A management system for information assets and a method for evaluating protection strength thereof

Abstract

The application relates to the technical field of information asset management and control, and discloses an information asset management system and an evaluation method for the protection strength of the information asset management system. An asset identification module of the method acquires original attribute data of information assets, generates an asset identification code according to asset types and storage locations; a classification mapping module extracts key attributes of the assets, and establishes an association between the asset identification code and the key attributes; a risk evaluation module calculates an asset vulnerability index based on the key attributes, and generates a risk level in combination with external threat data; a dynamic adjustment module updates the key attributes according to the change of the risk level, and recalculates the vulnerability index; and an access control module generates an access permission strategy according to the updated vulnerability index, and limits asset access behavior. The system realizes fine and dynamic management of information assets, balances asset security and management efficiency, and meets the needs of an organization for information asset management.

Description

Technical Field

[0001] This invention relates to the field of information asset management technology, specifically to an information asset management system and a method for assessing the strength of its protection. Background Technology

[0002] In the digital age, information assets have become a core element of organizational operations and development, encompassing various types such as data files, software systems, and hardware devices. Their storage locations are scattered across different environments, including local servers, cloud storage, and mobile terminals, significantly increasing the difficulty of information asset management. Currently, most organizations lack a unified and accurate asset identification mechanism in their information asset management process, often relying solely on manual records or simple classification tools to organize information assets. This fails to comprehensively obtain the original attribute data of information assets and makes it difficult to generate unique identification information based on asset type and storage location. This poses a significant challenge to subsequent asset tracking and management, easily leading to problems such as asset omissions and duplicate statistics.

[0003] Existing management methods lack precision in extracting key attributes of information assets and fail to effectively establish the correlation between asset identifiers and key attributes. This results in an inability to conduct risk assessments based on complete asset attribute information. Traditional risk assessments often rely on static assessment indicators, considering only some characteristics of the asset itself and ignoring the dynamic changes in external threat data. Consequently, the calculated asset vulnerability index deviates from the actual risk situation, and the generated risk level fails to accurately reflect the real threats faced by information assets.

[0004] When risk levels change, existing systems lack effective dynamic adjustment mechanisms, failing to update key attributes of information assets and recalculate vulnerability indices in a timely manner, resulting in delayed risk response measures. Regarding access control, most systems employ fixed permission policies, failing to adjust access permissions in real time based on changes in asset vulnerability indices. This leaves some high-risk assets vulnerable to unauthorized access, while excessive access restrictions on low-risk assets impact normal business operations. These problems make it difficult to balance information asset security and management efficiency, failing to meet the organization's needs for refined and dynamic management of information assets. Summary of the Invention

[0005] The purpose of this invention is to provide an information asset management system and a method for assessing the strength of its protection, in order to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides an information asset management system, the system comprising:

[0007] The asset identification module is used to acquire the original attribute data of information assets and generate asset identification codes based on the type and storage location of the information assets.

[0008] The classification mapping module is used to extract key attributes of information assets and establish the association between asset identification codes and key attributes;

[0009] The risk assessment module calculates the asset vulnerability index based on the key attributes of information assets and generates a risk level by combining external threat data.

[0010] The dynamic adjustment module updates the key attributes of information assets based on changes in risk level and recalculates the asset vulnerability index.

[0011] The access control module generates access permission policies based on the updated asset vulnerability index to restrict access to information assets.

[0012] Preferably, the asset identification module is implemented in the following ways:

[0013] Collect metadata of information assets, including creation time, modification records, and storage path;

[0014] The metadata is normalized to generate standardized attribute fields;

[0015] The hash value is calculated based on the standardized attribute fields, and then combined with the type code of the information asset to form an asset identification code.

[0016] Preferably, the classification mapping module is implemented in the following ways:

[0017] Extract the sensitivity and usage frequency of information assets from standardized attribute fields;

[0018] Sensitivity and frequency of use are divided into multiple level intervals, and a weighting coefficient is assigned to each level interval;

[0019] The comprehensive score of key attributes is calculated based on the weighting coefficients, and the comprehensive score is stored in association with the asset identification code.

[0020] Preferably, the risk assessment module is implemented in the following ways:

[0021] Obtain attack frequency and vulnerability exploitation difficulty data from external threat databases;

[0022] The exposure level of information assets is calculated by combining the comprehensive scores of key attributes;

[0023] A risk level is generated based on the matching results of exposure level and external threat data.

[0024] Preferably, the dynamic adjustment module is implemented in the following ways:

[0025] Monitor the usage logs of information assets, identify abnormal access behavior, adjust the sensitivity level of key attributes based on the frequency of abnormal access behavior, recalculate the asset vulnerability index, and update the risk level.

[0026] Preferably, the access control module is implemented in the following way:

[0027] Access permission levels are determined based on the updated risk level.

[0028] Set access rules for each permission level, including time limits and operation types;

[0029] Bind access rules to asset identifiers to generate dynamic access policies.

[0030] Preferably, the system further includes a log auditing module for:

[0031] Record access behavior and permission change history of information assets;

[0032] Analyze the compliance of access behavior and generate an audit report;

[0033] The abnormal events in the audit report are fed back to the dynamic adjustment module.

[0034] Preferably, the system further includes a backup and recovery module for:

[0035] Backup frequencies are determined based on the risk level of information assets. Incremental backups are performed on high-risk information assets, and high-risk information assets are prioritized for recovery when data corruption is detected.

[0036] Preferably, the system further includes an encryption management module for:

[0037] Encryption algorithms are selected based on the key attributes of information assets. Multiple encryption methods are enabled for high-risk information assets, encryption keys are rotated regularly, and asset identification codes are updated.

[0038] Preferably, the present invention also includes a method for assessing the strength of information asset protection, comprising:

[0039] The protection strength calculation module extracts the original attribute data of the information asset based on the asset identification code generated by the asset identification module, and calculates the basic protection value of the information asset by combining the key attribute association relationship established by the classification mapping module.

[0040] The threat quantification module, based on the risk level generated by the risk assessment module, quantifies the potential impact of external threats on information assets and generates a threat intensity coefficient.

[0041] The comprehensive assessment module weights and fuses the basic protection value with the threat intensity coefficient to generate a real-time protection strength score for information assets.

[0042] The dynamic feedback module adjusts the calculation weight of the basic protection value based on the asset vulnerability index updated by the dynamic adjustment module, and triggers the comprehensive assessment module to regenerate the real-time protection strength score.

[0043] Compared with the prior art, the beneficial effects of the present invention are:

[0044] This information asset management system, through the establishment of asset identification, classification mapping, risk assessment, dynamic adjustment, and access control modules, forms a complete information asset management system that effectively solves many problems existing in current information asset management. The asset identification module can comprehensively acquire the original attribute data of information assets and generate a unique asset identifier code based on the asset type and storage location. This identifier code provides a unified basis for subsequent asset tracking and management, avoiding asset omissions or duplicate statistics, making asset sorting more accurate and efficient, and laying a solid foundation for the subsequent work of other modules.

[0045] The classification mapping module can extract key attributes of information assets and establish a relationship between asset identification codes and key attributes. The establishment of this relationship makes asset information more complete and clear, which facilitates the subsequent risk assessment module to quickly and accurately obtain the required asset attribute information. It also provides convenience for asset classification management. Managers can quickly filter out specific types of assets based on key attributes, improving the convenience of management operations.

[0046] The risk assessment module calculates the asset vulnerability index based on the key attributes of information assets and generates risk levels by combining external threat data. Compared with the traditional static assessment method, this module fully considers the dynamic changes of the asset's own attributes and external threats, making the calculated asset vulnerability index more in line with the actual situation of the asset. The generated risk level can accurately reflect the degree of threat faced by the asset, providing a reliable reference for organizations to formulate risk response strategies and helping organizations to carry out risk prevention and control work in a more targeted manner.

[0047] The dynamic adjustment module can update the key attributes of information assets in a timely manner according to changes in risk level and recalculate the asset vulnerability index. This dynamic adjustment mechanism ensures the timeliness of asset information and risk assessment results. When external threats or the asset's own condition changes, the system can respond quickly and update relevant data to avoid the problem of untimely risk response due to information lag, so that risk management is always in an effective state.

[0048] The access control module generates access permission policies based on the updated asset vulnerability index, restricting access to information assets. This module enables dynamic adjustment of access permissions. For high-risk assets with a high vulnerability index, stricter access permission policies can be formulated to reduce the possibility of unauthorized access. For low-risk assets with a low vulnerability index, access restrictions can be appropriately relaxed to ensure the efficiency of normal business operations. This achieves a balance between information asset security and business operation convenience, meeting the organization's needs for refined management of information assets.

[0049] The modules work together to form a closed-loop management process. The asset identification module provides basic data for the classification and mapping module, which in turn provides key information for the risk assessment module. The results of the risk assessment module drive the dynamic adjustment module to update the data, and the update results of the dynamic adjustment module provide a basis for the access control module. This collaborative mechanism ensures the efficient operation of the entire management system, improves the overall level of information asset management, and helps the organization better protect information assets and maintain the stable operation of business. Attached Figure Description

[0050] Figure 1 This is a sequence diagram of the information asset management system described in this invention;

[0051] Figure 2 This is a diagram illustrating the working principle of the asset identification module.

[0052] Figure 3 This is a diagram illustrating the working principle of the risk assessment module. Detailed Implementation

[0053] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0054] Please see Figure 1This invention provides an information asset management system and a method for assessing its protection strength. The method comprises the collaborative work of multiple modules to achieve comprehensive management of enterprise information assets. First, the system acquires raw attribute data of information assets through an asset identification module. This data includes basic information such as asset type, storage location, and creation time. The asset identification module generates a unique asset identifier code based on this data, which is used to uniquely identify each information asset throughout the system. Subsequently, a classification and mapping module extracts key attributes, such as sensitivity and usage frequency, from the raw attribute data and establishes a correlation between the asset identifier code and the key attributes. This correlation provides the basis for subsequent risk assessment. The risk assessment module calculates an asset vulnerability index based on the key attributes and, in conjunction with external threat data, such as attack frequency and vulnerability exploitation difficulty, generates a risk level for each information asset. A dynamic adjustment module monitors changes in the status of information assets in real time. When the risk level changes, this module updates the key attributes and recalculates the asset vulnerability index to ensure the accuracy of the risk assessment. Finally, an access control module generates dynamic access permission policies based on the updated asset vulnerability index. These policies include rules such as time limits and operation types, thereby effectively restricting access to information assets. Through modular design, the entire system achieves automated and adaptive information asset management, enabling it to cope with ever-changing security threats.

[0055] Example 1: See Figure 2When the asset identification module starts, it automatically collects metadata about information assets from various data sources, including the enterprise's internal distributed storage system, document management platform, and database server. This metadata covers basic descriptive information about the information assets, including but not limited to file creation timestamps, historical modification records, complete path location information in the storage system, and attributes such as file size and owner identity. The collection process is completed through lightweight agent programs deployed on various data sources. These agent programs proactively report metadata to the system's central processing unit according to preset time periods or event triggers (such as file creation or modification completion). The system also supports batch retrieval of metadata lists from specified storage areas via application programming interfaces (APIs) to ensure the comprehensiveness and timeliness of asset information collection. After completing metadata collection, the asset identification module immediately initiates a data normalization process. This process aims to convert raw metadata from different systems and in various formats into a standardized set of attribute fields that can be processed uniformly by the system. For example, for date and time information, the module will identify various formats that may exist in the raw data (such as "2023-10-01", "01 / 10 / 2023 14:30", etc.) and convert them into the international standard ISO8601 format ("2023-10-01T14:30:00Z"); for storage path information, the module will parse the path representation methods under different operating systems (such as "C:\Folder\file" in Windows and " / home / user / file" in Linux) and convert them into absolute resource locators containing the complete hostname or mount point; for fields involving user identity such as file owner, the module will map them to the standard user identifier in the enterprise unified directory service.

[0056] This normalization process is implemented through a scalable parsing rule base. Each data source has a corresponding parser, and the processed standardized attribute fields are output to a structured data model, preparing for subsequent identification code generation. After obtaining the standardized attribute field set, the module begins generating asset identification codes. The core of this process is calculating the hash value of the attributes to ensure the uniqueness and tamper-proof nature of the identification. The system uses the SHA-256 cryptographic hash algorithm, which can map input data of arbitrary length to a fixed-length (256-bit) near-unique digital digest. The module concatenates a set of core standardized attribute fields (typically including storage path, creation timestamp, and file size, which are considered highly identifiable fields) into a string in a specific order and inputs this string into the SHA-256 algorithm for calculation. After generating the hash value, the module combines it with the type code of the information asset. The type code is a predefined string or numeric code representing the asset category, such as "DOC" for text document, "DB" for database table, and "APP" for executable application. The combination method typically uses string concatenation.

[0057] The classification and mapping module follows the asset identification module. It extracts key attributes for risk assessment from standardized attribute fields, with sensitivity and usage frequency being two core dimensions. Sensitivity is determined based on a logic grounded in business rules and data classification policies. The module scans for keywords in file content (such as "confidential" or "personally identifiable information"), analyzes the directory path of the file (e.g., whether it contains sensitive folder names like "Contracts" or "HR"), and refers to sensitivity labels pre-set by the data administrator for specific storage areas. Usage frequency is calculated by querying integrated system access logs. The module counts the total number of read and write operations on the information asset within a specified time window (e.g., the past 30 days). The extracted raw sensitivity description (e.g., "highly sensitive") and specific access counts need further quantification. The quantification process involves dividing sensitivity and usage frequency into multiple preset level intervals and assigning a weight coefficient to each interval. For example, sensitivity can be categorized into three levels: "high," "medium," and "low," with corresponding weighting coefficients of 0.9, 0.5, and 0.1, respectively. Usage frequency can be categorized by average daily visits: "high frequency" (>100 times), "medium frequency" (10-100 times), and "low frequency" (<10 times), with weighting coefficients of 0.7, 0.4, and 0.1, respectively. The weighting coefficients are typically based on historical security incident analysis, industry best practices, or the company's own risk preference policies, reflecting the relative importance of this attribute to the overall risk of the asset. After determining the level and weight of each key attribute, the classification mapping module begins calculating the comprehensive score of the key attributes. The calculation typically uses a weighted summation model: Comprehensive Score = (Sensitivity Weight × Sensitivity Level Score) + (Usage Frequency Weight × Usage Frequency Level Score). Here, the level score maps the level name (e.g., "high," "medium," "low") to a specific numerical value (e.g., 3, 2, 1). Through weighted calculation, a quantitative comprehensive score is obtained, which comprehensively reflects the risk profile of the information asset in terms of sensitivity and activity. Finally, the module associates this comprehensive score with the unique asset identifier of the information asset and persists it in the system's asset attribute database in the form of key-value pairs. This association allows subsequent modules to quickly retrieve the risk attribute summary of the asset through the asset identifier.

[0058] At the system integration level, the asset identification module and the classification mapping module exchange data through a well-defined internal application programming interface (API). After successfully generating an asset identification code, the asset identification module triggers an event notification carrying the asset identification code and complete standardized attribute field data. The classification mapping module listens for this event and immediately initiates its key attribute extraction and mapping process. This event-driven architecture ensures real-time data flow and decoupling between modules. To handle potential spikes in data flow, the module employs in-memory computing technology, temporarily storing newly generated asset identification codes and preliminary associations in a high-speed cache to reduce database write latency and improve system response speed. The system also features robust error handling and retry mechanisms. For example, when metadata collection fails due to a temporary network interruption, the agent records a checkpoint and resumes collection from the point of interruption after the connection is restored, rather than restarting, thus ensuring the reliability of data collection. The classification and mapping module is not a one-time operation. It automatically re-executes the extraction of key attributes, classification, and comprehensive scoring process according to the preset scheduling strategy (such as every 24 hours) or when it receives an event notification that the asset metadata has changed. This ensures that the risk profile of the asset can be dynamically updated as its own status and access patterns change, thus maintaining the accuracy of the assessment results.

[0059] Example 2: See Figure 3Upon startup, the risk assessment module immediately establishes connections with multiple external threat data sources, including commercial threat intelligence subscription services, open-source vulnerability databases, and industry security information sharing platforms. The module periodically pulls or receives real-time push threat data streams through a pre-configured application programming interface (API). The acquired raw threat data includes key indicators such as attack frequency and vulnerability exploitation difficulty. Attack frequency data is typically presented as the number of attack attempts suffered by a specific asset type or software version per unit time, while vulnerability exploitation difficulty may be represented using attack complexity indicators from standardized scoring systems such as CVSS. The module parses the received raw data, extracts threat indicators potentially relevant to the various information assets currently managed, and standardizes them, for example, mapping the scoring systems used by different data sources to a unified internal system dimension. After completing the collection and standardization of external threat data, the module begins calculating the exposure level of information assets. This calculation process closely relies on the comprehensive score of the asset's key attributes provided by the classification and mapping module. Exposure level aims to quantify the likelihood of an asset being successfully attacked in the current threat environment. The calculation model takes the asset's comprehensive score as a basic input, reflecting the asset's intrinsic value and activity level. It also incorporates attack frequency data targeting this type of asset in the current external threat environment; a higher attack frequency indicates a greater probability of asset exposure. Furthermore, the model considers the exploit difficulty of known vulnerabilities related to the asset; the lower the exploit difficulty, the higher the exposure risk. The module integrates information from these three dimensions through an internal calculation logic, ultimately generating a quantified exposure level index.

[0060] The module generates risk levels by matching the calculated exposure index with specific external threat data. This matching process is driven by a rule engine. The rule engine has pre-defined matching rules. For example, if an asset's exposure index is high, and a significant increase in attacks targeting that asset has been detected recently, along with easily exploitable vulnerabilities, the rule engine will match it to a "high-risk" level. If the exposure is moderate, and although there are related threats, the attack frequency is low or the exploitation conditions are stringent, it may be matched to a "medium-risk" level. These matching rules can be customized according to an organization's risk tolerance strategy; for example, the financial industry may set stricter thresholds for certain risk levels. After the risk level is generated, the module binds it to the unique identifier of the information asset and persistently stores the binding relationship in the risk status database. Meta-information such as the timestamp of this risk assessment and the version number of the threat data used is also recorded for auditing and traceability. After storage is complete, the module will publish a risk assessment update event to the system's message bus. This event carries the asset identification code and the new risk level information, thereby notifying the dynamic adjustment module and other relevant components to carry out subsequent processing.

[0061] The risk assessment module prioritizes processing efficiency and real-time performance. To handle potentially large asset volumes and frequently updated threat data streams, it employs a streaming architecture, performing risk calculations asynchronously and in parallel. Internally, the module maintains a local threat data cache, storing the most frequently used or recently updated threat indicators in memory. This significantly reduces latency when calling remote threat intelligence APIs, and the cached data is periodically refreshed according to a pre-defined expiration policy. The module also includes an adaptive data quality check mechanism. When acquiring threat data from external sources, it verifies the integrity and format validity of the data. In cases of abnormal data or acquisition failures, the module automatically switches to a backup data source or continues running using the most recent valid cached data, logging alerts for administrator review. The matching rules in the rules engine are not static; the module supports dynamically loading updated rule sets during runtime, enabling the system to quickly respond to the emergence of new threats. The entire risk assessment process is designed to be executed automatically on a regular basis (e.g., every 4 hours), while also supporting immediate execution triggered by specific events. For example, when a key asset attribute is updated by the classification and mapping module, or when a high-risk vulnerability notification related to a specific asset is received from a threat intelligence source, the module will immediately initiate a new risk assessment for that asset, ensuring the timeliness of the risk level. Detailed risk assessment logs generated by the module, including input data, intermediate calculation results, and the reasons for the final level determination, are fully recorded. These logs can be used for subsequent analysis, rule optimization, and compliance report generation.

[0062] Example 3: The dynamic adjustment module's operation begins with continuous monitoring of information asset usage logs. These logs are collected from various access gateways, application servers, and operating system audit subsystems within the enterprise. Log entries detail the timestamp of each access attempt, the user or process initiating the access, the type of operation performed (e.g., read, modify, delete), the source IP address, and the success or failure status of the operation. The module pulls or receives pushed log streams in real time through data collectors deployed on the log aggregation system. The collectors are configured with data filtering rules to focus on security-related events, such as authentication attempts, file access, and network connections. This data is converted into a unified JSON format before being input into the module's processing pipeline. To handle high-concurrency log data streams, the module uses a distributed message queue as a buffer to ensure that log records are not lost even during peak traffic periods.

[0063] Identifying abnormal access behavior is one of the core functions of this module. Its identification logic is based on a multi-layered set of analysis rules and statistical models. The rule layer predefines typical abnormal patterns, such as access occurring outside of working hours (e.g., 2 AM to 5 AM), the same user account logging in from multiple geographically dispersed IP addresses within a very short period (e.g., within one minute), or multiple failed read attempts on sensitive assets. The statistical model is built upon historical normal access behavior. The module establishes a dynamic access behavior baseline for each information asset or user role. Baseline data includes average access frequency, common operation times, and typical access sources. Anomalies are identified by comparing the deviation of real-time logs from the baseline. For example, a sliding time window is used to calculate the standard deviation of the current access frequency from the historical average. When the access frequency within a certain time window exceeds three standard deviations of the baseline average, an anomaly flag is triggered. The identification process is incremental; newly arrived log records are immediately matched against the current baseline and rules. Identified abnormal events are timestamped and tagged with an anomaly type, and temporarily stored in a pending queue.

[0064] For identified abnormal access behaviors, the module dynamically adjusts the sensitivity level of key attributes of information assets based on their frequency. The adjustment strategy is based on an internally defined frequency-sensitivity mapping table, which defines the correspondence between the number of abnormal events within different time windows and the adjustment range of the sensitivity level. For example, consider a simple adjustment calculation relationship:

[0065]

[0066] Where: symbol Represents the total number of anomalous access events to this information asset detected within a configurable observation period (e.g., the past 24 hours), symbolized by... This represents a frequency unit threshold (e.g., 10 events) used to normalize the number of anomalies. The symbol... This indicates a fixed sensitivity level adjustment step size (e.g., 0.5 levels), while This is the calculated actual adjustment amount for the sensitivity level. Its value can be positive or negative; a positive value increases sensitivity, and a negative value decreases sensitivity. The module applies this adjustment amount to the asset's current sensitivity level. For example, if the original level is "Medium" (corresponding to a value of 2), and the adjustment amount Δ is +0.5, then the new level will be adjusted to "Medium-High" (corresponding to a value of 2.5). Specific parameters of the mapping table, such as the time window length, threshold, and step size, can be adjusted by the system administrator according to the organization's security policy. For example, for extremely critical assets, a shorter time window and a lower threshold may be set, making the system more sensitive to abnormal activity.

[0067] After adjusting the sensitivity level of key attributes, the module triggers a recalculation of the asset vulnerability index. This recalculation reuses the logic defined in the risk assessment module, but uses the updated key attribute values. The calculation process comprehensively considers the adjusted sensitivity level, usage frequency, and other potentially dynamically changing attributes to generate a new asset vulnerability index value. Subsequently, based on this newly calculated vulnerability index and referencing current external threat data (usually the latest snapshot from the cache), the module re-executes the matching logic in the risk assessment module to generate an updated risk level. This new risk level overrides the asset's original risk rating in the system.

[0068] The module rebinds the updated risk level with the asset identifier and persists this change to the central asset status database. It also notifies other system components, such as the access control and log auditing modules, by publishing a status change event. The entire adjustment, calculation, and update process is designed as an automated closed loop. The module continuously monitors new log data, enabling risk assessment to dynamically respond to changes in the actual usage environment of information assets. To handle performance requirements with a large asset base, the module performs asset monitoring and adjustment calculations in parallel, using a distributed computing framework to group assets across different processing nodes. The module also includes a state consistency check mechanism, verifying that the asset's current state matches the cached state in memory before making sensitivity adjustments to avoid decisions based on outdated data. When an administrator manually modifies an asset's risk level or sensitivity via the console, the module updates its internal baseline accordingly and may pause automatic adjustments for that asset for a period to prevent conflicts between automated rules and manual intervention. All operations performed by the dynamic adjustment module, including identified anomalies, reasons for sensitivity adjustments, newly calculated vulnerability indices and risk levels, generate detailed audit trails, which are sent to the log audit module for subsequent analysis.

[0069] Example 4: The collaborative operation of the access control module and the log auditing module ensures effective monitoring and restriction of access to information assets. The access control module is primarily responsible for dynamically generating and executing access policies based on the latest risk level of the asset, while the log auditing module is responsible for comprehensively recording and auditing all access activities, forming a closed-loop security management mechanism. To illustrate the implementation, consider an example in an enterprise environment. Suppose a company has an important "customer information database" asset, identified in the system by the unique asset identifier "DB_CUST_2023XYZ". Its initial risk level is assessed as "medium," but due to detected abnormal access attempts, the dynamic adjustment module raises its risk level to "high," triggering a series of actions from the access control module and the log auditing module. Upon receiving an event notification that the risk level of asset "DB_CUST_2023XYZ" has changed to "high," the access control module immediately initiates a process of reclassifying access permission levels. These levels are predefined based on the risk level, with multiple levels such as "strict restriction," "standard operation," and "read-only access" potentially set for high-risk assets. The module first queries the policy configuration library to obtain the default permission template for high-risk database assets. This template specifies details such as the types of operations allowed, access time ranges, and concurrent session limits for each permission level. For example, the "Strict Restriction" level only allows authorized administrators to perform read and write operations during working hours on weekdays and requires multi-factor authentication. Next, the module customizes these rules for the asset "DB_CUST_2023XYZ," further refining access conditions based on the asset's specific attributes, such as storage location and department. For instance, it restricts access source IPs to originate from a specific segment of the company's intranet.

[0070] After defining the permission hierarchy, the access control module begins setting specific access rules for each level. These rules include elements such as time restrictions and operation types. Time restrictions may stipulate that certain operations can only be performed during specific time periods, such as data export operations only being allowed to be executed between 2:00 AM and 4:00 AM during off-peak business hours. Operation type rules explicitly allow or prohibit actions, such as prohibiting anonymous user queries or prohibiting batch deletion operations. The module uses a declarative policy language to define these rules. Rule conditions can be dynamically evaluated based on user roles, device types, and access contexts. For example, allowing finance department users to query customer data during working hours, but prohibiting R&D department users from performing the same operation outside of working hours. These rules are compiled into executable policy fragments and stored in the policy library. Next, the module binds the access rules to the asset identifier "DB_CUST_2023XYZ" to generate dynamic access policies. The binding process is achieved by creating a policy association record, which associates the asset identifier, permission level, and specific rule ID, and marks the effective time and expiration conditions. The generated policies are distributed in real time to access gateways and execution points, such as database firewalls or application authentication middleware. Policy distribution uses an incremental update approach, synchronizing only the changed parts to reduce network overhead. The module also maintains a policy version history for quick rollback when needed. See Table 1 for a simplified example of access permission hierarchy to illustrate permission settings under different risk levels.

[0071] Table 1: Access Permission Hierarchy Based on Risk Level

[0072]

[0073] While the access control module enforces its policies, the log auditing module begins recording access behavior and permission change history for information assets. The access behavior log captures detailed information for each access attempt, including the access timestamp, user identity, executed operation, source IP address, operation result (success or failure), and the version of the access policy in effect at that time. The permission change history records all policy adjustment events triggered by the access control module, such as changes in permission levels due to risk level changes, and manual rule modifications by administrators. These historical entries include the change time, reason for change, executor identity, and policy differences before and after the change. Log data is written to a secure, tamper-proof audit log store. The storage system employs a segmented storage strategy, with recent logs stored in high-speed storage for real-time querying, and historical logs archived in low-cost storage.

[0074] The log auditing module periodically analyzes the compliance of access behavior. This analysis is based on a predefined set of compliance rules, which correspond to the organization's security policies and regulatory requirements. For example, rules might require all write operations to high-risk assets to undergo multi-factor authentication or prohibit data export during non-working hours. The module uses a stream processing engine to examine newly generated log events in real time, matching each event against compliance rules. The matching logic includes pattern recognition and anomaly detection, such as detecting frequent failed login attempts by the same user within a short period or identifying access sources that do not match the user's usual geographical location. The analysis results are used to generate audit reports, which are generated periodically (e.g., daily or weekly), highlighting compliance status, violation statistics, and trend analysis. Anomalies in the audit reports are fed back to the dynamic adjustment module. This feedback mechanism is implemented through an internal message queue. When the log auditing module identifies a serious violation, such as multiple unauthorized access attempts to high-risk assets, it creates an anomaly event record containing event details and the associated asset identifier, and publishes this record to the message bus. The dynamic adjustment module subscribes to these messages. Upon receiving an anomaly, it triggers a reassessment of the key attributes of the relevant assets, potentially increasing the asset's sensitivity level, thereby indirectly influencing subsequent risk assessments and access control policies. This feedback loop enables the system to adaptively respond to security events, forming a self-optimizing protection system. The access control module and the log auditing module need to collaborate efficiently. For example, when the access control module issues a new policy, it simultaneously notifies the log auditing module to record this policy change event, ensuring the integrity of the audit logs. Communication between modules is asynchronous to avoid single points of failure, and all operations are audit traced for forensic analysis in the event of a security incident.

[0075] Example 5: Consider a specific scenario. A financial institution's core "customer credit approval record database" is identified in the system as asset identification code "DB_CREDIT_APP_2024A". Its initial risk level is determined to be "high" by the classification mapping module and risk assessment module. The key attributes of this asset show that its sensitivity is at the highest level, and its daily access frequency is extremely high. This determination triggers specific processing procedures in the backup and recovery module and the encryption management module. The backup and recovery module first formulates a backup strategy based on the "high" risk level of the database. The module has a pre-set backup strategy matrix based on the risk level. For high-risk assets, the strategy requires a combination of daily incremental backups and weekly full backups. The backup window is set between 2:00 AM and 4:00 AM, when business volume is lowest. The module queries the database's metadata, including data size, storage type (such as whether it is a structured database), and change frequency. Based on this, it calculates the estimated time and storage space requirements for each backup and compares them with the current capacity of the backup storage system. Once the strategy is deemed feasible, the module will generate specific backup task instructions. These instructions include the source database connection information (obtained through asset identification code parsing), backup type (incremental or full), target storage location (such as a specific storage pool in an off-site disaster recovery center), and a specific time schedule for task execution.

[0076] These task instructions are submitted to the system's backup job scheduler and queued for execution. During backup task execution, the module monitors its status in real time. For incremental backups, the module identifies data blocks that have changed since the last backup by checking the database's transaction logs or file system change records, and only copies these incremental data to the backup media. This significantly reduces the time required for backups and the network bandwidth consumption. After each successful backup, the module generates a backup verification report, which includes the size of the backup data, the checksum (such as the SHA-256 hash value), and the completion time. The module also associates this backup event with the asset identifier "DB_CREDIT_APP_2024A" and records it in the backup metadata database. The module also periodically performs recovery drills, which involve attempting to restore a small amount of non-critical data from the most recent backup set to the isolated environment to verify the recoverability and integrity of the backup data. The results of these drills are also recorded. The encryption management module works in parallel, receiving input of the key attributes of the asset "DB_CREDIT_APP_2024A," especially its "highest" sensitivity level. Based on preset encryption policy rules, the module selects an encryption algorithm for this type of asset. The decision-making process involves an algorithm selection matrix. For static data stored in the database, the module may select the AES-256-CBC algorithm for encryption. For data that needs to be transmitted over the network during backup, the module may additionally enable the TLS 1.3 protocol for transport layer encryption. Since the asset risk level is "high," the module determines that multiple encryption mechanisms are required. That is, before the data is stored on the disk, an application layer encryption is applied, and then the database management system performs a storage layer encryption on the stored files, forming double protection.

[0077] Key management is the core responsibility of the encryption management module. The module integrates a key management service for generating, storing, rotating, and destroying encryption keys. During initial encryption, the module uses this service to generate a pair of data encryption keys for the asset "DB_CREDIT_APP_2024A," with the master key protected by a hardware security module. The module implements a strict key rotation policy; for such high-risk assets, the policy stipulates that the data encryption key must be rotated every 90 days. The rotation process does not simply re-encrypt all data; instead, it employs an online key rotation technology. First, a new data encryption key is generated. Then, newly added or modified data is gradually encrypted with the new key, while the old key is retained for decrypting historical data. A background process asynchronously re-encrypts historical data with the new key, avoiding prolonged interruptions to the database service. After key rotation is complete, an important step is updating the asset's identifier, as a change in encryption status is considered a significant attribute change for the asset. The encryption management module sends a signal to the asset identification module, triggering it to recalculate the hash value based on the updated asset metadata (including the new key identifier and encryption algorithm version) and generate a new asset identification code, for example, updating from "DB_CREDIT_APP_2024A" to "DB_CREDIT_APP_2024A_VER2". This new identification code updates the association with the asset in the system, ensuring the consistency of the asset identification with the current security state.

[0078] The backup and recovery module and the encryption management module interact closely. When the encryption management module re-encrypts the data, it notifies the backup and recovery module, which then schedules a full backup to ensure the data in the backup storage maintains the same encryption state as the production system. In a data recovery scenario, assuming the monitoring system detects that the "Customer Credit Approval Record Database" in the production environment has suffered partial data corruption due to hardware failure, the backup and recovery module initiates the recovery process. The module first locates the latest valid backup set (including full backups and subsequent incremental backups) for the asset based on its asset identifier. Because the asset's risk level is "high," its recovery request is given the highest priority, and the resource scheduler allocates optimal computing and network resources to accelerate the recovery. During the data recovery process from backup storage to the production environment, the encryption management module ensures that the recovered data can be decrypted and accessed using the correct current version key before being written to production storage, or, if necessary, guides the system to decrypt using the historical key corresponding to the backup before encrypting with the new key. The entire backup, encryption, rotation, and potential recovery process, including all key operational steps, decision-making basis, execution results, and related key operation logs, is recorded in detail and linked to the asset identification code. These logs are ultimately sent to the log audit module for centralized analysis and archiving, forming a complete security audit chain.

[0079] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0080] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A system for managing information assets, characterized by The method comprises the following steps: An asset identification module is used to obtain original attribute data of information assets, and generate an asset identification code according to the type and storage location of the information assets; A classification mapping module is used to extract key attributes of the information assets, and establish an association between the asset identification code and the key attributes; A risk assessment module is used to calculate an asset vulnerability index based on the key attributes of the information assets, and generate a risk level in combination with external threat data; A dynamic adjustment module is used to update the key attributes of the information assets according to the change of the risk level, and recalculate the asset vulnerability index; An access control module is used to generate an access permission strategy according to the updated asset vulnerability index, and limit the access behavior to the information assets; The implementation mode of the risk assessment module comprises the following steps: Attack frequency and vulnerability exploitation difficulty data in an external threat database are obtained; The exposure degree of the information assets is calculated in combination with the comprehensive score of the key attributes; The calculation of the exposure degree of the information assets in combination with the comprehensive score of the key attributes comprises the following steps: The calculation process takes the comprehensive score of the key attributes as a basic input, and simultaneously integrates the attack frequency data of the current external threat environment against the type of the information assets and the exploitation difficulty of the known vulnerabilities related to the assets, and fuses the three-dimensional information of the comprehensive score of the key attributes, the attack frequency and the vulnerability exploitation difficulty through internal calculation logic to generate a quantitative exposure degree index; A risk level is generated according to the matching result of the exposure degree and the external threat data; The implementation mode of the dynamic adjustment module comprises the following steps: The use log of the information assets is monitored to identify abnormal access behavior, the sensitivity level of the key attributes is adjusted according to the frequency of the abnormal access behavior, the asset vulnerability index is recalculated, and the risk level is updated; The implementation mode of the classification mapping module comprises the following steps: The sensitivity and use frequency of the information assets are extracted from the standardized attribute fields; The sensitivity and use frequency are divided into multiple level intervals, and a weight coefficient is assigned to each level interval; The comprehensive score of the key attributes is calculated according to the weight coefficient, and the comprehensive score is stored in association with the asset identification code.

2. The system for management of information assets as claimed in claim 1 wherein, The implementation mode of the asset identification module comprises the following steps: The metadata of the information assets, including the creation time, modification record and storage path, are collected; The metadata is normalized to generate standardized attribute fields; The hash value is calculated according to the standardized attribute fields, and the hash value is combined with the type code of the information assets to form the asset identification code.

3. The system for management of information assets as claimed in claim 1 wherein, The access control module is implemented by the following method: The access permission hierarchy is divided according to the updated risk level; Access rules, including time limit and operation type, are set for each permission hierarchy; The access rules are bound to the asset identification code to generate a dynamic access strategy.

4. The system for management of information assets as claimed in claim 1 wherein, Further comprising a log audit module for: Recording the access behavior and permission change history of the information assets; Analyzing the compliance of the access behavior to generate an audit report; Feeding the abnormal events in the audit report to the dynamic adjustment module.

5. The system for management of information assets as claimed in claim 4 wherein, Further comprising a backup recovery module for: Formulating a backup frequency according to the risk level of the information assets, performing incremental backup on the information assets of high risk level, and preferentially recovering the information assets of high risk level when data damage is detected.

6. The system for management of information assets as claimed in claim 5 wherein, Further comprising an encryption management module for: According to the key attributes of information assets, encryption algorithms are selected, multiple encryption is enabled for information assets with high risk levels, encryption keys are regularly rotated, and asset identification codes are updated.

7. An information asset protection strength evaluation method characterized by comprising: Comprise: Step one: According to the asset identification code generated by the asset identification module, the original attribute data of the information asset is extracted, and the key attribute correlation relationship established by the classification mapping module is combined to calculate the basic protection value of the information asset; Step two: Based on the risk level generated by the risk assessment module, the potential impact of external threats on information assets is quantified, and a threat intensity coefficient is generated; Step three: The basic protection value and the threat intensity coefficient are weighted and fused to generate a real-time protection strength score for the information asset; Step four: According to the asset vulnerability index updated by the dynamic adjustment module, the calculation weight of the basic protection value is adjusted, and the comprehensive evaluation module is triggered to regenerate the real-time protection strength score.

Images