scope of permissions to overall security; λ: proportional parameter, used to adjust the scale; |A|: cardinality of set A, i.e., the number of permissions that can be accessed.

[0050] To measure the overall risk level of a request, the system introduces a comprehensive risk coefficient Q, calculated using the following formula:

[0051]

[0052] Log = (R, S, Q)

[0053] Where Q: Risk coefficient, representing the relative ratio of risk to protection strength; R: Risk score; S: Security strength index; "+1" in the denominator is used to avoid a zero denominator. After the access is completed, the system generates an audit log, recording the following triplet: Log: Audit log record; R: Risk score; S: Security strength index; Q: Risk coefficient. This log not only supports subsequent security audits but can also be used for model retraining and parameter optimization.

[0054] Finally, when the risk coefficient Q reaches or exceeds the preset threshold Q max Furthermore, if the number of occurrences exceeds the threshold T consecutively within the sliding time window, the system will trigger a security response mechanism. At this time, the system will perform a series of security actions, including freezing user accounts or sessions, sending alerts to security administrators, automatically tightening global access policies, updating blacklists and whitelists, and adjusting parameters α, β, and w based on the latest data. i ,θ1,θ2,θ3,λ are dynamically retrained to improve adaptability.

[0055] Example 2: Taking a large financial platform as an example, user A initiates a transfer request of 500,000 yuan at 2:00 AM using an unregistered mobile device connected to a public Wi-Fi network via an overseas IP address. The system applies the method of this invention to control access to this request.

[0056] First, the system collects contextual features to construct a five-dimensional feature vector: a time factor of 0.9 (indicating late-night hours, higher risk), a location factor of 0.8 (indicating overseas access, deviating from commonly used areas), a device factor of 0.7 (indicating a new terminal, lower credibility), a network factor of 0.8 (indicating public Wi-Fi, poor security), and a historical behavior factor of 0.6 (indicating deviation from routine operations). The system assigns the following weights to each factor: time 0.25, location 0.20, device 0.20, network 0.20, and historical behavior 0.15.

[0057] Based on this, the system calculates the risk score: R = (0.25 × 0.9) + (0.20 × 0.8) + (0.20 × 0.7) + (0.20 × 0.8) + (0.15 × 0.6) = 0.765. The resulting risk score of 0.765 indicates that the overall request is at a relatively high risk level.

[0058] The system then substitutes the risk score into the logic function, setting parameters α = 5 and β = -2, to obtain the risk probability:

[0059]

[0060] The risk probability is 0.86, which is close to 1, indicating that the request is very likely a high-risk request.

[0061] Based on the preset thresholds (low risk <0.3, medium risk 0.3-0.6, relatively high risk 0.6-0.8, high risk 20.8), the request was determined to be at the "high risk" level.

[0062] During the permission pruning phase, the basic permission set corresponding to user A includes account inquiry, fund transfer, investment purchase, and fund export. The restriction set corresponding to the high-risk level prohibits fund transfer and fund export operations. After taking the intersection of the two, the dynamic permission set only includes account inquiry and investment purchase, while fund transfer operations are tightened.

[0063] During the security strength assessment phase, assuming the basic permission set size is 4, the high-risk permission set size after pruning is 2, and the proportional coefficient λ = 1, then the security strength index is: S = 1 × 2 = 2, indicating that the system's protection for this request is relatively strict under the current conditions.

[0064] Finally, the system calculates the overall risk coefficient: The overall risk coefficient reached 0.255.

[0065] Since the system-set threshold Q_max = 0.2, the request has exceeded the threshold, and user A has made similar high-risk accesses multiple times within the sliding time window. Therefore, the system immediately triggers the security response mechanism: freezing the user account's transfer function, sending a real-time alert to the administrator, and requiring subsequent access to be subject to multi-factor authentication.

[0066] As can be seen from the above calculation process, the method of the present invention can quantitatively evaluate access requests based on multi-dimensional features, and form a quantifiable, traceable, and responsive closed-loop control process through dynamic permission pruning, security strength assessment, and risk coefficient calculation, thereby effectively avoiding the threat posed by high-risk access behaviors to sensitive financial data and fund security.

[0067] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A big data security access control method, characterized in that, Includes the following steps: S1. Upon receiving an access request, collect the context information of the accessing entity and construct an access feature vector F. The vector consists of a time factor f1, a location factor f2, a device factor f3, a network factor f4, and a historical behavior factor f5, and assigns a corresponding weight parameter w to each factor. i This allows different dimensions to make differentiated contributions to the overall risk assessment; S2, Based on feature vector F and weight parameter w i Risk is measured for access requests, a risk score R is generated, and a correspondence is established between the R score and the request identifier and the time t when the request was generated, so as to facilitate subsequent tracking and auditing. S3. Input the risk score R into the probability mapping model, and combine it with the model parameters α and β to obtain the risk probability P, which is used to measure the probability that the access request is statistically a high-risk behavior. S4. Based on the risk probability P and the system's preset thresholds θ1, θ2, and θ3, the request is divided into risk levels L, which include at least four levels: low risk, medium risk, relatively high risk, and high risk. S5. Combining the user role U and risk level L of the accessing entity, retrieve the basic permission set A corresponding to each role. base (U) The set of restrictions corresponding to the risk level A limit (L), a dynamic permission set A is obtained through permission trimming, and the set will gradually tighten as the risk level increases; S6. Calculate the security strength index S based on the size of the dynamic permission set A and the proportional adjustment parameter λ. This index is used to characterize the degree of control of user access by the system under the current risk environment. S7. Combine the risk score R with the safety intensity index S to form a risk coefficient Q, and then combine Q with R and S to form a triplet.<R,S,Q> This coefficient reflects the actual level of danger of a request under access restrictions; S8. Write the triplet and related parameters to the audit log. When the risk coefficient Q reaches or exceeds the threshold Q... max Furthermore, if the number of occurrences exceeds the threshold T consecutively within the sliding time window, the system triggers a security response mechanism, including freezing the account or session, sending an alarm notification, and tightening and adjusting the global access policy.

2. The big data security access control method according to claim 1, characterized in that, The components of the access feature vector F have the following functions: time factor f1 is used to determine whether the access occurred during an abnormal time period; location factor f2 is used to compare whether the geographical location matches the user's commonly used area; device factor f3 is used to identify whether the terminal device is trustworthy or registered; network factor f4 is used to determine whether the access comes from a public network, intranet, or virtual private network environment; and historical behavior factor f5 is used to characterize the user's past access patterns and operating habits in order to detect abnormal deviations.

3. The big data security access control method according to claim 1, characterized in that, The risk score R is calculated by analyzing each factor f of the access feature vector F. i According to the weight parameter w i Obtained through weighted summation, it reflects the overall risk level of the current request; the weight parameter w. i It can be configured based on industry security standards, historical data analysis results, or machine learning model training results, and can be dynamically adjusted during operation.

4. The big data security access control method according to claim 1, characterized in that, The risk probability P is derived from the risk score R through a probability mapping model combined with parameters α and β. The value of the risk probability P ranges between 0 and 1, with the closer it is to 1, the more risky the request is. Parameter α is used to control the risk sensitivity, and parameter β is used to calibrate the overall probability distribution so that the model can adapt to the risk distribution characteristics under different business scenarios.

5. The big data security access control method according to claim 1, characterized in that, The risk level L is determined based on the comparison between the risk probability P and the thresholds θ1, θ2, and θ3. The thresholds θ1, θ2, and θ3 are preset according to the risk management policy and satisfy the relationship of increasing from low to high. The risk level L includes at least four levels: low, medium, relatively high, and high, which can realize hierarchical control of access requests.

6. The big data security access control method according to claim 1, characterized in that, The dynamic permission set A consists of the basic permission set A of user role U. base (U) and the constraint set A corresponding to risk level L limit The intersection of (L) is determined, and the basic permission set A is determined. base (U) Granted based on user identity attributes, limiting set A limit (L) gradually tightens as the risk level increases, thereby achieving dynamic permission trimming and risk adaptive control.

7. The big data security access control method according to claim 1, characterized in that, The security strength index S is determined based on the size and proportion parameter λ of the dynamic permission set A. It is used to measure the degree of protection of the system for access requests. The smaller the size of the permission set and the lower the security strength index S, the higher the risk of the request is considered by the system. Accordingly, the system will increase access latency, reduce access speed or force the triggering of secondary verification.

8. The big data security access control method according to claim 1, characterized in that, The risk coefficient Q is obtained by combining the risk score R and the security strength index S. It is used to measure the degree of danger of the access request under the current protection level. When the risk score R is high and the security strength S is low, the risk coefficient Q will increase significantly, indicating that the request is in a high-risk situation.

9. The big data security access control method according to claim 1, characterized in that, The audit logs generated by the system include a risk score R, a security strength index S, and a risk coefficient Q, which are stored together with the request identifier and request time information in an immutable log database to support subsequent security incident investigations, compliance audits, and model retraining.

10. The big data security access control method according to claim 9, characterized in that, When the risk coefficient Q reaches or exceeds the preset threshold Q max Furthermore, if the number of occurrences exceeds a threshold T consecutively within a set sliding time window, the system triggers a security response mechanism. This mechanism includes, but is not limited to: freezing or suspending the user account, blocking suspicious sessions, pushing real-time alerts to the security administrator, automatically tightening the global access policy, updating the blacklist and whitelist, and adjusting parameters α, β, and w. i θ1, θ2, θ3, and λ are dynamically retrained and adjusted to improve the overall security level of the system.

Images