Dynamic access control method and system based on permission graph calculation and policy switching

Abstract

The application relates to a dynamic access control method and system based on a permission graph calculation and policy switching, and relates to the field of electric digital data processing.The method comprises the following steps: taking an operation relationship in a permission graph network and a historical access abnormality statistical score as training data, constructing a user access behavior analysis model, verifying a permission range of a token in a target resource access request initiated by a target user carrying the token when the target resource access request is received, transforming target access request information into a target access request vector if the permission range verification is passed, inputting the target access request vector into the user access behavior analysis model to obtain a risk score, and adjusting an access permission of the target user according to the risk score. The method can improve the effectiveness of resource access control.

Description

Technical Field

[0001] This application relates to the field of electronic digital data processing, and in particular to a dynamic access control method and system based on permission graph calculation and policy switching. Background Technology

[0002] With the rapid development of enterprise network environments, dynamic access control has become a crucial requirement in the field of network security. Under the zero-trust security concept, resource access in enterprise network environments requires more granular and real-time permission management to address increasingly complex security threats.

[0003] Currently, role-based access control (RBAC) is commonly used in enterprise network environments to manage resource access. This mechanism controls access by pre-configuring static role-based permission rules and setting up a circuit breaker mechanism based on threshold statistics at the gateway level, while also performing access auditing through traditional logging methods.

[0004] However, with the increase in concurrent access volume and the increasing complexity of access patterns in enterprise network environments, the above-mentioned technical solutions have significant shortcomings in practical applications. Because static role-based access control configurations cannot promptly reflect the dynamic changes in user access behavior, the system cannot accurately identify abnormal access behavior, easily leading to a decline in the effectiveness of resource access control. Summary of the Invention

[0005] This application provides a dynamic access control method and system based on permission graph calculation and policy switching to improve the effectiveness of resource access control.

[0006] Firstly, this application provides a dynamic access control method based on permission graph calculation and policy switching, applied to a dynamic access control system. The method includes: setting user identifiers in the access control system as user nodes, user-held access credentials as token nodes, and controlled resources as resource nodes; constructing connection edges based on the operational relationships between user nodes, token nodes, and resource nodes, and marking historical access anomaly statistical scores on the connection edges to form a permission graph network; using the operational relationships and historical access anomaly statistical scores in the permission graph network as training data to construct a user access behavior analysis model. The model input of this user access behavior analysis model is a combination of features including real-time access request information and historical access behavior baseline features. The real-time access request vector includes the resource identifier, access time, and access frequency of the requested access; the model output of this user access behavior analysis model is a risk score for the access behavior; when a target user initiates a target resource access request carrying a token, the permission scope of the token in the target resource access request is verified; if the permission scope verification passes, the target access request information is converted into a target access request vector, and the target access request vector is input into the user access behavior analysis model to obtain a risk score; and the access permissions of the target user are adjusted according to the risk score.

[0007] In the above embodiments, the permission graph network built based on users, tokens, and resource nodes records operation relationships and historical anomaly statistical scores, providing complete training data for the user access behavior analysis model. This enables the model to extract access features from access request vectors. When a user initiates an access request, the model analyzes the request in real time and outputs a risk score. Combined with permission scope verification, this achieves accurate evaluation of user access behavior, thereby ensuring the accuracy of resource access control and improving the effectiveness of dynamic access control in enterprise-level network environments.

[0008] In conjunction with some embodiments of the first aspect, in some embodiments, the steps of setting user identifiers in the access control system as user nodes, user-held access credentials as token nodes, controlled resources as resource nodes, constructing connection edges based on the operational relationships between user nodes, token nodes, and resource nodes, and marking historical access anomaly statistical scores on the connection edges to form a permission graph network specifically include: obtaining a set of user identifiers, a set of access credentials, and a set of resource identifiers in the access control system; constructing each user identifier in the user identifier set as a user node, each access credential in the access credential set as a token node, and each resource identifier in the resource identifier set as a resource node; extracting historical access credential information and historical access resource information of the user identifier within a specified time window from the system's historical access logs, and establishing a first type of connection between user nodes and token nodes based on the historical access credential information. The system establishes a second type of connection edge between token nodes and resource nodes based on historical access resource information. It performs time-dimensional analysis on each access record in the historical access log, calculating the access time entropy value for each user identifier. This access time entropy value is used as the initial weight of the corresponding first type of connection edge, representing the dispersion of user access time. It also performs resource-dimensional analysis on each access record in the historical access log, calculating the resource access entropy value for each access credential. This resource access entropy value is used as the initial weight of the corresponding second type of connection edge, representing the divergence of token access to resources. Based on a time window, it periodically calculates the access time entropy value on the first type of connection edge and the resource access entropy value on the second type of connection edge. The calculated access time entropy value and resource access entropy value are used as the historical access anomaly statistical score for the corresponding connection edge, resulting in the permission graph network.

[0009] In the above embodiments, the system first obtains a set of user identifiers, access credentials, and resource identifiers from the access control system to establish initial nodes. Then, it constructs connection edges between users and tokens and between tokens and resources based on historical access logs. Next, it calculates the access time entropy value and the resource access entropy value as the initial weights of the edges. The system periodically updates these entropy values ​​as anomaly statistical scores, forming a permission graph network structure that quantifies the degree of abnormal access behavior. This provides a precise basis for subsequent access control decisions, enabling the access control system to have fine-grained abnormal behavior identification capabilities.

[0010] In conjunction with some embodiments of the first aspect, in some embodiments, the step of constructing a user access behavior analysis model using operational relationships and historical access anomaly statistical scores in a permission graph network as training data specifically includes: obtaining the connection edges between user nodes, token nodes, and resource nodes in the permission graph network; extracting the historical access anomaly statistical scores on each connection edge; mapping the operational relationships and the historical access anomaly statistical scores of the connection edges into edge feature vectors; calculating the set of one-hop neighbor nodes for each user node in the permission graph network; calculating the deviation measure between the real-time access request vector and the historical access behavior features in the corresponding edge feature vector to obtain time deviation features and frequency deviation features; constructing a node embedding layer of a graph neural network based on the connection relationships, operational relationships, and deviation features of nodes in the set of one-hop neighbor nodes, with the output dimension of the node embedding layer being a preset dimension; sequentially connecting a graph convolutional layer and a fully connected layer after the node embedding layer; aggregating and updating node features through the graph convolutional layer; and outputting a risk score for access behavior through the fully connected layer; and training the graph neural network to obtain the user access behavior analysis model based on pre-labeled normal access logs and abnormal access logs, using the historical access anomaly statistical scores as part of the model input features.

[0011] In the above embodiments, the operational relationships and anomaly statistical scores in the permission graph network are mapped to edge feature vectors. An embedding layer of the graph neural network is constructed based on the connection relationships of one-hop neighbor nodes, and the node features are aggregated and updated through graph convolutional layers. The system uses historical access anomaly statistical scores as model input features to train the graph neural network, establishing an analytical model that can adaptively learn access behavior patterns. This enables real-time risk assessment of access requests, giving the access control system a dynamic and adaptive risk identification capability.

[0012] In conjunction with some embodiments of the first aspect, in some embodiments, the step of adjusting the access permissions of the target user based on the risk score specifically includes: comparing the risk score with a preset first threshold and a preset second threshold, wherein the preset first threshold is less than the preset second threshold; when the risk score is less than the preset first threshold, searching for a token node connected to the target user node in the permission graph network, allowing the target user to access the target resource using the current token; when the risk score is not less than the preset first threshold and less than the preset second threshold, obtaining the permission policy status of the token node, marking the permission policy status as a downgraded state, updating the permission policy library corresponding to the token node in the permission graph network to a low-permission policy library, and performing permission verification on the target user's subsequent access requests based on the low-permission policy library; when the risk score is not less than the preset second threshold, obtaining the permission policy status of the token node, marking the permission policy status as a circuit breaker state, updating the permission policy library corresponding to the token node in the permission graph network to an empty permission policy library, and interrupting all subsequent access requests of the target user's current session.

[0013] In the above embodiments, the permission policy status of the token node is adjusted in stages based on the comparison results of the risk score and two preset thresholds. When the risk is low, normal access is maintained; when the risk is medium, it is downgraded to a low permission policy library; and when the risk is high, it switches to an empty permission policy library and interrupts the current session. The system achieves precise control over user access permissions through dynamic switching of the permission policy library, enabling the access control system to have adaptive permission management capabilities based on risk levels.

[0014] In conjunction with some embodiments of the first aspect, in some embodiments, after adjusting the access permissions of the target user based on the risk score, the method further includes: extracting session identification information from historical access logs and storing the session identification information in the attribute field of the connection edge between the user node and the token node; when the risk score is not less than a preset second threshold, obtaining the set of tokens currently held by the target user and extracting the session identification information associated with the token set from the attribute field of the connection edge; determining the target session that caused the abnormal access based on the session identification information and marking the token node corresponding to the target session as a circuit breaker state; and maintaining the status of other token nodes of the target user other than the target session unchanged.

[0015] In the above embodiments, session identification information is extracted from historical access logs and stored in the connection edge attribute field between user nodes and token nodes. When high-risk access is detected, the system obtains the set of tokens currently held by the user and their associated session information. Based on this session-level association, the system accurately locates and isolates abnormal access, marking only the token corresponding to the target session that caused the abnormality as a circuit breaker, thus enabling the access control system to achieve precise session-level control over abnormal access.

[0016] In conjunction with some embodiments of the first aspect, in some embodiments, the step of determining the target session that generated abnormal access based on session identification information specifically includes: extracting the historical access paths of the target user to the target resource through the target session; constructing an access path subgraph in the permission graph network based on the historical access paths; calculating the path risk score of the target session based on the access path subgraph, wherein the path risk score includes node access frequency and edge jump probability; comparing the path risk score with the statistical baseline of the historical access paths to determine the degree of abnormality of the target session, and determining the target session that generated abnormal access based on the degree of abnormality.

[0017] In the above embodiments, the historical access paths of the target session are extracted and an access path subgraph is constructed. A path risk score, including node access frequency and edge jump probability, is calculated. The system compares the path risk score with a statistical baseline to determine the degree of anomaly. Based on the degree of anomaly, the system identifies the target session that caused the anomaly and performs circuit breaker processing. This establishes an anomaly session identification mechanism based on access path characteristics, enabling the access control system to have path-level analysis capabilities for anomaly access.

[0018] In conjunction with some embodiments of the first aspect, in some embodiments, after adjusting the access permissions of the target user based on the risk score, the method further includes: setting a predetermined time window and recording user access operations in the access control system within the predetermined time window; storing the user access operations in a structured manner according to access time, user identifier, access credentials, access resources, and access results; calculating statistical characteristics of user access behavior within the predetermined time window based on the structured access logs; and updating the baseline data of the historical access logs according to the statistical characteristics of user access behavior.

[0019] In the above embodiments, user access operations are recorded and stored in a structured manner within a predetermined time window. Statistical characteristics of access behavior within the window are calculated, and the baseline data of historical access logs is updated. Through this time-window-based incremental baseline update mechanism, the system achieves dynamic tracking and baseline adjustment of user access behavior patterns, enabling the access control system to maintain baseline characteristics through adaptive evolution.

[0020] In a second aspect, embodiments of this application provide a dynamic access control system, which includes: one or more processors and a memory; the memory is coupled to the one or more processors, and the memory is used to store computer program code, which includes computer instructions, and the one or more processors call the computer instructions to cause the dynamic access control system to perform the method described in the first aspect and any possible implementation thereof.

[0021] Thirdly, embodiments of this application provide a computer program product containing instructions that, when the computer program product is run on a dynamic access control system, cause the dynamic access control system to perform the method described in the first aspect and any possible implementation thereof.

[0022] Fourthly, embodiments of this application provide a computer-readable storage medium including instructions that, when executed on a dynamic access control system, cause the dynamic access control system to perform the method described in the first aspect and any possible implementation thereof.

[0023] Understandably, the dynamic access control system provided in the second aspect, the computer program product provided in the third aspect, and the computer storage medium provided in the fourth aspect are all used to execute the methods provided in the embodiments of this application. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods, and will not be repeated here.

[0024] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages:

[0025] 1. This application records operational relationships and historical anomaly statistical scores through a permission graph network constructed based on users, tokens, and resource nodes, providing complete training data for the user access behavior analysis model. This enables the model to extract access features from access request vectors. When a user initiates an access request, the model analyzes the request in real time and outputs a risk score. Combined with permission scope verification, it achieves accurate evaluation of user access behavior, thereby ensuring the accuracy of resource access control and improving the effectiveness of dynamic access control in enterprise-level network environments.

[0026] 2. This application first establishes initial nodes by obtaining user identifiers, access credentials, and resource identifiers from the access control system. Then, it constructs connection edges between users and tokens and between tokens and resources based on historical access logs. Next, it calculates access time entropy and resource access entropy as the initial weights of the edges. The system periodically updates these entropy values ​​as anomaly statistical scores, forming a permission graph network structure that quantifies the degree of abnormal access behavior. This provides a precise basis for subsequent access control decisions, enabling the access control system to have fine-grained abnormal behavior identification capabilities.

[0027] 3. This application maps the operational relationships and anomaly statistical scores in the permission graph network into edge feature vectors, constructs an embedding layer of the graph neural network based on the connection relationships of one-hop neighbor nodes, and aggregates and updates node features through graph convolutional layers. The system uses historical access anomaly statistical scores as model input features to train the graph neural network, establishing an analytical model that can adaptively learn access behavior patterns, realizing real-time risk assessment of access requests, and enabling the access control system to have dynamic and adaptive risk identification capabilities. Attached Figure Description

[0028] Figure 1 This is a flowchart illustrating a dynamic access control method based on permission graph calculation and policy switching in an embodiment of this application.

[0029] Figure 2 This is another flowchart illustrating the dynamic access control method based on permission graph calculation and policy switching in the embodiments of this application;

[0030] Figure 3This is a schematic diagram of the physical device structure of a dynamic access control system in the embodiments of this application. Detailed Implementation

[0031] The terminology used in the following embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. As used in the specification of this application, the singular expressions “a,” “an,” “the,” “the,” and “this” are intended to include the plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this application refers to any or all possible combinations including one or more of the listed items.

[0032] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature, and in the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0033] To facilitate understanding, the application scenarios of the embodiments of this application are described below.

[0034] In a large enterprise's internal network environment, with the increasing demand for distributed work, employees need to remotely access various resources on the enterprise intranet, including code repositories, document systems, and databases. The enterprise has adopted a zero-trust security architecture, requiring strict permission verification for each resource access request. However, due to the dynamic and complex nature of access patterns, the system faces three main challenges: First, users may use different types of tokens (such as temporary tokens and long-term tokens) to access resources at different times, requiring rapid adjustment of permission boundaries based on token type; second, when abnormal access is detected, it is necessary to accurately locate the specific abnormal session and implement circuit breaking to avoid affecting other normal user access; finally, in high-concurrency access scenarios, a large number of permission verifications and audit log recordings lead to increased system response latency, affecting overall business efficiency. These problems make traditional static permission management solutions insufficient to meet the enterprise's security needs.

[0035] In a certain enterprise network environment, the system uses a traditional Role-Based Access Control (RBAC) scheme for permission management. When a developer needs to access the code repository, the system first checks their statically configured role permission rules. For example, junior developers are configured to only access the code repository of a specific project, while senior developers can access multiple projects. When abnormal access is detected, the system uses a circuit breaker mechanism based on a fixed threshold; for example, if a user fails to access the repository more than 10 times within 5 minutes, the circuit breaker is triggered. This scheme has significant problems: First, static role permissions cannot adapt to users' access needs in different scenarios, such as when a developer temporarily needs to access the code of another project, the permission configuration needs to be manually modified; second, the circuit breaker mechanism based on a fixed threshold may incorrectly block normal access, such as when multiple projects are being developed in parallel, causing high-frequency access within a short period of time to be misjudged as abnormal; finally, the audit logs generated by each access need to be written to the database in real time, causing a serious performance bottleneck in high-concurrency scenarios.

[0036] In an enterprise network environment employing this invention, the system first constructs a permission graph network containing users, tokens, and resource nodes. For example, when a developer logs into the system for the first time, connections are established in the permission graph between the user node and its held token node, as well as connections between the token node and its accessible code repository resource nodes. The system uses a graph neural network (GNN) model to analyze these connections and marks the edges with statistical scores of historical access anomalies. When a developer initiates an access request, the system verifies the token's validity using ECDSA and quickly switches the corresponding permission policy library based on the session status bit in the token metadata (0 indicates a temporary session, 1 indicates a regular session). Simultaneously, the GNN model calculates the risk score of the access path in real time. When the score of a session exceeds a preset threshold (e.g., 0.85), the system only circuit breaks the abnormal session without affecting other normal accesses by the user. The permission verification results are directly written to the kernel DMA buffer via memory mapping and then asynchronously batch-written to the audit database via the event bus, keeping log latency within the range of 35-50 milliseconds. This approach not only enables millisecond-level permission adjustments and precise session-level circuit breaking, but also significantly improves the system's processing capabilities in high-concurrency scenarios.

[0037] To facilitate understanding, the method provided in this implementation will be described in detail below, using the above scenario as an example. Please refer to [link / reference]. Figure 1 This is a flowchart illustrating a dynamic access control method based on permission graph calculation and policy switching in an embodiment of this application.

[0038] S101. Set the user identifier in the access control system as the user node, set the access credentials held by the user as the token node, set the controlled resource as the resource node, construct the connection edge based on the operation relationship between the user node, token node and resource node, and mark the historical access anomaly statistics score on the connection edge to form a permission graph network.

[0039] In this system, user nodes represent uniquely identified user entities registered in the access control system; token nodes are access credentials held by users to verify their identity and permissions, which can be temporary or long-term tokens; resource nodes represent various protected resources in the system that require access control, such as code repositories and document systems; operation relationships refer to the types of user access behaviors to resources, including reading, writing, and execution; historical access anomaly statistics score represents the risk assessment value calculated based on historical access records; and the permission graph network is a directed graph structure composed of these nodes and edges, used to represent the access control relationships of the entire system.

[0040] This step is performed during the system initialization phase and is used to build the basic access control network structure. Specifically, the system first obtains the identity information of all registered users from the user management module and maps them to user nodes in the graph; then it obtains all valid access credential information from the authentication center and creates corresponding token nodes; simultaneously, it obtains the list of protected resources from the resource management module and establishes resource nodes. The system analyzes historical access logs, extracts the access relationships between users, tokens, and resources, establishes connecting edges between the corresponding nodes accordingly, and calculates the historical anomaly score for each edge. This information about nodes and edges is organized into a complete access control graph network structure, providing the foundation for subsequent dynamic access control.

[0041] In some embodiments, the permission graph network can be constructed in several ways: Optionally, an adjacency matrix storage structure can be used. First, three node sets are created to store user nodes, token nodes, and resource nodes respectively. Then, a sparse matrix is ​​used to represent the connection relationships between nodes, and the matrix element values ​​record the anomaly statistics score. The graph is constructed and updated through matrix operations. Optionally, a linked adjacency list structure can be used. Each node maintains a linked list containing information about its neighboring nodes. The linked list nodes contain attributes such as the target node ID, edge type, and anomaly statistics score. The graph is constructed and maintained through dynamic linked list operations. It is understood that other data structures can also be used to implement the storage and management of the permission graph network, and no limitation is made here.

[0042] In some embodiments, this step specifically includes:

[0043] Obtain the user identifier set, access credential set, and resource identifier set from the access control system. Construct each user identifier in the user identifier set into a user node, each access credential in the access credential set into a token node, and each resource identifier in the resource identifier set into a resource node.

[0044] Among them, the user identifier set refers to the set of unique identifiers for all registered users in the system; the access credential set contains all valid access tokens; the resource identifier set contains the unique identifiers for all accessible resources in the system; and a node is the basic unit in the permission graph network, containing identification information and attribute data.

[0045] The system performs node construction operations for the permission graph network. Specifically, it first retrieves a list of all active user identifiers from the user management system, constructing a set of user nodes. Each user node contains attribute fields such as user ID, user type, and creation time. Then, it retrieves a list of all valid access credentials from the token management system, constructing a set of token nodes. Each token node contains attribute fields such as token ID, expiration time, and permission level. Next, it retrieves a list of all resource identifiers from the resource management system, constructing a set of resource nodes. Each resource node contains attribute fields such as resource ID, resource type, and access control policy. The system uses an efficient graph data structure to store these nodes and creates an index for each type of node to support fast lookup.

[0046] Extract historical access credentials and historical access resource information of the user identifier within a specified time window from the system's historical access logs. Establish a first type of connection edge between the user node and the token node based on the historical access credentials information, and establish a second type of connection edge between the token node and the resource node based on the historical access resource information.

[0047] Among them, the historical access log stores all access records in the system; the specified time window indicates the time range for analysis; the first type of connection edge represents the association between users and tokens; and the second type of connection edge represents the access relationship between tokens and resources.

[0048] The system performs edge construction operations on the permission graph network. Specifically, it first queries the access log database for all access records within a specified time window. For each record, the system extracts the user identifier and the corresponding access credential information, finds the corresponding user node and token node in the permission graph network, and creates a first-type connection edge between them, which includes attributes such as first use time and most recent use time. Then, it extracts the resource information accessed by the access credential, finds the corresponding token node and resource node in the graph, and creates a second-type connection edge between them, which includes attributes such as access count and access type. The system uses an adjacency list structure to store the information of these edges, supporting fast graph traversal operations.

[0049] Perform time-dimensional analysis on each access record in the historical access log, calculate the access time entropy value of each user identifier, and use the access time entropy value of each user identifier as the initial weight of the corresponding first type of connection edge. This access time entropy value is used to characterize the dispersion of user access time.

[0050] Among them, the access time entropy value is an application of the concept of information entropy, used to measure the uncertainty of the distribution of user access time; the initial weight represents the importance of the edge; and the degree of dispersion reflects the regularity of user access time.

[0051] The system performs time-based access behavior analysis. Specifically, it first statistically analyzes each user's access records hourly to obtain a 24-hour access frequency distribution. Then, it calculates the access time entropy value using the information entropy formula: H = -∑(pi*log2(pi)), where pi represents the probability of access in the i-th hour. For example, if user access is concentrated during working hours (9:00-17:00), then pi is larger during these time periods, while pi is close to 0 during other time periods, resulting in a smaller calculated entropy value, indicating that the access time is regular. Conversely, if the access time distribution is uniform, the calculated entropy value is larger, indicating that the access time is more random. The system uses the calculated entropy value as the weight of the connection edge between user nodes and token nodes, providing an important basis for subsequent anomaly detection.

[0052] Resource dimension analysis is performed on each access record in the historical access log, and the resource access entropy value of each access credential is calculated. The resource access entropy value of each access resource is used as the initial weight of the corresponding second type of connection edge. This resource access entropy value is used to characterize the degree of divergence of token access to resources.

[0053] Among them, resource dimension analysis refers to statistical analysis from the perspective of accessing resources; resource access entropy value is an information entropy index describing the distribution of access credentials to resources; divergence degree indicates the centralized or decentralized state of the scope of access token use; second type of connection edge represents the access relationship between token node and resource node; initial weight refers to the basic importance value of the edge.

[0054] The system performs a quantitative analysis of resource access patterns. Specifically, it first groups the records of each access credential in the historical access log by resource ID and counts the number of accesses to each resource. Then, it converts the number of accesses into an access probability distribution. For resource i, its access probability qi = number of accesses to that resource / total number of accesses. Next, it uses the information entropy formula to calculate the resource access entropy value: H = -∑(qi*log2(qi)), where i ranges from 1 to the total number of resources. For example, if the resource access records of a certain access credential show that resource A was accessed 50 times, resource B was accessed 30 times, and resource C was accessed 20 times, then qA = 0.5, qB = 0.3, and qC = 0.2. Substituting these values ​​into the formula, we get H = -(0.5log2(0.5) + 0.3log2(0.3) + 0.2*log2(0.2)) = 1.485. The calculated entropy value is used as the weight value of the connection edge between the access credential and each resource node. The entropy value is smaller when access is concentrated on a few resources and larger when access is dispersed, which directly reflects the scope of use of access credentials.

[0055] The access time entropy value of the first type of connection edge and the resource access entropy value of the second type of connection edge are calculated periodically based on the time window. The calculated access time entropy value and resource access entropy value are used as the historical access anomaly statistical scores of the corresponding connection edge to obtain the permission graph network.

[0056] Among them, the time window represents a fixed time period for statistical analysis; the access time entropy value describes the dispersion of user access time distribution; the resource access entropy value represents the breadth of access credentials usage; and the historical access anomaly statistical score is an anomaly metric calculated based on entropy values.

[0057] The system performs dynamic maintenance of the permission graph network. Specifically, it first recalculates the access time entropy value of each first-type connection edge at preset time intervals (e.g., 1 hour). The calculation method involves statistically analyzing the user's access distribution over a 24-hour time slot to obtain the access probability pi for each time slot, and then substituting this probability into the entropy formula H = -∑(pi * log2(pi)). Simultaneously, it calculates the resource access entropy value of each second-type connection edge by statistically analyzing the access probability distribution qi of the token for each resource and substituting this probability into the same entropy formula. For each edge, the currently calculated entropy value is compared with the mean and standard deviation of its historical entropy values, and a standardized score Z = (current entropy value - historical mean) / standard deviation is calculated. This Z score is the historical access anomaly statistical score for that edge; a higher score indicates a more anomalous current access pattern. The system then updates the corresponding edge's attribute fields with the updated entropy value, anomaly statistical score, and calculation timestamp, completing a dynamic update of the permission graph network.

[0058] S102. Using the operation relationships in the permission graph network and the historical access anomaly statistical scores as training data, construct a user access behavior analysis model. The model input of the user access behavior analysis model is a combination of features including real-time access request information and historical access behavior baseline features. The real-time access request vector includes the resource identifier, access time and access frequency of the requested access. The model output of the user access behavior analysis model is the risk score of the access behavior.

[0059] Among them, training data refers to the sample set of historical access records used for model learning; real-time access request information represents the specific content of the access request initiated by the current user; historical access behavior baseline features refer to the statistical characteristics of the user's past access behavior; combined features are used to represent the feature vector after combining real-time requests with historical baselines; risk score refers to the model's risk assessment result of access behavior, and the value range is usually between 0 and 1.

[0060] This step is performed after the permission graph network is built, and its purpose is to establish an analytical model capable of assessing access risks in real time. Specifically, the system first extracts the operational relationships between nodes and the anomaly statistical scores on edges from the permission graph network, converting this data into a feature matrix suitable for machine learning. Then, a graph neural network-based model structure is constructed. This model receives input containing access request information (such as resource ID, access time, access frequency, etc.) and user historical behavior characteristics, and outputs a score representing the degree of access risk after processing through multiple layers of neural networks.

[0061] In some embodiments, the user access behavior analysis model can be constructed in several ways: Optionally, a Graph Attention Network (GAT) structure can be used. First, self-attention computation is performed on node features to obtain node representations. Then, neighbor node information is aggregated through a multi-head attention mechanism. Finally, a risk score is output through a fully connected layer. This approach can adaptively focus on important access patterns. Optionally, a Graph Convolutional Network (GCN) structure can be used. Node features are aggregated and transformed by defining special graph convolution operators. Then, pooling layers are used for dimensionality reduction. Finally, a classification layer outputs the risk prediction result. It is understood that other deep learning model architectures can also be used to implement access behavior risk assessment; this is not limited here.

[0062] In some embodiments, this step specifically includes:

[0063] Obtain the connection edges between user nodes, token nodes, and resource nodes in the permission graph network, extract the historical access anomaly statistics score on each connection edge, and map the operation relationship and the historical access anomaly statistics score of the connection edge into edge feature vectors.

[0064] Among them, the connecting edge represents the association between nodes; the historical access anomaly statistical score is the quantitative value of the anomaly degree recorded on the edge; the operation relationship refers to the operation type of the access credential on the resource; and the edge feature vector is the numerical representation of the edge attributes.

[0065] The system constructs edge feature vectors. Specifically, it first traverses all edges in the permission graph network, extracting the historical access anomaly statistics score for each edge. Then, it performs one-hot encoding on the operation relationships, for example, encoding read, write, and execute operations as [1, 0, 0], [0, 1, 0], and [0, 0, 1], respectively. Next, it concatenates the encoded vector of the operation relationship with the historical access anomaly statistics score to form a complete edge feature vector. For example, if an edge's operation type is read and its anomaly statistics score is 0.8, then its edge feature vector is [1, 0, 0, 0.8]. In this way, the system uniformly converts the discrete and continuous attributes on the edges into numerical vector form, facilitating subsequent machine learning processing.

[0066] For each user node in the permission graph network, calculate its one-hop neighbor node set, calculate the deviation measure between the real-time access request vector and the historical access behavior features in the corresponding edge feature vector, and obtain the time deviation feature and frequency deviation feature. Based on the connection relationship, operation relationship and deviation feature of the nodes in the one-hop neighbor node set, construct the node embedding layer of the graph neural network. The output dimension of the node embedding layer is a preset dimension.

[0067] Among them, the set of one-hop neighbor nodes refers to the nodes directly connected to the target node; the real-time access request vector represents the characteristics of the current access operation; the deviation metric represents the degree of difference between real-time behavior and historical patterns; and the node embedding layer is the input layer of the graph neural network.

[0068] The system performs node feature extraction and embedding operations. First, for each user node, it traverses the graph to obtain its directly connected token nodes and resource nodes, forming a one-hop neighbor set. Then, it calculates the deviation between the time and frequency features of the current access request and historical behavior: the time deviation feature is calculated as |current access time - historical average access time| / historical access time standard deviation; the frequency deviation feature is calculated as |current time window access count - historical average access count| / historical access count standard deviation. Next, the node connectivity is represented as an adjacency matrix A, and the operational relationships and deviation features form a feature matrix X, which is input to the node embedding layer. This layer uses a trainable parameter matrix W to transform the input features into an embedding space of a preset dimension d: H = XW, where H is the node embedding representation.

[0069] After the node embedding layer, a graph convolutional layer and a fully connected layer are sequentially connected. The graph convolutional layer aggregates and updates the node features, while the fully connected layer outputs a risk score for the access behavior.

[0070] Among them, the graph convolutional layer is a network layer that performs message passing and feature aggregation; the fully connected layer is a network layer that maps high-dimensional features to scalar scores; and the risk score is the model's evaluation of the degree of risk of access behavior.

[0071] The system performs feature propagation and risk assessment operations on the neural network. First, graph convolution is applied to the output of the node embedding layer. The calculation formula for each layer is: H(l+1)=σ(D^(-1 / 2)AD^(-1 / 2)H(l)W(l)), where D is the degree matrix, σ is the activation function, and W(l) is the weight matrix of the l-th layer. Through multiple layers of graph convolution, the system captures the higher-order neighborhood information of the nodes. Then, the output of the graph convolution layer is passed through a fully connected layer for dimensionality reduction, finally outputting a risk score between 0 and 1. The calculation formula for the fully connected layer is: score=sigmoid(W_fc*H_gcn+b), where W_fc is the weight matrix, b is the bias term, and H_gcn is the output feature of the graph convolution layer. This score reflects the risk level of the current access behavior; a higher score indicates a greater risk.

[0072] Based on pre-labeled normal access logs and abnormal access logs, a graph neural network is trained using historical abnormal access statistical scores as part of the model input features to obtain a user access behavior analysis model.

[0073] Among them, the pre-labeled normal access logs refer to the set of historical access records that have been confirmed as legitimate and secure by manual or automated tools, including fields such as user ID, access time, and operation type; the abnormal access logs represent the set of historical access records that have been identified as having security risks, recording risky behaviors such as unauthorized access and abnormal operations; the historical access anomaly statistical score is the attribute value of the edge in the permission graph network, reflecting the degree of abnormality of the access behavior; the graph neural network is a deep learning model that learns the representation of nodes in graph structure data through a message passing mechanism; the user access behavior analysis model is a risk assessment component deployed in the access control system, which receives real-time access requests and outputs risk assessment scores.

[0074] The system performs model training, constructing training samples from the labeled dataset. First, normal access logs and abnormal access logs are divided into training and validation sets in an 8:2 ratio. For each training sample, the local subgraph structure of the user node is extracted, including token nodes and resource nodes directly connected to the user. Historical access anomaly statistical scores are obtained from the edges connecting these nodes, and concatenated with the one-hot encoded vector of the operation type to form edge features. The graph neural network is trained using the Adam optimizer with a learning rate of 0.001 and a batch size of 128. In each training batch, the model performs the following calculations: mapping the original features to a 64-dimensional embedding space through a node embedding layer, followed by feature aggregation through two graph convolutional layers with output dimensions of 32 and 16 respectively, using ReLU activation. Finally, a risk score between 0 and 1 is output through a fully connected layer with a sigmoid activation function. Binary cross-entropy is used as the loss function: Loss = -∑(y*log(p) + (1-y)*log(1-p)), where y is the true label and p is the predicted probability. An early stopping mechanism is triggered when the AUC metric on the validation set fails to improve for five consecutive epochs. After training, the model parameters are saved in a format loadable by the production environment.

[0075] S103. When a target user sends a request to access a target resource with a token, the scope of permissions of the token in the request is verified.

[0076] Here, the target user refers to the specific user entity that initiates the current access request; the token is an access credential provided by the user for authentication, which may contain information such as the scope of permissions and the validity period; the target resource access request represents the specific resource operation that the user wishes to access; and the permission scope verification refers to the matching check between the permission scope declared in the token and the requested operation.

[0077] This step is executed when the system receives a user's access request to verify its legitimacy. Specifically, when a user initiates resource access through a system interface, the system first parses the token information carried in the request and extracts the permission declaration portion. Then, this permission information is compared with the target resource and operation type requested to check whether the user has the basic permissions to perform the operation. This verification process includes checking the token's validity period, signature integrity, and whether the permission scope covers the requested operation.

[0078] In some embodiments, token permission scope verification can be implemented in several ways: Optionally, an ECDSA-based asymmetric encryption verification scheme can be used. First, the validity of the token signature is verified using the system public key. Then, the permission declaration field in the token payload is parsed and matched against a predefined permission mapping table. Finally, it is checked whether the target operation is within the allowed permission set. Optionally, a multi-level permission check mechanism based on RBAC can be used. First, the role information in the token is parsed. Then, the role permission mapping table is queried to obtain the allowed operation set. Finally, it is verified whether the requested operation meets the permission requirements. It is understood that other cryptographic or access control models can also be used to implement token permission verification, which is not limited here.

[0079] S104. If the permission scope verification is successful, the target access request information is converted into a target access request vector, and the target access request vector is input into the user access behavior analysis model to obtain a risk score.

[0080] Among them, the target access request information represents the detailed content of the specific access operation currently initiated by the user; the target access request vector refers to the standardized feature vector converted from the request information; and the risk score represents the risk level of the current access operation as assessed by the model, which is used for subsequent access control decisions.

[0081] This step is executed after the token permission scope verification is successful, and its purpose is to perform a more granular risk assessment of the access request. Specifically, the system first extracts various types of information from the request (such as access time, resource identifier, operation type, etc.) and converts them into standardized feature vectors through feature engineering. Then, this feature vector is input into a previously trained user access behavior analysis model. The model combines the user's historical access patterns and the current access context to calculate a score representing the level of risk.

[0082] In some embodiments, risk assessment of access requests can be implemented in several ways: Optionally, a feature mapping method can be used, where discrete attributes (such as resource ID and operation type) in the request information are first one-hot encoded, continuous attributes (such as timestamps) are normalized, and then these features are concatenated into a fixed-dimensional vector, which is then input into the model to obtain a risk prediction value. Optionally, a sequence modeling method can be used, where the user's most recent N access requests are organized into a sequence in chronological order, and a recurrent neural network is used to process the features of this sequence, combining them with the features of the current request to calculate a risk score. It is understood that other feature processing and model inference methods can also be used to implement risk assessment of access requests, and this is not limited here.

[0083] S105. Adjust the access permissions of target users based on risk scores.

[0084] Among them, the risk score represents the model's risk assessment result for the current access request, and the value range is usually between 0 and 1; access control adjustment refers to the dynamic modification of the user's access capabilities according to the risk level; preset threshold refers to the risk level classification standard predefined by the system, which is used to determine different permission adjustment strategies; permission policy status represents the current token's permission control level, including normal, downgraded, and circuit breaker states.

[0085] This step is executed immediately after the access risk score is obtained, enabling risk-based dynamic access control. Specifically, the system first compares the calculated risk score with a preset risk threshold and selects an appropriate access control strategy based on the comparison result. When the risk score is low, the user's normal access rights are maintained; when the risk score is at a medium level, the user's permissions are downgraded to a more restricted range; when the risk score exceeds the high-risk threshold, a circuit breaker mechanism is triggered, temporarily suspending access rights for the relevant session. This risk-based dynamic adjustment mechanism can maintain system availability to the greatest extent while ensuring security.

[0086] In some embodiments, risk-score-based access control can be implemented in several ways: Optionally, a multi-level access control policy switching scheme can be adopted. First, three risk thresholds (low, medium, and high) are set. Then, the corresponding access control policy library is selected based on the risk score's range. Next, the thread-local policy pointer is updated through atomic operations. Finally, the new access control rules are applied for access control. This approach can achieve millisecond-level access control response. Optionally, a session-based fine-grained control scheme can be used. First, the specific session generating high risk is identified. Then, access control or circuit breaking is applied only to that session, while maintaining the access permissions of other normal user sessions. Finally, the access control status is synchronized to all gateway nodes through a distributed cache. This approach can achieve precise session-level control and avoid excessive blocking of normal access. It is understood that other access control strategies can also be used to implement risk-based dynamic access control, which is not limited here.

[0087] After the permission adjustment is executed, the system also asynchronously writes the relevant operation records to the audit log. Specifically, the system uses zero-copy technology to directly write the permission adjustment event to the kernel buffer, and then asynchronously batch persists it to the audit database through the event bus mechanism. This method can significantly reduce system overhead and improve concurrency processing capabilities while ensuring log integrity. The end-to-end latency of the entire permission adjustment process, from risk assessment to policy switching, can usually be controlled at the millisecond level, meeting real-time requirements.

[0088] In some embodiments, this step specifically includes:

[0089] The risk score is compared with a preset first threshold and a preset second threshold, where the preset first threshold is less than the preset second threshold. When the risk score is less than the preset first threshold, a token node connected to the target user node is found in the permission graph network, allowing the target user to access the target resource using the current token. When the risk score is not less than the preset first threshold and less than the preset second threshold, the permission policy status of the token node is obtained, the permission policy status is marked as downgraded, the permission policy library corresponding to the token node in the permission graph network is updated to a low-permission policy library, and permission verification is performed on subsequent access requests of the target user based on the low-permission policy library.

[0090] The risk score is a risk assessment value for access behavior, ranging from 0 to 1, where 0 represents the safest and 1 represents the most dangerous. The preset first threshold and second threshold are two risk level division points set by the system, such as 0.3 and 0.7. The permission graph network is a graph structure describing the relationship between users, tokens, and resources. Token nodes represent access credential entities. The permission policy status indicates the current permission control mode. A downgraded state indicates that stricter access control is enabled. The low-permission policy library contains a set of restricted access permission rules. For example, a complete application system's permissions include read, write, and execute; a downgraded low-permission system only retains read operations. Permission verification refers to determining the legitimacy of an access request based on the policy rules.

[0091] The system implements tiered access control. First, it obtains a risk score calculated by the user access behavior analysis model and compares it with two preset thresholds. When the risk score is below the first threshold, it indicates that the current access behavior is within the normal range. The system uses a depth-first search in the permission graph network to find all directly connected token nodes starting from the target user node. After confirming that the currently used token is among these nodes, the access operation is allowed to continue. When the risk score is between the two thresholds, the system performs defensive degradation: first, it reads the permission policy status field of the token node and updates it to a degraded status flag; then, it searches the permission policy database for the low-privilege policy configuration corresponding to the token, which typically only retains necessary read-only permissions; finally, it points the permission policy associated with the token to the low-privilege policy library. Afterward, all access requests for this token must be matched against low-privilege policy rules: the system reads the operation type in the request and compares it with the set of allowed operations in the policy rules, allowing the request only if the operation type matches exactly. This mechanism proactively tightens access control when risk signs are detected, reducing the system's exposure surface. Specific permission downgrade actions include: updating the permission policy status field value to "degraded", switching the policy library reference pointer, and refreshing the permission cache. In addition, the system records the timestamp, triggering reason, and scope of impact of the policy downgrade event for subsequent audit analysis.

[0092] When the risk score is not less than the preset second threshold, obtain the permission policy status of the token node, mark the permission policy status as circuit breaker status, update the permission policy library corresponding to the token node in the permission graph network to an empty permission policy library, and interrupt all subsequent access requests of the target user's current session.

[0093] Among them, the preset second threshold is the highest dividing point of risk level; exceeding this value indicates that the access behavior has a serious risk. The permission policy status is an attribute field of the token node, recording the current policy execution mode. The circuit breaker status indicates a control mode that completely blocks access. The empty permission policy library is a policy set that does not contain any permission rules, used to completely prohibit access. The user's current session refers to the access connection established after the user logs in this time. Subsequent access requests include all operation requests that have not yet been executed and will be initiated in the current session. For example, if a user establishes a session using token A and performs multiple operations, when a high risk is detected, all incomplete operations and newly initiated operations in that session will be rejected.

[0094] The system executes access circuit breaker processing. First, it determines whether the risk score reaches or exceeds a preset second threshold. If the condition is met, the circuit breaker process is initiated: Step 1: Locate the currently used token node in the permission graph network and read the value of its permission policy status field; Step 2: Update the value of this field to "circuit_breaker", indicating that the token has entered the circuit breaker state; Step 3: Modify the token node's permission policy library reference, pointing it to an empty permission policy library with an empty set of allow_rules; Step 4: Find all active access requests based on the current session ID, call the session manager's interrupt interface, and return a "403 Forbidden" response for each request; Step 5: Mark the current session as terminated, prohibiting the session from initiating new access requests. This mechanism addresses high-risk scenarios by immediately cutting off access permissions. Specific actions include updating policy status values, switching policy library configurations, forcibly terminating the session, and clearing the request queue. The circuit breaker operation simultaneously records the trigger time, risk score, and affected sessions for subsequent analysis and sends circuit breaker event notifications via a message queue.

[0095] In some embodiments, assuming an enterprise-level network environment, after system startup, an initial permission graph is first constructed, containing nodes of all users, tokens, and resources, as well as the permission relationship edges between them. The weight of each edge is initialized with historical anomaly scores. Next, the GNN model is warmed up, and a policy library containing two sets of RBAC policies—one for non-login and one for login—is loaded. When the system receives a user's request, it first performs ECDSA asymmetric key verification to confirm the token's validity. Subsequently, the session state bit of the token is parsed. If the session state bit is 0, the "non-login policy library" is loaded; if it is 1, the "login policy library" is loaded. After successful verification, the system writes the "user-token-resource" information to the graph update stream in real time, performs forward propagation through the GNN, and calculates the risk score of the path. If the score exceeds 0.85 (a configurable threshold), the system immediately sends a circuit breaker command to the session manager, interrupting all subsequent requests for that session, achieving a millisecond-level response. Meanwhile, the permission verification result structure is directly mapped to the kernel DMA buffer through memory mapping technology. It is then asynchronously consumed by the event bus and written to the audit database in batches. The latency of each log is controlled between 35 and 50 milliseconds, which effectively reduces CPU usage and ensures the system throughput in high-concurrency scenarios.

[0096] The following provides a more detailed description of the process of the method provided in this implementation. Please refer to [link / reference]. Figure 2 This is another flowchart illustrating the dynamic access control method based on permission graph calculation and policy switching in this application embodiment.

[0097] S201. Compare the risk score with a preset first threshold and a preset second threshold, wherein the preset first threshold is less than the preset second threshold.

[0098] Among them, the risk score represents the risk value of the access operation evaluated by the model, which is usually a floating-point number between 0 and 1; the preset first threshold and the preset second threshold refer to two risk judgment standard values ​​predefined by the system to distinguish different risk levels. For example, 0.6 can be set as the first threshold and 0.85 as the second threshold; the comparison operation refers to dividing the risk level into three intervals: low, medium and high, by judging the numerical value.

[0099] After receiving the risk score output by the user access behavior analysis model, the system immediately performs a three-value comparison operation. Specifically, it first reads two preset risk thresholds from the system configuration, which have been verified and loaded during system initialization. Then, using standard numerical comparison operations, the risk score is compared with these two thresholds. Through this comparison, the risk level is divided into three intervals: low risk (less than the first threshold), medium risk (between the two thresholds), and high risk (greater than or equal to the second threshold). This dual-threshold-based comparison method provides a more granular risk classification, providing a basis for subsequent differentiated access control.

[0100] S202. When the risk score is less than the preset first threshold, find the token node connected to the target user node in the permission graph network and allow the target user to access the target resource using the current token.

[0101] In this context, the permission graph network represents the directed graph structure of users, tokens, and resource nodes and their relationships in the system; a token node is an access credential node associated with the target user; the target resource represents the specific resource object that the user requests to access; and granting access means granting the user the permission to operate on the target resource.

[0102] When the risk score is in the low-risk range, the system executes the normal access authorization process. Specifically, it first locates the target user node in the permission graph network, and then searches for all token nodes directly connected to that user node through graph traversal. For the token used in the current request, its connection status and attribute information in the graph are verified. After confirmation, the system maintains the current permission policy of the token and marks it as allowed in the access control list. In this way, the user can continue to use the token for normal resource access operations, and the system will not impose additional restrictions on its permission scope. For example, when a developer uses a valid token to access a code repository, and the risk score of this access behavior is 0.3 (less than the first threshold of 0.6), the system will maintain the full permissions of the token, allowing the developer to perform operations such as reading and committing code.

[0103] S203. When the risk score is not less than a preset first threshold and less than a preset second threshold, obtain the permission policy status of the token node, mark the permission policy status as a downgraded state, update the permission policy library corresponding to the token node in the permission graph network to a low permission policy library, and perform permission verification on subsequent access requests of the target user based on the low permission policy library.

[0104] Among them, the permission policy status indicates the current permission control level of the token; the downgraded status refers to a restricted permission configuration; the low permission policy library represents a set of restricted access control rules; and subsequent access requests refer to resource access operations initiated by the user in the current session.

[0105] When the risk score falls into the medium-risk range, the system initiates a permission downgrade mechanism. Specifically, it first retrieves the current policy state of the target token node from the permission graph network and then updates its status to a downgraded state. Next, the system switches the permission policy library associated with that token node to a pre-configured low-permission version. This low-permission policy library defines a set of restricted access rules, such as retaining only read permissions while disabling write operations, or restricting the scope of accessible resources. After the switch is complete, all subsequent access requests from that user will be verified using the new low-permission policy library. This mechanism effectively reduces potential security risks while maintaining basic access capabilities. For example, when a developer's access risk score is 0.7, the system downgrades their permissions to read-only mode, allowing them to view code but prohibiting them from submitting changes, until the risk level decreases or an administrator intervenes manually.

[0106] S204. When the risk score is not less than the preset second threshold, obtain the permission policy status of the token node, mark the permission policy status as circuit breaker status, update the permission policy library corresponding to the token node in the permission graph network to an empty permission policy library, and interrupt all subsequent access requests of the target user's current session.

[0107] Among them, the circuit breaker state indicates that the token is completely disabled; the empty permission policy library refers to a set of permission rules that does not contain any permitted operations; the current session refers to the access session established after the user logs in this time; subsequent access requests refer to all resource operation requests initiated in this session.

[0108] When the system detects high-risk access behavior, it immediately executes the circuit breaker protection mechanism. Specifically, it first obtains the current state information of the target token node in the permission graph network and updates its state marker to the circuit breaker state. Then, it replaces the permission policy library associated with the token node with an empty permission policy library, which does not contain any allowed operation permissions. Next, the system searches for the currently active session associated with the token in the session manager, sends an interrupt command to the session manager, and forcibly terminates all access operations under that session. At the same time, the system records the circuit breaker event information in the security audit log, including detailed information such as trigger time, risk score, and session identifier. This mechanism can quickly cut off the access channel when high-risk access is detected, preventing potential security threats from escalating. For example, when the access risk score of a token reaches 0.9, the system immediately interrupts all operation permissions of that token, preventing any further resource access attempts.

[0109] In some embodiments, to address the technical challenge of immediately suspending a single session rather than the entire service when an abnormal permission request occurs, a two-layer token verification protocol combined with GNN dynamic analysis is employed to achieve precise session-level circuit breaking. After system startup, not only is an initial permission graph constructed, but the GNN model parameters are also warmed up and the RBAC policy library is loaded. When the gateway receives a request, it first uses the ECDSA algorithm for asymmetric key verification to validate the token's validity. Then, it parses the 32nd bit of the token's metadata—the session state identifier—loads the corresponding RBAC policy library based on its value (0 / 1), and quickly replaces the thread-local policy pointer through atomic operations to ensure the immediacy of permission adjustments. Based on this, by updating the graph structure in real time and using GNN to calculate path risk scores, once the score exceeds a predetermined threshold, a circuit breaker command is immediately sent to the session manager, suspending only the abnormal session without affecting the operation of other normal sessions, thus achieving precise session-level circuit breaking.

[0110] S205. Extract session identification information from historical access logs and store the session identification information in the attribute field of the connection edge between the user node and the token node.

[0111] Among them, the historical access log represents the user access operation records recorded by the system; the session identification information refers to the identifier used to uniquely identify the user login session; the attribute fields of the connection edges represent the data structure on the edges in the permission graph network that can store additional information; the connection edges between user nodes and token nodes represent the association between the user and the access credentials they hold.

[0112] The system performs session information association operations during the construction and updating of the permission graph network. Specifically, it first queries and extracts relevant records of user login sessions from the system's historical access log database, including session creation time, session identifier, and associated token information. Then, it locates the connection edge between the corresponding user node and token node in the permission graph network and writes the extracted session identifier information into the attribute field of that connection edge. This attribute field is stored in key-value pairs, where the key is the session identifier and the value contains detailed session information. In this way, the system establishes a mapping between user sessions and node relationships in the permission graph network, providing data support for subsequent precise session control.

[0113] S206. When the risk score is not less than the preset second threshold, obtain the set of tokens currently held by the target user, and extract the session identifier information associated with the token set from the attribute field of the connection edge.

[0114] Among them, the set of tokens currently held by the target user represents the set of all valid access credentials currently held by the user; the attribute fields of the connection edge store session-related metadata; and the session identification information is used to uniquely identify different user access sessions.

[0115] Upon detecting high-risk access, the system performs session information extraction. Specifically, it first obtains a list of all valid tokens currently held by the target user from the user authentication center, forming a token set. Then, it locates the nodes corresponding to these tokens in the permission graph network, as well as the edges connecting them to the user node. Next, the system iterates through the attribute fields of these edges to extract the stored session identification information. For each token, the system reads its associated session identifier, session creation time, session state, and other information, which is used for subsequent precise session control. For example, when a user holds multiple valid tokens simultaneously, the system can accurately identify which session generated the high-risk access, thereby achieving precise session-level control.

[0116] S207. Extract the historical access paths of the target user to the target resource through the target session.

[0117] Here, the target session refers to the specific user access session that needs to be analyzed; the historical access path refers to the time sequence of the user's access to each resource node in the session; the target resource refers to the system resource that the user requested to access; and the access path includes the sequence of accessed resource nodes and the transfer relationships between them.

[0118] The system extracts access records for a specific session from the access log database and reconstructs the access path. Specifically, it first retrieves all access records for that session in the access log table using the session identifier and sorts them by timestamp. Then, these access records are converted into access sequences for resource nodes, with each record containing information such as the access time, resource identifier, and operation type. The system records the transfer relationships between adjacent resource nodes, including the time interval and frequency of transfers. This forms a complete session access path, reflecting the user's resource access behavior patterns within that session. For example, for a developer's session, the access path might be: code repository → configuration center → deployment system → monitoring platform; this sequence demonstrates the developer's typical workflow within the system.

[0119] S208. Construct an access path subgraph in the permission graph network based on the historical access paths.

[0120] The access path subgraph represents a local graph structure related to a specific access path extracted from the complete permission graph network; the subgraph construction operation refers to the process of selecting relevant nodes and edges based on historical access paths.

[0121] Based on the extracted historical access paths, the system constructs corresponding local subgraph structures within the permission graph network. Specifically, firstly, all resource nodes involved in the access path are marked as the vertex set of the subgraph. Then, direct connecting edges between these resource nodes are found in the permission graph network and added to the subgraph. For each edge, the system retains its original attribute information, such as historical access anomaly statistics scores. Simultaneously, the system also includes user nodes and their corresponding token nodes within the subgraph, establishing a complete access path structure. In this way, the system obtains a local graph structure containing the complete context of user access behavior, providing a data foundation for subsequent risk analysis.

[0122] S209. Calculate the path risk score of the target session based on the access path subgraph, where the path risk score includes node access frequency and edge jump probability.

[0123] Among them, node access frequency represents the statistical value of the number of times a user accesses a certain resource node per unit time; edge jump probability refers to the conditional probability of a user moving from one resource node to another; path risk score is a comprehensive risk assessment value calculated based on these statistical characteristics.

[0124] The system performs risk assessment calculations based on the constructed access path subgraph. Specifically, it first calculates the access frequency for each resource node in the subgraph, using the formula: the number of times the node is accessed in a session divided by the session duration. Then, it calculates the jump probability between adjacent nodes, by dividing the number of direct transfers from node A to node B by the total number of transfers initiated from node A. For example, if a user initiates 100 transfers from the code repository, with 30 of them to the configuration center, the jump probability for this edge is 0.3. Next, the system calculates the path risk score using a weighted summation method: it adds the access frequency deviation of each node (the difference from the historical average frequency) to the jump probability deviation of each edge. A larger deviation indicates a more abnormal current access pattern. The node frequency has a weight of 0.4, and the edge jump probability has a weight of 0.6, resulting in a path risk score between 0 and 1. This score reflects the degree to which the current session's access behavior deviates from historical normal patterns.

[0125] S210. Compare the path risk score with the statistical baseline of historical access paths to determine the degree of abnormality of the target session. Based on the degree of abnormality, determine the target session that caused the abnormal access and mark the token node corresponding to the target session as a circuit breaker state.

[0126] Among them, the statistical baseline represents the normal behavior pattern characteristics of historical access paths; the degree of abnormality refers to the degree to which the current path risk score deviates from the statistical baseline; the circuit breaker status represents the access permission status of completely disabling the token; and the token node corresponding to the target session refers to the access credential node associated with the abnormal session.

[0127] The system performs anomaly detection and handling operations based on statistical baselines. Specifically, it first reads the statistical characteristics of the user's historical access paths from the system's baseline database, including the mean and standard deviation of path risk scores. Then, it calculates the difference between the current path risk score and the baseline mean, and divides the difference by the standard deviation to obtain a standardized anomaly score. When the anomaly score exceeds a preset anomaly threshold (usually set to 3 standard deviations), the system determines that the session has generated abnormal access. For sessions determined to be abnormal, the system locates the token node associated with the session in the permission graph network, updates its status field to the circuit breaker status, and records the timestamp and triggering reason of the status change in the token status table. This anomaly detection method based on statistical significance can accurately identify access sessions that deviate from normal behavior patterns.

[0128] S211. Maintain the status of other token nodes for the target user, excluding the target session.

[0129] Among them, other token nodes represent all access credential nodes currently held by the target user, excluding tokens associated with abnormal sessions; node status includes three states: normal, downgraded, and circuit breaker; unchanged status means maintaining the original permission policy configuration.

[0130] The system performs precise token state management. Specifically, it first obtains the set of all token nodes directly connected to the target user node in the permission graph network. Then, it excludes the token nodes corresponding to the target session that have been marked as abnormal from this set. For the remaining token nodes, the system maintains their current state value and permission policy configuration unchanged, ensuring that these tokens continue to operate according to the original permission rules. This precise state management mechanism avoids impacting other normal user sessions, achieving precise circuit breaking of abnormal sessions, ensuring both security and maximizing system availability.

[0131] S212. Set a predetermined time window and record user access operations in the access control system within the predetermined time window.

[0132] The scheduled time window represents a fixed time period set by the system for observing and recording user access behavior; user access operations include information such as resource access requests, permission verification results, and operation execution status.

[0133] The system establishes a sliding time window to collect and record access behavior data. Specifically, the size of the time window is first set in the system configuration, typically ranging from 5 to 60 minutes, with the specific value determined based on business scenarios and performance requirements. Then, the system starts a dedicated logger that writes all access operations occurring within the window to a high-performance log buffer in real time. The recorded content includes: the timestamp of the access, user ID, session ID, requested resource ID, operation type, and permission verification result. The system uses a circular buffer structure to store these records; when the buffer is full, the oldest record is overwritten by the newest record. These records are used for both real-time anomaly detection and as a data source for subsequent updates to the statistical baseline.

[0134] S213. Store user access operations in a structured manner according to access time, user ID, access credentials, access resources, and access results.

[0135] Among them, access time represents the precise timestamp of the operation; user identifier refers to the user's unique identification number; access credential refers to the token information used for authentication; access resource refers to the requested system resource; access result includes the execution status of the operation and the return code; structured storage refers to organizing and storing data according to a predefined pattern.

[0136] The system performs structured processing and storage operations on access logs. Specifically, the raw access operation logs are first parsed into a standard data structure, with each record containing fixed fields: millisecond-level timestamp, user ID, token ID, resource ID, operation type, response status code, etc. Then, a distributed columnar storage engine is used to store this structured data, storing similar fields in adjacent locations to achieve efficient column-level compression and fast conditional queries. The system builds composite indexes on these fields, supporting fast retrieval based on time range, user identifier, and resource identifier. Simultaneously, the system uses a partitioned storage strategy, managing data in partitions according to the time dimension, ensuring both query performance and facilitating data lifecycle management.

[0137] S214. Based on the access logs stored in structured memory, calculate the statistical characteristics of user access behavior within a predetermined time window.

[0138] Among them, statistical features represent a set of quantitative indicators of user access behavior, including feature values ​​of multiple dimensions such as access frequency, resource distribution, and time pattern.

[0139] The system performs statistical analysis based on access logs stored in structured memory. Specifically, it first counts the total number of accesses for each user within a predetermined time window, calculating the average access interval and standard deviation. Then, it analyzes the access frequency distribution for each resource, calculating the entropy value of resource access to measure the degree of access dispersion. For access time-series characteristics, the system calculates periodic indicators of user access, including hourly access density distributions. Simultaneously, the system calculates the distribution characteristics of operation types, such as the ratio of read / write operations and the conversion probability of different operation types. For each statistical indicator, the system calculates its mean, variance, quantiles, and other statistical measures within the current time window, forming a complete feature vector.

[0140] S215. Update the baseline data of historical access logs based on the statistical characteristics of user access behavior.

[0141] Baseline data represents the statistical benchmark values ​​of users' historical access behavior stored in the system; update operation refers to dynamically adjusting the baseline data using new statistical features.

[0142] The system performs incremental updates to the baseline data. Specifically, it first reads the current baseline data from the baseline database, including the historical mean and variance of each statistical feature. Then, it calculates the new baseline value using an exponential moving average algorithm, with the formula: New baseline value = α × Current window statistic + (1-α) × Historical baseline value, where α is a smoothing factor, typically between 0.1 and 0.3. For each statistical feature, the system updates its baseline mean and variance. For example, for the access frequency feature, if the historical baseline value is 100 visits per hour, the current window statistic is 120 visits, and α is 0.2, the updated baseline value is 104 visits per hour. The system also updates the variance of the feature for subsequent anomaly detection. After the update is complete, the system persists the new baseline data to the baseline database and records the update timestamp. This incremental baseline update mechanism allows the system to adapt to slow changes in user access behavior while maintaining sensitivity to sudden anomalies.

[0143] In some embodiments, to further address the technical challenges of optimizing the audit log writing process, reducing log latency and CPU overhead, and improving system throughput, a zero-copy log acquisition technique is employed, combined with an event bus mechanism, to achieve efficient and low-latency log recording. During system startup, in addition to constructing the permission graph and loading the policy library, a memory mapping region and a DMA buffer are pre-configured. Once the permission verification result is generated, its structure is directly mapped to the kernel DMA buffer via mmap operations, avoiding data copying from kernel mode to user mode and reducing CPU load. The event bus (based on the eBPF ring buffer) is responsible for asynchronously consuming these permission verification results and writing them in batches to the audit database, thereby keeping log latency at an extremely low level, reducing peak CPU utilization by 40%, and effectively improving system throughput.

[0144] The dynamic access control system in the embodiments of this invention is described below from the perspective of hardware processing. Please refer to [link / reference needed]. Figure 3 This is a schematic diagram of the physical device structure of a dynamic access control system in an embodiment of this application.

[0145] It should be noted that, Figure 3 The structure of the dynamic access control system shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0146] like Figure 3 As shown, the dynamic access control system includes a Central Processing Unit (CPU) 301, which can perform various appropriate actions and processes based on programs stored in Read-Only Memory (ROM) 302 or programs loaded from storage section 308 into Random Access Memory (RAM) 303, such as performing the methods described in the above embodiments. The RAM 303 also stores various programs and data required for system operation. The CPU 301, ROM 302, and RAM 303 are interconnected via a bus 304. An Input / Output (I / O) interface 305 is also connected to the bus 304.

[0147] The following components are connected to I / O interface 305: input section 306 including audio input devices, push-button switches, etc.; output section 307 including a liquid crystal display (LCD) and audio output devices, indicator lights, etc.; storage section 308 including a hard disk, etc.; and communication section 309 including a network interface card such as a LAN (Local Area Network) card, modem, etc. Communication section 309 performs communication processing via a network such as the Internet. Drive 310 is also connected to I / O interface 305 as needed. Removable media 311, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 310 as needed so that computer programs read from them can be installed into storage section 308 as needed.

[0148] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing computer programs for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 309, and / or installed from removable medium 311. When the computer program is executed by central processing unit (CPU) 301, it performs the various functions defined in the present invention.

[0149] It should be noted that specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0150] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. Each block in a flowchart or block diagram may represent a module, program segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those shown in the drawings.

[0151] Specifically, the dynamic access control system of this embodiment includes a processor and a memory. The memory stores a computer program. When the computer program is executed by the processor, it implements the dynamic access control method based on permission graph calculation and policy switching provided in the above embodiment.

[0152] In another aspect, the present invention also provides a computer-readable storage medium, which may be included in the dynamic access control system described in the above embodiments; or it may exist independently and not incorporated into the dynamic access control system. The storage medium carries one or more computer programs that, when executed by a processor of the dynamic access control system, cause the dynamic access control system to implement the dynamic access control method based on permission graph calculation and policy switching provided in the above embodiments.

[0153] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

[0154] As used in the above embodiments, depending on the context, the term "when..." can be interpreted as meaning "if...", "after...", "in response to determining...", or "in response to detecting...". Similarly, depending on the context, the phrase "when determining..." or "if (the stated condition or event) is interpreted as meaning "if determining...", "in response to determining...", "when (the stated condition or event) is detected", or "in response to detecting (the stated condition or event)".

[0155] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes described in the above method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM or random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A dynamic access control method based on permission graph calculation and policy switching, characterized in that, Applied to a dynamic access control system, the method includes: In the access control system, user identifiers are set as user nodes, access credentials held by users are set as token nodes, and controlled resources are set as resource nodes. Connection edges are constructed based on the operational relationships between the user nodes, token nodes, and resource nodes, and historical access anomaly statistics scores are marked on the connection edges to form a permission graph network. Using the operational relationships in the permission graph network and the historical access anomaly statistical scores as training data, a user access behavior analysis model is constructed. The model input of the user access behavior analysis model is a combination of features including real-time access request information and historical access behavior baseline features. The real-time access request information includes the resource identifier, access time, and access frequency of the requested access. The model output of the user access behavior analysis model is a risk score of the access behavior. When a target user sends a target resource access request with a token, the token in the target resource access request is verified for its permission scope. If the permission scope verification passes, the target access request information is converted into a target access request vector, and the target access request vector is input into the user access behavior analysis model to obtain a risk score. The risk score is compared with a preset first threshold and a preset second threshold, wherein the preset first threshold is less than the preset second threshold; When the risk score is less than the preset first threshold, the token node connected to the target user node is found in the permission graph network, and the target user is allowed to access the target resource using the current token; When the risk score is not less than the preset first threshold and less than the preset second threshold, the permission policy status of the token node is obtained, the permission policy status is marked as a downgraded status, the permission policy library corresponding to the token node is updated to a low permission policy library in the permission graph network, and permission verification is performed on the subsequent access requests of the target user based on the low permission policy library. When the risk score is not less than the preset second threshold, the permission policy status of the token node is obtained, the permission policy status is marked as a circuit breaker status, the permission policy library corresponding to the token node is updated to an empty permission policy library in the permission graph network, and all subsequent access requests of the target user's current session are interrupted.

2. The method according to claim 1, characterized in that, The steps of setting user identifiers in the access control system as user nodes, user-held access credentials as token nodes, controlled resources as resource nodes, constructing connection edges based on the operational relationships between user nodes, token nodes, and resource nodes, and marking historical access anomaly statistics scores on the connection edges to form a permission graph network specifically include: Obtain the user identifier set, access credential set, and resource identifier set from the access control system; construct each user identifier in the user identifier set as a user node; construct each access credential in the access credential set as a token node; and construct each resource identifier in the resource identifier set as a resource node. Extract the user's historical access credentials and historical access resource information within a specified time window from the system's historical access logs, and establish a first type of connection edge between the user node and the token node based on the historical access credentials information, and establish a second type of connection edge between the token node and the resource node based on the historical access resource information. Perform time dimension analysis on each access record in the historical access log, calculate the access time entropy value of each user identifier, and use the access time entropy value of each user identifier as the initial weight of the corresponding first type of connection edge. The access time entropy value is used to characterize the dispersion of user access time. Resource dimension analysis is performed on each access record in the historical access log, and the resource access entropy value of each access credential is calculated. The resource access entropy value of each access resource is used as the initial weight of the corresponding second type of connection edge. The resource access entropy value is used to characterize the degree of divergence of token access resources. The access time entropy value of the first type of connection edge and the resource access entropy value of the second type of connection edge are periodically calculated based on the time window. The calculated access time entropy value and the resource access entropy value are used as the historical access anomaly statistical score of the corresponding connection edge to obtain the permission graph network.

3. The method according to claim 1, characterized in that, The step of constructing a user access behavior analysis model using the operational relationships in the permission graph network and the historical access anomaly statistical scores as training data specifically includes: Obtain the connection edges between user nodes, token nodes and resource nodes in the permission graph network, extract the historical access anomaly statistical score on each connection edge, and map the operation relationship and the historical access anomaly statistical score of the connection edge into an edge feature vector. For each user node in the permission graph network, calculate its one-hop neighbor node set, calculate the deviation measure between the real-time access request vector and the historical access behavior baseline feature in the corresponding edge feature vector, and obtain the time deviation feature and frequency deviation feature. Based on the connection relationship, operation relationship and deviation feature of the nodes in the one-hop neighbor node set, construct the node embedding layer of the graph neural network. The output dimension of the node embedding layer is a preset dimension. After the node embedding layer, a graph convolutional layer and a fully connected layer are sequentially connected. The graph convolutional layer aggregates and updates the node features, and the fully connected layer outputs a risk score for the access behavior. Based on pre-labeled normal access logs and abnormal access logs, the graph neural network is trained using the historical abnormal access statistical scores as part of the model input features to obtain a user access behavior analysis model.

4. The method according to claim 2, characterized in that, After the step of adjusting the access permissions of the target user based on the risk score, the method further includes: Extract session identification information from the historical access logs and store the session identification information in the attribute field of the connection edge between the user node and the token node; When the risk score is not less than the preset second threshold, obtain the set of tokens currently held by the target user, and extract the session identifier information associated with the token set from the attribute field of the connection edge; Based on the session identification information, the target session that caused the abnormal access is determined, and the token node corresponding to the target session is marked as circuit breaker state. Maintain the status of all token nodes for the target user other than the target session.

5. The method according to claim 4, characterized in that, The step of determining the target session that caused the abnormal access based on the session identifier information specifically includes: Extract the historical access paths of the target user to the target resource through the target session; Based on the historical access paths, an access path subgraph is constructed in the permission graph network; The path risk score of the target session is calculated based on the access path subgraph, wherein the path risk score includes node access frequency and edge jump probability; The path risk score is compared with the statistical baseline of the historical access path to determine the degree of abnormality of the target session, and the target session that caused the abnormal access is determined based on the degree of abnormality.

6. The method according to claim 2, characterized in that, After the step of adjusting the access permissions of the target user based on the risk score, the method further includes: Set a predetermined time window and record user access operations in the access control system within the predetermined time window; The user access operations are stored in a structured manner according to access time, user identifier, access credentials, access resources, and access results; Based on the structured access logs, calculate the statistical characteristics of user access behavior within the predetermined time window; The baseline data of the historical access logs is updated based on the statistical characteristics of the user access behavior.

7. A dynamic access control system, characterized in that, The dynamic access control system includes: one or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code including computer instructions, and the one or more processors call the computer instructions to cause the dynamic access control system to perform the method as described in any one of claims 1-6.

8. A computer-readable storage medium comprising instructions, characterized in that, When the instruction is executed on the dynamic access control system, it causes the dynamic access control system to perform the method as described in any one of claims 1-6.

9. A computer program product, characterized in that, When the computer program product is run on the dynamic access control system, it causes the dynamic access control system to perform the method as described in any one of claims 1-6.

Images