Security management system for data access control
By employing a data access control method based on hierarchical parsing and spatial modeling, the issues of flexibility and accuracy in permission management under complex data resource structures are addressed. This enables adaptive adjustment of permission policies, thereby enhancing the security and availability of data access control.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- BEIJING ZHONGCHUANG HAISHENG TECHNOLOGY CO LTD
- Filing Date
- 2026-01-08
- Publication Date
- 2026-04-17
- Estimated Expiration
- Not applicable · inactive patent
AI Technical Summary
Existing data access control methods are ill-suited to adapting to dynamically changing access needs and environments. In particular, under complex data resource structures with multiple levels and dimensions, the flexibility and accuracy of permission management are insufficient, leading to rigid permission policies that affect data security and system availability.
By hierarchically parsing resource identifiers and spatially modeling user access behavior, dynamic access permission policies are generated. Combined with risk space construction and baseline permission modeling, real-time adjustments to user behavior and resource characteristics are achieved, generating adaptive permission policies.
It improves the adaptability and accuracy of access control, reduces the subjectivity and blindness of access allocation, lowers the risk of data leakage, and enhances access efficiency and user experience. It is applicable to various data resource structures and access log formats.
Smart Images
Figure CN121881384A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of data security management technology, specifically a data access control security management system. Background Technology
[0002] With the continuous development of information technology, the management and protection of data resources has become a significant challenge for enterprises and organizations. Traditional data access control methods are mainly based on static permission allocation, such as discretionary access control (DAC) and mandatory access control (MAC). These methods typically rely on pre-defined permission rules and are difficult to adapt to dynamically changing access needs and environments. Role-based access control (RBAC) models link users and permissions through roles, improving the flexibility of permission management to some extent, but they still cannot effectively cope with application scenarios with complex resource hierarchies and varied access behaviors.
[0003] With the widespread application of big data, cloud computing, and distributed systems, the structure of data resources is becoming increasingly complex, exhibiting multi-level and multi-dimensional characteristics. For example, enterprise data resources may be organized according to multiple dimensions such as departments, projects, and security levels, showing obvious hierarchical characteristics. At the same time, user access behavior also shows certain spatial distribution patterns; for example, some users frequently access resources at specific levels or categories, while rarely venturing into other areas. Existing access control mechanisms lack in-depth analysis of resource hierarchy characteristics and fail to effectively utilize the spatial distribution information contained in users' historical access behavior, resulting in overly rigid permission policies that cannot achieve fine-grained dynamic adjustments.
[0004] Furthermore, while some existing dynamic access control schemes attempt to incorporate environmental variables or real-time behavior analysis, most only focus on a single dimension, such as time or location, failing to comprehensively consider resource hierarchy and access behavior spatial characteristics for joint decision-making. This limitation results in insufficient accuracy and adaptability in permission judgment when faced with complex access requests, easily leading to over- or under-allocation of permissions. This affects data security and privacy, and also reduces system availability and management efficiency. Therefore, there is an urgent need for a dynamic access control mechanism that integrates resource hierarchy resolution and access behavior spatial analysis to improve the adaptability, accuracy, and security of permission management. Summary of the Invention
[0005] The purpose of this invention is to provide a secure management system for data access control to solve the problems mentioned in the background art.
[0006] To achieve the above objectives, the present invention provides a data access control security management system, the system comprising: An access request receiving unit is used to obtain user data access request data and determine the request subject identifier and request resource identifier based on the data access request data; The hierarchical parsing unit is used to perform hierarchical parsing operations on the requested resource identifier and extract resource hierarchical feature information; The spatial mapping unit is used to retrieve historical access log data based on the request subject identifier and construct a spatial distribution model of access behavior based on the historical access log data. The permission decision unit is used to generate dynamic access permission policy data based on the resource hierarchy feature information and the access behavior spatial distribution model. The permission execution unit is used to control the user's access operation to the resource corresponding to the requested resource identifier according to the dynamic access permission policy data.
[0007] Preferably, the hierarchical parsing unit performs hierarchical parsing on the requested resource identifier to extract resource-level feature information, specifically as follows: The hierarchical parsing unit parses the resource path structure contained in the requested resource identifier and splits the resource path structure into multi-level resource node data according to preset hierarchical rules; Extract node attributes from the data of each level of resource nodes to generate node attribute feature vectors; The multi-scale feature fusion algorithm is used to fuse the node attribute feature vectors corresponding to the multi-level resource node data to generate the resource-level feature information.
[0008] Preferably, the spatial mapping unit retrieves historical access log data based on the request subject identifier, and constructs a spatial distribution model of access behavior based on the historical access log data, specifically as follows: The spatial mapping unit uses the request subject identifier as an index to extract the historical access log data containing timestamps and resource location information from the access log library; The historical access log data is segmented into time series based on the timestamp, and the resource location information of the same time series segment is divided into spatial regions based on the dynamic density clustering algorithm. Based on the spatial region division results, a spatial distribution model of the access behavior, including time and spatial dimensions, is constructed.
[0009] Preferably, the permission decision unit generates dynamic access permission policy data based on the resource level feature information and the access behavior spatial distribution model, specifically as follows: The permission decision unit extracts the access frequency characteristics and access time period characteristics of each spatial region in the access behavior spatial distribution model; Arrange the access frequency features and access time period features in a time series to construct an access behavior feature matrix; The access behavior feature matrix is weighted and corrected based on the resource level feature information to generate permission assessment feature data.
[0010] Preferably, the system further includes: The risk space construction unit is used to define multiple risk dimensions according to a preset security strategy and construct a multi-dimensional risk space based on the multiple risk dimensions. The permission decision-making unit maps the permission evaluation feature data to the multi-dimensional risk space to generate permission risk coordinate points; Calculate the distribution clustering degree of the permission risk coordinate points in the multidimensional risk space.
[0011] Preferably, the system further includes: The baseline permission modeling unit is used to construct a user resource relationship graph based on the system resource topology, and to extract baseline permission features from the user resource relationship graph based on a graph structure learning algorithm. Generate baseline permission feature data that includes upper and lower permission limits.
[0012] Preferably, the permission decision unit generates dynamic access permission policy data, which specifically includes: Real-time behavioral feature data of the request subject identifier corresponding to the current access request is obtained; The real-time behavioral feature data is converted into a real-time state vector; Calculate the spatial correlation value between the real-time state vector and the permission risk coordinate point in the multidimensional risk space; The real-time risk deviation is determined based on the spatial correlation value and the distribution clustering value. The real-time risk deviation is normalized based on the baseline permission feature data, and permission adjustment amount data is output.
[0013] Preferably, the system further includes: An anomaly verification unit is used to monitor the continuous change status of the real-time risk deviation. When the percentage of abnormalities that exceed the first preset duration or the second preset duration for the real-time risk deviation is detected to reach a preset threshold, an authorization verification command is triggered. The permission execution unit performs an access blocking operation according to the permission verification instruction.
[0014] Preferably, the permission execution unit controls access operations according to the dynamic access permission policy data, and specifically further includes: Calculate the permission offset direction vector and permission offset magnitude value based on the permission adjustment data; The adaptive correction algorithm updates the currently effective permission policy in real time based on the permission offset direction vector and permission offset magnitude value; Output the updated dynamic access permission policy data to the access control gateway.
[0015] Preferably, the system further includes: The secure transmission unit is used to perform layered encapsulation processing on the dynamic access permission policy data to generate access permission policy transmission data packets; The permission policy transmission data packet is sent to the permission execution unit based on a layered encrypted communication protocol. The permission execution unit decrypts and parses the received permission policy transmission data packet to restore the dynamic access permission policy data.
[0016] Compared with the prior art, the beneficial effects of the present invention are: This invention achieves more refined and adaptive data access control through hierarchical resolution of resource identifiers and spatial modeling of access behavior. The system can identify the multi-level structure of resources, thereby formulating permission policies based on resource hierarchical characteristics, avoiding the shortcomings of traditional role-based or rule-based methods in complex resource structures. Simultaneously, by mining the spatial distribution patterns in users' historical access behavior, the system can establish user-specific access patterns, making permission allocation more closely aligned with actual behavioral needs.
[0017] Dynamic permission policies are generated without relying on fixed rules, but are adjusted in real time according to resource characteristics and user behavior, enhancing the system's ability to cope with changing access scenarios. This method reduces the subjectivity and arbitrariness in permission allocation, lowers the risk of data leakage caused by excessive permission granting, and avoids the impact on normal business operations due to insufficient permissions.
[0018] The system boasts good scalability and applicability, is compatible with various data resource structures and access log formats, and is easily integrated into existing security management systems. Its adaptive mechanism reduces the daily maintenance burden on system administrators and improves the automation level of access control.
[0019] Furthermore, this solution enhances data security while also considering access efficiency and user experience, supporting flexible authorization requirements while ensuring data privacy. Overall, the system improves the accuracy, reliability, and maintainability of data access control, making it suitable for application environments with high data security requirements. Attached Figure Description
[0020] Figure 1This is a schematic diagram of the working principle of the data access control security management system described in this invention; Figure 2 A flowchart of the hierarchical parsing unit; Figure 3 A workflow diagram for generating evaluation features for the authority decision-making unit; Figure 4 Workflow diagram generated for dynamic permission policies; Figure 5 This is a flowchart illustrating the process of anomaly verification and blocking. Detailed Implementation
[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0022] Please see Figure 1 This invention provides a data access control security management system, the system comprising: During system operation, the access request receiving unit first obtains the user-submitted data access request data. This data includes a standardized format request subject identifier and a request resource identifier. The request subject identifier uses a globally unique user ID encoding, and the request resource identifier uses a Uniform Resource Identifier format conforming to RFC3986. After obtaining the request data through a secure API interface, the receiving unit verifies and standardizes the data format to ensure that subsequent units can correctly parse it.
[0023] The hierarchical parsing unit receives the standardized request resource identifier and performs structured parsing. This unit has a built-in resource path parser capable of recognizing hierarchical relationships represented by different delimiters. After parsing, the unit outputs a sequence of resource nodes containing complete hierarchical information. The spatial mapping unit synchronously initiates operations, using the request subject identifier as the retrieval key to access the distributed storage's historical access log database. The database records use a time-series encoding format, with each record containing a nanosecond-level timestamp and geometrically encoded resource location information. The retrieved historical data is preprocessed before being fed into the modeling engine.
[0024] The permission decision unit receives resource-level feature information from the hierarchical parsing unit and the spatial distribution model of access behavior from the spatial mapping unit. This unit integrates a multimodal feature fusion algorithm to correlate behavioral pattern features in the spatial distribution model with resource-level features. Dynamically changing permission policy data is generated in real-time using a standardized policy description language based on JSONSchema. Finally, the permission execution unit parses the dynamic policy through the security policy execution engine, generating specific access control instructions. These instructions are then sent to the access control gateway via a secure channel, enabling real-time control over data resource access operations.
[0025] Example 1: See Figure 2 When a user initiates an access request, the requested resource identifier obtained by the access request receiving unit may be a structured resource path, such as representing a database table file located in a specific storage location. The hierarchical parsing unit first parses this resource path. Predefined hierarchical rules define the usage specifications of path separators; for example, forward slashes are used to separate directories at different levels, while colons may be used to distinguish protocol types or namespaces. The parsing process breaks down the complete path into a series of ordered resource nodes, each node representing a logical segment in the path. For example, a complete resource path may be broken down into five levels of node data: protocol header, storage account name, container name, directory path, and final filename.
[0026] Attribute extraction for each level of resource node data is a process of in-depth analysis. Node attributes not only include basic surface features such as length and character type, but also involve deep semantic parsing. For example, for a filename node, extracted attributes might include file extension type, whether the naming pattern conforms to standards, and whether it contains specific keywords. These attributes are encoded into numerical feature vectors, with each dimension representing an attribute state. The generation of node attribute feature vectors considers the diversity and relevance of attributes, employing techniques such as feature hashing to map high-dimensional categorical attributes to a fixed-dimensional vector space, ensuring the efficiency and consistency of subsequent processing.
[0027] Multi-scale feature fusion algorithms focus on integrating information from nodes at different levels. Lower-level nodes, such as protocol types, may provide security attributes of the access protocol, while higher-level nodes, such as specific filenames, may reflect the sensitivity of the resource. The algorithm dynamically calculates the importance weights of nodes at different levels through an attention mechanism, with lower-level nodes potentially receiving higher weights because they typically carry more stable classification information. Feature fusion is not a simple vector concatenation or weighted averaging, but rather uses a gating mechanism to control the flow of information, allowing the model to adaptively select which levels of information should be emphasized or suppressed. The final generated resource-level feature information is a compact vector representation that integrates the essential information from all levels, capturing both the structural and semantic characteristics of the resource path.
[0028] The spatial mapping unit operates concurrently with the hierarchical parsing unit, but its focus is on analyzing the historical behavioral patterns of the requesting entity. Using the requesting entity identifier as an index, the system retrieves all access records of that user over a past period from the access log database. This historical access log data not only contains timestamps and resource location information but may also implicitly reveal the user's access habits and preferences. The precision of the timestamps ensures the temporal accuracy of the behavioral analysis, while the resource location information uses a standardized encoding format, which may be a globally unique resource identifier or latitude and longitude coordinates converted through a geocoding service.
[0029] Time-series segmentation divides these historical access records into meaningful time-segment sequences. Segmentation is based not only on simple time intervals but may also consider differences between weekdays and weekends, and even seasonal variations in access patterns. A dynamic density clustering algorithm then performs spatial analysis on the resource location information within each time segment. This algorithm does not require pre-specifying the number of clusters and can automatically discover densely accessed areas based on the data's inherent distribution characteristics. For example, during the morning, user access may be concentrated in a single data center; while at night, access may be dispersed across multiple different storage locations. The clustering results define multiple spatial regions, each representing a set of resources frequently accessed by users within a given time segment.
[0030] The spatial distribution model of access behavior integrates both temporal and spatial dimensions. Temporally, the model records changes in user access patterns across different time periods within a 24-hour cycle; spatially, it depicts the distribution of user-preferred resource locations during each time period. This model not only reflects users' historical behavioral patterns but also provides a benchmark for detecting abnormal access. For example, if a user suddenly accesses a previously unexplored spatial area during an unusual time period, the system can identify this behavioral deviation. The entire implementation process demonstrates the transformation from raw log data to a structured behavioral model, providing a data foundation for subsequent dynamic permission decisions.
[0031] Example 2: See Figure 3 After receiving the processing results from the preceding units, the access decision unit begins deep feature extraction from the spatial distribution model of access behavior. The access frequency characteristics of each spatial region are not simply counted statistics, but calculated by analyzing the concentration of user access to a certain type of resource group within a specific time period. For example, the system might find that a user accesses the financial database region significantly more often than other regions during the morning hours of weekdays; this persistent pattern forms a high-frequency feature value. The extraction of access time period features is more refined, requiring the identification of the distribution pattern of user access behavior along the time axis. For example, the user typically accesses personnel file resources between 9:00 and 11:00 AM, while accessing project document resources more frequently in the afternoon. These time patterns are quantified into probability distributions for different time intervals, forming a feature vector reflecting the user's daily routine.
[0032] Arranging these features into a matrix according to time series is a structured process. The row dimension of the matrix represents different logical spatial regions, which are the results of previous clustering analysis. Each region corresponds to a set of resources with similar functions or themes. The column dimension is arranged in chronological order, possibly in hours, containing feature data from multiple consecutive time periods. During the construction process, the system needs to handle potential data gaps, using time series-based interpolation methods to ensure the integrity of the matrix. The final generated access behavior feature matrix is a two-dimensional structure that can simultaneously show the distribution patterns of user behavior in both spatial and temporal dimensions.
[0033] The weighted adjustment of the matrix by resource-level feature information reflects the impact of resource attributes on access decisions. This resource-level feature information includes attributes such as resource sensitivity and business importance obtained through path resolution. The adjustment operation is not a simple numerical multiplication, but rather uses an attention mechanism to allow the system to dynamically adjust the degree of attention given to resources at different levels. For example, for resource nodes at deeper levels and marked as highly sensitive, their corresponding weight in the feature matrix is appropriately increased, making subsequent permission assessments more focused on access behavior to these resources. After the weighted adjustment, the feature matrix, which originally mainly reflected user behavior habits, incorporates the security attributes of the resources themselves, generating more discriminative permission assessment feature data.
[0034] The risk space construction unit defines risk dimensions from multiple perspectives based on the system's predefined security policies. The time-based risk dimension may examine whether the access occurred outside of working hours or on holidays; the geographical risk dimension assesses whether the geographical location initiating the access is abnormal; the behavioral anomaly dimension analyzes the degree of deviation between the current access pattern and historical behavior; and the resource sensitivity dimension considers the security level of the target resource itself. Each dimension has a quantitative scoring system, determining the threshold range for different risk levels by analyzing historical security event data. These dimensions constitute a multi-dimensional risk space, with each dimension representing an independent risk assessment perspective.
[0035] The mapping of permission assessment feature data to a multi-dimensional risk space is a transformation process. A pre-trained transformation model converts feature vectors reflecting user behavior patterns and resource characteristics into specific coordinate points within the risk space. The location of these coordinate points directly reflects the assessment value of the current access request across various risk dimensions. The system then calculates the distribution clustering degree of this permission risk coordinate point within the risk space, analyzing its relative position to the clusters formed by historical normal access requests. If the coordinate point is within a dense area of a normal cluster, it indicates that the access conforms to a normal pattern; if the coordinate point deviates from the normal cluster, it suggests a potential abnormal risk. This spatial relative position-based assessment method can dynamically adapt to differences in user behavior patterns, achieving personalized risk judgment.
[0036] Example 3: See Figure 4 The baseline permission modeling unit first obtains attribute information for all users from the organization's identity management system, including departmental affiliation, role definitions, and job level data. Simultaneously, it retrieves classification information, sensitivity tags, and business affiliation for all data resources from the resource metadata database. Based on this information, the system constructs a heterogeneous user-resource relationship graph, where user nodes and resource nodes are the two main types of entities, and edge relationships include various types such as affiliation, access, and management relationships. The graph structure learning algorithm employs a graph neural network architecture based on neighborhood aggregation. This network aggregates the feature information of adjacent nodes in the graph through a multi-layer message passing mechanism. Each layer of the neural network calculates the feature representation of a node and its neighbors, generating new node embedding vectors through nonlinear transformations. After multiple iterations, the final output is a node representation that reflects the complex structural relationships in the graph. Based on these learned node representations, the system calculates the association strength score for each user-resource pair. This score reflects the reasonableness of the user's access to the resource under normal business conditions.
[0037] The generation of baseline permission feature data is a statistical learning process. The system collects the association strength scores of all user-resource pairs, forming a probability distribution. The upper and lower limits of permissions are not determined using fixed thresholds, but rather dynamically calculated based on the quantiles of this distribution. The upper limit is selected from the high quantiles of the distribution, such as the 95th quantile, meaning that there is a 95% probability that the association strength of normal business access is lower than this value. The lower limit is selected from the low quantiles, such as the 5th quantile, indicating that access requests with an association strength lower than this value have a higher probability of being abnormal. The final generated baseline permission feature data defines a reasonable permission range for each user-resource pair, providing a reference benchmark for subsequent dynamic permission adjustments.
[0038] Real-time behavioral feature data is collected through data collectors deployed at key nodes of the system. These collectors capture user access behavior sequences in a non-intrusive manner, including raw features across multiple dimensions such as request frequency, request interval, duration of a single access, and operation sequence patterns. After standardization and normalization, these features are encoded into a fixed-dimensional real-time state vector. Each dimension of this vector represents a quantified value of a specific behavioral feature, such as the number of accesses in the last minute, the deviation of the current session duration from the average duration, etc.
[0039] The permission decision-making unit maps the real-time state vector to a multi-dimensional risk space through a pre-trained transformation model, obtaining the coordinate representation of the real-time state vector in this space. The system calculates the spatial correlation between this coordinate point and the set of historical permission risk coordinate points, using a distance-based correlation metric. in: This represents the spatial correlation value, ranging from 0 to 1. The larger the value, the stronger the correlation. This represents the coordinates of the real-time state vector in the risk space. The first point in the set of historical permission risk coordinates. One point. This represents the total number of historical coordinate points. This represents the Euclidean distance operator.
[0040] The correlation value, along with the previously calculated distribution clustering value, is input into a risk assessment model. This model analyzes the combination patterns of these two input features to calculate a comprehensive real-time risk deviation value. This deviation value quantifies the degree of abnormality of the current access behavior relative to historical patterns. Normalizing the real-time risk deviation based on baseline permission feature data is a key step in transforming abstract risk metrics into concrete permission adjustment amounts. The system obtains the corresponding baseline permission range based on the resource identifier currently accessed by the user, maps the risk deviation value to this range, and calculates the specific permission adjustment amount. This adjustment amount not only includes the magnitude of the permission value change but also indicates the direction of adjustment: whether to upgrade or downgrade the permission level. The final output permission adjustment amount data provides precise operational instructions for subsequent permission execution units, realizing a dynamic permission adjustment mechanism based on real-time risk assessment.
[0041] Example 4: See Figure 5 The anomaly verification unit continuously monitors the real-time risk deviation value output by the permission decision unit. This value is sampled 10 times per second and stored in a circular buffer. The monitoring system maintains a configurable time window, with a default sliding window of 300 seconds, storing 3000 consecutive sampled values within the window. The system sets two levels of detection thresholds: a primary alarm threshold of 0.7 and a high-level alarm threshold of 0.8. When the real-time risk deviation value continuously exceeds the primary alarm threshold for 30 seconds, the system triggers a state machine transition, generates a primary alarm event, and records a timestamp. For anomaly percentage detection, the system counts the proportion of sampled values exceeding the high-level alarm threshold within the 300-second time window. When this proportion exceeds the configured threshold of 75%, the system generates a high-level alarm event. All alarm events are digitally signed and timestamped, and while being written to the security audit database, a detailed security event report is generated, including key information such as event number, trigger time, duration, and deviation curve.
[0042] Upon receiving a permission verification command, the permission execution unit executes the corresponding access blocking operation based on the verification level specified in the command. The system defines a three-level blocking response mechanism: Level 1 temporarily freezes the user account, suspending all access permissions for a configurable duration; Level 2 forcibly terminates all currently active sessions, locking the account login function; Level 3 completely disables the user account, requiring administrator intervention to restore it. Blocking operations are implemented through the management API provided by the access control gateway, and these API calls employ two-way authentication and encrypted transmission. The system guarantees that the time delay from receiving the command to the operation taking effect is within 50 milliseconds. All blocking operations generate detailed operation logs, including operation time, execution result, affected users, etc., and the security operations team is notified in real time for follow-up processing.
[0043] The calculation of the permission offset direction vector is based on time-series analysis of permission adjustment data. The system maintains a time-series queue containing the 100 most recent permission adjustment records, each record including a timestamp and adjustment value. By analyzing the changing trends of the adjustment values at consecutive time points, a differential calculation method is used to obtain the direction vector. This vector represents the direction using a unit vector, and the amplitude value is obtained by calculating the Euclidean norm of the adjustment value change. An adaptive correction algorithm integrates a proportional-integral-derivative controller to generate permission policy adjustment parameters based on the permission offset direction vector and amplitude value. The proportional coefficient controls the response strength to the current deviation, the integral term eliminates accumulated errors, and the derivative term predicts the changing trend. These parameters are dynamically adjusted according to the real-time system load, employing a more conservative adjustment strategy under high load and allowing for more aggressive permission adjustments under low load.
[0044] The current active access control policy is updated using a gradual deployment strategy. Newly generated dynamic access control policy data is first validated and tested in an isolated sandbox environment, simulating various access scenarios to ensure the policy's effectiveness and security. After successful validation, the system gradually replaces the policy version in the production environment using a blue-green deployment approach. During the update process, both the old and new policies run in parallel, with a traffic distribution controller directing some access requests to the new policy version for processing. The system monitors the new policy's performance in real time, automatically rolling back to the old version if any anomalies are detected. After the final complete switchover, the updated dynamic access control policy data is identified by an incrementing version number, and a distributed transaction log ensures the atomicity and consistency of policy updates across all nodes (see Table 1).
[0045] Table 1: Definition of permission blocking operation levels.
[0046] Operational Level Triggering conditions Execute action Duration Recovery method Level 1 Deviation > 0.7 for 30 seconds Temporarily freeze accounts Configurable time Automatic recovery Level 2 Deviation > 0.8 accounts for over 75%. Force logout and lock session Until review Administrator Approval Level 3 Level 2 alarms triggered continuously Completely disable the account Long-term effective Security team handling When implementing blocking operations, the authorization execution unit strictly adheres to the level standards defined in the table above, executing corresponding control measures. Each level of operation is equipped with detailed execution procedures and recovery processes to ensure that security controls are achieved while minimizing the impact on normal business operations. The system also records the execution effect data of all blocking operations for subsequent analysis and optimization of threshold parameters for blocking strategies.
[0047] Example 5: After receiving the dynamic access control policy data generated by the permission decision unit, the secure transmission unit initiates a layered encapsulation process. The encapsulation process follows the layered principle of the standard communication protocol stack, processing downwards layer by layer starting from the application layer. At the application layer, the policy data is first encoded according to abstract syntax marking rules, converting the JSON-formatted policy description into a binary serialized format. This serialization process preserves complete policy semantic information, including all metadata such as permission entries, effective conditions, and time constraints. The presentation layer adds type markers and length identifiers to the serialized data. The type markers distinguish different categories of policy instructions, and the length identifiers ensure clear and identifiable data block boundaries. The session layer adds session control information, including session identifiers, sequence numbers, and timeout parameters, which are used to maintain session state consistency during transmission. The final permission policy transmission data packet is organized in a type-length-value format. The header contains a version identifier, timestamp, and packet sequence number; the body carries the encrypted policy data; and the tail appends an integrity check code and a digital signature.
[0048] The encrypted communication protocol employs a layered encryption architecture, with each layer using independent encryption algorithms and key management mechanisms. The application layer uses symmetric encryption algorithms to protect policy data, combining authentication and encryption in a mode that provides both confidentiality and integrity guarantees. The transport layer secure channel is built on standard security protocols, providing end-to-end communication protection, including two-way authentication, key exchange, and session key derivation. The network layer encryption provides network-level protection by encapsulating and encrypting IP packets to prevent traffic analysis and relay attacks. Each encryption layer uses keys from an independent key management system, which are periodically rotated and updated, and possess forward security features, ensuring that even long-term key leaks will not affect the security of past communications.
[0049] The packet header field generates a unique sequence number using a secure random number generator, and the timestamp is taken from the system's secure clock to prevent replay attacks. Encryption of the body is performed within a secure encryption module, using the currently valid encryption key to encrypt the serialized policy data. The tail checksum is calculated using a collision-resistant hash algorithm to ensure data integrity. The digital signature uses an asymmetric cryptographic algorithm to sign the hash values of the packet header and body, providing authentication of the data source and non-repudiation. The overall packet length is optimized to fit the maximum transmission unit limitations of typical network transmission environments, avoiding the performance overhead and security risks associated with fragmentation.
[0050] After receiving the data packet, the authorization execution unit performs a rigorous security verification and decryption process. The verification process first checks the compliance of the data packet format, including whether the length field matches, whether the version number is supported, and whether the timestamp is within a valid time window. Next, it calculates the checksum of the data packet and compares it with the transmitted checksum to detect whether the data has been tampered with during transmission. Digital signature verification uses a pre-set public key certificate to verify the authenticity of the data packet's origin. Only data packets that pass all verification steps will proceed to the decryption process.
[0051] The decryption operation follows the reverse order of layered encryption: first, the network layer encapsulation is removed; then, a secure transport layer channel is established; and finally, the policy data is decrypted and restored at the application layer. All keys used in the decryption process are from a secure key storage module, protected by a hardware security module. Each decryption step is logged, including the decryption time, key identifier used, and operation result. The restored dynamic access control policy data undergoes format validation and semantic checks before being immediately loaded into the policy execution engine. The policy activation process is guaranteed to be atomic; it either fully activates or remains unchanged, preventing intermediate states that could lead to access control vulnerabilities. The entire process from reception to activation is completed within strict time constraints, ensuring the real-time nature and effectiveness of access control.
[0052] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.
[0053] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.
Claims
1. A data access control security management system, characterized in that, The system includes: An access request receiving unit is used to obtain user data access request data and determine the request subject identifier and request resource identifier based on the data access request data; The hierarchical parsing unit is used to perform hierarchical parsing operations on the requested resource identifier and extract resource hierarchical feature information; The spatial mapping unit is used to retrieve historical access log data based on the request subject identifier and construct a spatial distribution model of access behavior based on the historical access log data. The permission decision unit is used to generate dynamic access permission policy data based on the resource hierarchy feature information and the access behavior spatial distribution model. The permission execution unit is used to control the user's access operation to the resource corresponding to the requested resource identifier according to the dynamic access permission policy data.
2. The data access control security management system according to claim 1, characterized in that, The hierarchical parsing unit performs hierarchical parsing on the requested resource identifier to extract resource-level feature information, specifically: The hierarchical parsing unit parses the resource path structure contained in the requested resource identifier and splits the resource path structure into multi-level resource node data according to preset hierarchical rules; Extract node attributes from the data of each level of resource nodes to generate node attribute feature vectors; The multi-scale feature fusion algorithm is used to fuse the node attribute feature vectors corresponding to the multi-level resource node data to generate the resource-level feature information.
3. The data access control security management system according to claim 2, characterized in that, The spatial mapping unit retrieves historical access log data based on the request subject identifier, and constructs a spatial distribution model of access behavior based on the historical access log data, specifically as follows: The spatial mapping unit uses the request subject identifier as an index to extract the historical access log data containing timestamps and resource location information from the access log library; The historical access log data is segmented into time series based on the timestamp, and the resource location information of the same time series segment is divided into spatial regions based on the dynamic density clustering algorithm. Based on the spatial region division results, a spatial distribution model of the access behavior, including time and spatial dimensions, is constructed.
4. The data access control security management system according to claim 3, characterized in that, The permission decision unit generates dynamic access permission policy data based on the resource level feature information and the access behavior spatial distribution model, specifically: The permission decision unit extracts the access frequency characteristics and access time period characteristics of each spatial region in the access behavior spatial distribution model; Arrange the access frequency features and access time period features in a time series to construct an access behavior feature matrix; The access behavior feature matrix is weighted and corrected based on the resource level feature information to generate permission assessment feature data.
5. The data access control security management system according to claim 4, characterized in that, The system also includes: The risk space construction unit is used to define multiple risk dimensions according to a preset security strategy and construct a multi-dimensional risk space based on the multiple risk dimensions. The permission decision-making unit maps the permission evaluation feature data to the multi-dimensional risk space to generate permission risk coordinate points; Calculate the distribution clustering degree of the permission risk coordinate points in the multidimensional risk space.
6. The data access control security management system according to claim 5, characterized in that, The system also includes: The baseline permission modeling unit is used to construct a user resource relationship graph based on the system resource topology, and to extract baseline permission features from the user resource relationship graph based on a graph structure learning algorithm. Generate baseline permission feature data that includes upper and lower permission limits.
7. The data access control security management system according to claim 6, characterized in that, The permission decision unit generates dynamic access permission policy data, specifically including: Real-time behavioral feature data of the request subject identifier corresponding to the current access request is obtained; The real-time behavioral feature data is converted into a real-time state vector; Calculate the spatial correlation value between the real-time state vector and the permission risk coordinate point in the multidimensional risk space; The real-time risk deviation is determined based on the spatial correlation value and the distribution clustering value. The real-time risk deviation is normalized based on the baseline permission feature data, and permission adjustment amount data is output.
8. The data access control security management system according to claim 7, characterized in that, The system also includes: An anomaly verification unit is used to monitor the continuous change status of the real-time risk deviation. When the percentage of abnormalities that exceed the first preset duration or the second preset duration for the real-time risk deviation is detected to reach a preset threshold, an authorization verification command is triggered. The permission execution unit performs an access blocking operation according to the permission verification instruction.
9. The data access control security management system according to claim 8, characterized in that, The permission execution unit controls access operations according to the dynamic access permission policy data, and specifically includes: Calculate the permission offset direction vector and permission offset magnitude value based on the permission adjustment data; The adaptive correction algorithm updates the currently effective permission policy in real time based on the permission offset direction vector and permission offset magnitude value; Output the updated dynamic access permission policy data to the access control gateway.
10. The data access control security management system according to claim 1, characterized in that, The system also includes: The secure transmission unit is used to perform layered encapsulation processing on the dynamic access permission policy data to generate access permission policy transmission data packets; The permission policy transmission data packet is sent to the permission execution unit based on a layered encrypted communication protocol. The permission execution unit decrypts and parses the received permission policy transmission data packet to restore the dynamic access permission policy data.