Certificate access frequency adaptive control method and system

Abstract

The invention relates to a certificate access frequency adaptive control method and system, and the method comprises the steps: receiving a certificate query obtaining request; the voucher query acquisition request comprises a target voucher identifier; determining behavior characteristic parameters based on the voucher query acquisition request; determining a calling mode type according to the behavior characteristic parameters; determining a dynamic access frequency threshold based on the calling mode type and the sensitivity level corresponding to the target credential identifier; based on the behavior characteristic parameters and a dynamic access frequency threshold, determining a behavior abnormal level; and according to the abnormal level, determining a corresponding adaptive control operation. Through application of the method and the device, the problem that the security of the privileged certificate is reduced due to the fact that the privileged certificate acquisition behaviors cannot be subjected to differential control in related technologies is solved, differential control according to different privileged certificate acquisition behaviors is realized, and the security of the privileged certificate is improved.

Description

Technical Field

[0001] This application relates to the field of network security, and in particular to a method and system for adaptive control of credential access frequency. Background Technology

[0002] In today's IT environment, enterprises typically employ Privileged Access Management (PAM) systems to centrally manage privileged credentials such as database accounts, operating system accounts, network device accounts, and cloud platform access keys. PAM systems interface with various business systems to provide login or asset access services to business personnel or applications. Therefore, a secure and reliable adaptive control technology for credential access frequency is crucial for mitigating the risk of mass leakage of privileged credentials.

[0003] Existing technologies for controlling access privilege management systems primarily focus on security strategies for general application programming interface (API) requests or system resource usage. Their drawback lies in the lack of refined consideration of the behavioral characteristics of individual callers on privileged credential acquisition interfaces, making it impossible to differentiate and control privileged credential acquisition behavior, thus leading to reduced security of privileged credentials.

[0004] There is currently no effective solution to the problem that the inability to differentiate the acquisition behavior of privileged credentials in related technologies leads to reduced security of privileged credentials. Summary of the Invention

[0005] This embodiment provides a method and system for adaptive control of credential access frequency to solve the problem in related technologies that cannot differentiate the control of privileged credential acquisition behavior.

[0006] Firstly, this embodiment provides a method for adaptive control of credential access frequency, including:

[0007] Receive a credential query and retrieval request; the credential query and retrieval request includes a target credential identifier;

[0008] Based on the credential query request, determine the behavioral characteristic parameters;

[0009] The invocation mode type is determined based on the behavioral characteristic parameters;

[0010] Based on the call mode type and the sensitivity level corresponding to the target credential identifier, determine the dynamic access frequency threshold for multiple time windows;

[0011] Based on the behavioral characteristic parameters and the dynamic access frequency threshold, the behavioral anomaly level is determined; and according to the anomaly level, the corresponding adaptive control operation is determined.

[0012] In some embodiments, determining behavioral characteristic parameters based on the credential query request includes:

[0013] Based on the credential query request and the pre-built password retrieval log, the behavioral characteristic parameters within different time windows are determined.

[0014] In some embodiments, determining the invocation pattern type based on the behavioral characteristic parameters includes:

[0015] The access frequency is determined based on the number of password retrieval requests in the behavioral characteristic parameters.

[0016] The invocation mode type is determined based on the access frequency, the number of privileged credentials accessed, and the proportion of high-sensitivity credentials accessed in the behavioral characteristic parameters.

[0017] In some embodiments, determining the invocation mode type based on the access frequency, the number of privileged credentials accessed in the behavioral characteristic parameters, and the proportion of high-sensitivity credentials accessed includes:

[0018] If the access frequency falls within a preset first numerical range, then the calling mode type is determined to be manual mode;

[0019] If the access frequency falls within a preset second numerical range and the access time distribution conforms to a preset periodicity, then the calling mode type is determined to be program mode.

[0020] If the access frequency falls within a preset third numerical range, and the number of accesses by the privileged credential is greater than a preset access number threshold, then the calling mode type is determined to be batch processing mode.

[0021] If the access frequency falls within a preset fourth numerical range, and the access ratio of the high-sensitivity credential is greater than a preset access ratio threshold, then the call mode type is determined to be a suspicious mode.

[0022] In some embodiments, determining the dynamic access frequency threshold for multiple time windows based on the sensitivity level corresponding to the call mode type and the target credential identifier includes:

[0023] Based on the target credential identifier, the sensitivity level is obtained from the pre-built credential database;

[0024] The dynamic access frequency threshold is determined based on the call mode type and the sensitivity level.

[0025] In some embodiments, determining the abnormal behavior level based on the behavioral feature parameters and the dynamic access frequency threshold includes:

[0026] Based on the behavioral feature parameters, the current access frequency is determined; the current access frequency includes a first access frequency, a second access frequency, and a third access frequency; the dynamic access frequency threshold includes a first time window frequency threshold, a second time window frequency threshold, and a third time window frequency threshold; the first access frequency is compared with the first time window frequency threshold, the second access frequency is compared with the second time window frequency threshold, and the third access frequency is compared with the third time window frequency threshold.

[0027] If only the first access frequency is greater than the first time window frequency threshold, then the abnormal behavior level is determined to be the first abnormal level.

[0028] If the second access frequency is greater than the second time window frequency threshold or the third access frequency is greater than the third time window frequency threshold, then the behavior abnormality level is determined to be the second abnormality level.

[0029] If the first access frequency is greater than the first time window frequency threshold or the second access frequency is greater than the second time window frequency threshold, and the access ratio of high-sensitivity credentials in the behavioral feature parameters is greater than the preset abnormal access ratio threshold, then the behavioral abnormality level is determined to be the third abnormality level.

[0030] In some embodiments, determining the corresponding adaptive control operation based on the anomaly level includes:

[0031] If the anomaly level is the first anomaly level, then the adaptive control operation is a response delay operation;

[0032] If the anomaly level is the second anomaly level, then the adaptive control operation is a downgrade return operation;

[0033] If the anomaly level is the third anomaly level, then the adaptive control operation is a temporary blocking operation.

[0034] In some embodiments, after determining the corresponding adaptive control operation based on the anomaly level, the method further includes:

[0035] Based on the adaptive control operation, the statistical parameters within each time window are adjusted; the statistical parameters are used to calculate the dynamic access frequency threshold for subsequent requests.

[0036] Secondly, this embodiment provides an adaptive control system for credential access frequency, including a behavior feature extraction module, a call pattern recognition module, a sensitivity level acquisition module, a threshold generation module, an anomaly determination module, and a control execution module;

[0037] The behavior feature extraction module is used to extract behavior feature parameters from the credential query request;

[0038] The call pattern recognition module is used to automatically identify the call pattern type based on the behavioral feature parameters;

[0039] The sensitivity level acquisition module is used to acquire the sensitivity level corresponding to the target credential identifier;

[0040] The threshold generation module is used to generate a dynamic access frequency threshold based on the call mode type and the sensitivity level.

[0041] The anomaly determination module is used to determine the level of behavioral anomaly based on the behavioral characteristic parameters and the dynamic access frequency threshold.

[0042] The control execution module is used to perform corresponding adaptive control operations based on the anomaly level.

[0043] In some embodiments, the system further includes a statistical model update module, a password lookup module, and a credential database;

[0044] The statistical model update module is used to provide statistical parameters and adjust the statistical parameters;

[0045] The authentication module is used to query the requested data from the credential database;

[0046] The credential database is used to persistently store the user-configurable sensitivity level and credential metadata.

[0047] Compared with related technologies, the adaptive control method and system for credential access frequency provided in this embodiment receives credential query requests, which include a target credential identifier. Based on the credential query request, behavioral characteristic parameters are determined. Based on the behavioral characteristic parameters, the calling mode type is determined. Based on the sensitivity level corresponding to the calling mode type and the target credential identifier, a dynamic access frequency threshold for multiple time windows is determined. Based on the behavioral characteristic parameters and the dynamic access frequency threshold, the behavioral anomaly level is determined. And based on the anomaly level, the corresponding adaptive control operation is determined. By introducing a judgment mechanism that combines automatic calling mode recognition with credential sensitivity level, and dynamically generating differentiated frequency thresholds for different scenarios, the static rate limiting strategy is transformed into adaptive behavioral risk management. This solves the problem in related technologies where the inability to differentiate control over privileged credential acquisition behavior leads to reduced privileged credential security, and achieves differentiated control based on different privileged credential acquisition behaviors, thereby improving the security of privileged credentials.

[0048] Details of one or more embodiments of this application are set forth in the following drawings and description to make other features, objects and advantages of this application more readily apparent. Attached Figure Description

[0049] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0050] Figure 1 This is a structural block diagram of a credential access frequency adaptive control system provided in an embodiment of this application;

[0051] Figure 2 This is a flowchart of an embodiment of the credential access frequency adaptive control method provided in this application;

[0052] Figure 3 This is a flowchart illustrating the determination of the invocation mode type according to an embodiment of this application;

[0053] Figure 4 This is a flowchart of determining adaptive control operations provided in an embodiment of this application;

[0054] Figure 5 This is a flowchart illustrating an embodiment of the credential access frequency adaptive control method provided in this application.

[0055] Figure 6 This is a schematic diagram of the structure of an adaptive control system for credential access frequency provided in an embodiment of this application.

[0056] In the diagram: 102, Behavioral Feature Extraction Module; 104, Call Pattern Recognition Module; 106, Threshold Generation Module; 108, Sensitivity Level Acquisition Module; 110, Anomaly Detection Module; 112, Control Execution Module. Detailed Implementation

[0057] To better understand the purpose, technical solution, and advantages of this application, the application is described and illustrated below in conjunction with the accompanying drawings and embodiments.

[0058] Unless otherwise defined, the technical or scientific terms used in this application shall have the general meaning understood by one of ordinary skill in the art to which this application pertains. Words such as “a,” “an,” “an,” “the,” “the,” and “these” used in this application do not indicate quantitative limitation and may be singular or plural. The terms “comprising,” “including,” “having,” and any variations thereof used in this application are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that comprises a series of steps or modules (units) is not limited to the listed steps or modules (units) but may include steps or modules (units) not listed, or may include other steps or modules (units) inherent to these processes, methods, products, or devices. Words such as “connected,” “linked,” and “coupled” used in this application are not limited to physical or mechanical connections but may include electrical connections, whether direct or indirect. “Multiple” used in this application refers to two or more. “And / or” describes the relationship between related objects, indicating that three relationships may exist; for example, “A and / or B” can represent: A alone, A and B simultaneously, and B alone. Normally, the character " / " indicates that the objects before and after it are in an "or" relationship. The terms "first," "second," "third," etc., used in this application are merely to distinguish similar objects and do not represent a specific order of objects.

[0059] The method embodiments provided in this example can be executed on a terminal, computer, or similar computing device. Figure 1 This is a block diagram of the credential access frequency adaptive control system in this embodiment. Figure 1As shown, the system may include a behavior feature extraction module 102, a call pattern recognition module 104, a threshold generation module 106, a sensitivity level acquisition module 108, an anomaly determination module 110, and a control execution module 112. The behavior feature extraction module 102 extracts behavior feature parameters and passes them to the call pattern recognition module 104. The call pattern recognition module 104 determines the call pattern type and passes it to the threshold generation module 106. The threshold generation module 106 obtains the sensitivity level corresponding to the credential from the sensitivity level acquisition module 108, and, combined with the call pattern type, generates a dynamic threshold for multiple time windows. This dynamic threshold is then passed to the anomaly determination module 110. The anomaly determination module 110 determines the anomaly level and passes it to the control execution module 112. The control execution module 112 executes the control operation corresponding to the anomaly level. Those skilled in the art will understand that… Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the system described above. For example, the system may also include components that are larger than... Figure 1 The more or fewer modules shown, or having the same Figure 1 The different configurations shown are illustrated.

[0060] This embodiment provides an adaptive control method for credential access frequency. Figure 2 This is a flowchart of the credential access frequency adaptive control method in this embodiment, as shown below. Figure 2 As shown, the process includes the following steps:

[0061] Step S210: Receive a credential query and retrieval request; the credential query and retrieval request includes the target credential identifier.

[0062] Specifically, after unified identity authentication and authorization through the privileged access management system, the credential service interface module begins processing application programming interface (API) authentication requests from the calling entity (operation personnel / applications / agents / scripts). The privileged access management system is a system for centralized management, storage, and distribution of privileged accounts and their credentials (account passwords, access keys, certificates, etc.) used to control and audit high-privilege access to critical assets. The request content includes the calling entity identifier (such as user ID, application ID, agent ID), the target credential identifier (such as account ID, key ID), the request initiation method (user interface / API / agent), and the request timestamp. There are no restrictions on the data types included in the request.

[0063] Step S220: Determine behavioral characteristic parameters based on the credential query request.

[0064] Specifically, historical password verification records can be parsed from the audit logs of the privileged access management system, and behavioral characteristic parameters can be obtained through time window statistical calculations; alternatively, request flows can be collected and aggregated in real time from the traffic monitoring component deployed at the gateway to dynamically generate behavioral characteristic parameters; or aggregated relevant behavioral statistics can be queried from an external security information and event management system. No restrictions are placed on the specific methods for obtaining behavioral characteristic parameters.

[0065] Step S230: Determine the calling mode type based on the behavioral characteristic parameters.

[0066] Specifically, the calling pattern type can be determined by logically matching and thresholding behavioral feature parameters through a pre-defined rule engine; alternatively, a trained lightweight classification model can be used to infer the feature parameter vector and directly output the pattern classification result; or the historical behavioral baseline of the calling entity can be combined with similarity calculation or pattern matching algorithms for classification. No restrictions are placed on the specific implementation method for determining the calling pattern type.

[0067] Step S240: Determine the dynamic access frequency threshold for multiple time windows based on the sensitivity level corresponding to the call mode type and the target credential identifier.

[0068] Specifically, the corresponding threshold parameters can be determined by looking up the combination of call pattern type and sensitivity level according to a pre-configured threshold mapping table; alternatively, thresholds can be dynamically calculated and generated based on historical behavior data through statistical models, such as using a linear combination of mean and standard deviation; or machine learning algorithms can be used to learn historical normal access patterns to predict and output dynamic thresholds that match the current scenario. No restrictions are placed on the specific method for determining the dynamic access frequency threshold.

[0069] Step S250: Determine the abnormal behavior level based on the behavioral characteristic parameters and the dynamic access frequency threshold; and determine the corresponding adaptive control operation according to the abnormality level.

[0070] Specifically, the level of behavioral anomaly can be determined by comparing the current access frequency with dynamic thresholds for each time window and combining auxiliary features such as the access ratio of highly sensitive credentials, based on preset multi-level judgment rules. Alternatively, an anomaly scoring algorithm based on statistical distribution can be used to quantify the anomaly level by calculating the degree to which the current behavioral characteristics deviate from the historical baseline. Another approach is to integrate detection models, combine multiple risk indicators to output a normalized risk score, and then map the score interval to the corresponding anomaly level. No restrictions are placed on the implementation path for determining the level of behavioral anomaly.

[0071] After determining the anomaly level, the corresponding operation instruction can be directly selected according to a predefined control strategy mapping table; alternatively, a configurable strategy engine can parse and execute complex control workflows associated with the anomaly level; or, based on the anomaly context, a handling plan including a combination of actions such as delay, degradation, and blocking can be dynamically generated. No restrictions are placed on the implementation method for determining the anomaly level.

[0072] Through the above steps, the system receives credential query requests and extracts multi-dimensional behavioral feature parameters, then derives the call mode type based on these parameters. Combining the call mode type with the sensitivity level, it dynamically derives access frequency thresholds suitable for different scenarios from historical behavioral data. In the judgment phase, the access frequency is compared with multi-level dynamic thresholds to obtain a quantified anomaly level, and adaptive control operations corresponding to the anomaly level are executed. This solves the problem in related technologies where the inability to differentiate control over privileged credential acquisition behavior leads to reduced privileged credential security. It achieves differentiated control based on different privileged credential acquisition behaviors, thereby improving privileged credential security.

[0073] The above steps are explained in detail below:

[0074] In some embodiments, determining behavioral characteristic parameters based on the credential query request in step S220 includes the following steps:

[0075] Based on credential query requests and pre-built password retrieval logs, behavioral characteristic parameters within different time windows are determined.

[0076] Specifically, based on the current credential query and retrieval requests and the pre-built encryption logs, behavioral characteristic parameters are statistically analyzed within different time windows. For the calling subject and the target privileged credential, within the time interval, the behavioral characteristic parameters include, but are not limited to, the number of encryption requests N within a short window. s (e.g., within the last 10 seconds), the number of password retrieval requests N within the intermediate window. m (e.g., within the last 10 minutes), the number of password retrieval requests N within a long window. l The number of different privileged credentials accessed within a short window (e.g., within the last 24 hours) U s The number of different privileged credentials accessed within the intermediate window (U) m The number of different privileged credentials accessed within a long-term window (U) l The proportion of requests accessing highly sensitive credentials within the window (number of highly sensitive requests / total number of requests) R high The request time distribution characteristics (e.g., whether they are concentrated in a specific time period) and the request interface type (user interface / application programming interface / proxy). There are no restrictions on the parameter type for the behavioral characteristics.

[0077] Behavioral characteristic parameters can be obtained through recording and statistically calculating password query logs in the privileged access management system, collecting data through middleware, or incrementally calculating data using caching. There are no restrictions on the method of obtaining behavioral characteristic parameters. Privileged credentials refer to credentials used to access high-risk assets or perform high-privilege operations, including but not limited to system administrator accounts, database superuser accounts, network device management accounts, or cloud platform access keys. There are no restrictions on the data types included in privileged credentials.

[0078] The number of time windows can be adjusted according to the specific system scale and business characteristics. For example, an ultra-short-term window or a statistical window with a longer time scale can be added. There is no limit to the number of time windows.

[0079] This embodiment enables a multi-dimensional and multi-timescale refined evaluation of the password retrieval behavior of the calling entity. By simultaneously statistically analyzing key parameters such as the number of password retrieval requests, the diversity of credential types, and the proportion of access to highly sensitive credentials within short-term, medium-term, and long-term windows, a comprehensive and reliable data foundation is provided for subsequent accurate identification of calling patterns, dynamic generation of thresholds, and determination of anomaly levels.

[0080] In some embodiments, determining the invocation mode type based on behavioral characteristic parameters in step S230 includes the following steps:

[0081] The access frequency is determined based on the number of password retrieval requests in the behavioral characteristic parameters;

[0082] The invocation mode type is determined based on the access frequency, the number of privileged credentials accessed, and the proportion of high-sensitivity credentials accessed in the behavioral characteristic parameters.

[0083] Specifically, firstly, based on the number of encryption requests in the behavioral characteristic parameters, the short-term access frequency, medium-term access frequency, and long-term access frequency are calculated. There are several ways to obtain the access frequency, one of which is to calculate the ratio of the number of encryption requests to the time window length using a mathematical formula. If the mathematical formula method is used, the formula for calculating the short-term access frequency is:

[0084] ;

[0085] in, For short-term access frequency, This refers to the number of password retrieval requests within a short window. This refers to the short-term time window length. The formula for calculating the medium-term access frequency is:

[0086] ;

[0087] in, For medium-term access frequency, This refers to the number of password retrieval requests within the intermediate window. This refers to the length of the medium-term time window. The formula for calculating the long-term access frequency is:

[0088] ;

[0089] in, For long-term access frequency, This refers to the number of password retrieval requests within a long window. This represents the length of the long-term time window.

[0090] Secondly, based on the access frequency, the number of privileged credentials accessed, and the proportion of highly sensitive credentials accessed in the behavioral characteristic parameters, the invocation mode type is comprehensively determined through a set of preset functional rules. Invocation mode types include, but are not limited to, manual mode, program mode, batch mode, and suspicious mode. Manual mode is typically characterized by low frequency, variable request times, a small number of credentials accessed per request, and primarily user-interface requests. Program mode is typically characterized by fixed periods, stable access frequency, and relatively fixed target credentials. Batch mode is typically characterized by accessing multiple different credentials within a short time window, with concentrated bursts in medium to long-term windows. Suspicious mode is typically characterized by a sudden increase in access frequency, a significant increase in the types of credentials accessed, and an abnormally high proportion of highly sensitive credentials accessed. No specific restrictions are placed on the specific invocation mode type.

[0091] This embodiment combines multi-dimensional behavioral feature parameters with multi-timescale frequency analysis, and uses a preset rule engine to classify key call patterns in real time and automatically, without relying on complex machine learning models, thereby improving threat response speed and optimizing system resource allocation.

[0092] In some embodiments, the invocation mode type is determined based on access frequency, the number of privileged credentials accessed, and the proportion of high-sensitivity credentials accessed in the behavioral characteristic parameters, such as... Figure 3 As shown, it includes the following steps:

[0093] Step S231: If the access frequency falls within the preset first numerical range, then the calling mode type is determined to be manual mode.

[0094] Step S232: If the access frequency belongs to the preset second numerical range and the access time distribution conforms to the preset periodicity, then the calling mode type is determined to be program mode.

[0095] Step S233: If the access frequency is within the preset third numerical range and the number of accesses by privileged credentials is greater than the preset access number threshold, then the call mode type is determined to be batch processing mode.

[0096] Step S234: If the access frequency falls within the preset fourth numerical range and the access ratio of high-sensitivity credentials is greater than the preset access ratio threshold, then the call mode type is determined to be a suspicious mode.

[0097] Specifically, the call mode type is used to differentiate the inherent frequency differences in privileged credential acquisition behaviors such as manual operations, program calls, and batch processing, avoiding false blocking or missed monitoring caused by imposing uniform access frequency restrictions on normal business calls. For example, if... Less than or equal to 0.1 times / second Less than or equal to 2 times / minute If the number of requests is less than or equal to 30 per day, and the user interface requests account for more than 80%, and the number of access credential types is less than or equal to 3, then it is judged as manual mode; if Greater than 0.1 times / second and less than or equal to 5 times / second If the frequency is greater than 2 times / minute but less than 30 times / minute, stable within a certain range, exhibits a clear periodicity in time distribution, and has relatively fixed access credentials, then it is determined to be a program mode; if... Greater than 5 times / second and less than or equal to 20 times / second If the number of accesses in a short window exceeds the preset threshold of 10, and the types of access credentials increase significantly, it is determined to be in batch processing mode; if the access frequency in the short window is... Greater than 20 times / second and R high If the access ratio exceeds a preset threshold of 50%, or if a large number of highly sensitive credentials are accessed within a short period of time, it will be marked as a suspicious mode. The call mode type can also be adapted to suit business lines, internal security specifications, or environments (production / testing).

[0098] It is understood that the ranges or thresholds listed above can be configured and adjusted according to the actual application environment, and are not limited to the fixed values ​​listed.

[0099] In this embodiment, the call mode type does not need to be manually configured and specified by the user or security administrator. Instead, it is automatically determined by the system based on behavioral characteristic parameters, thus avoiding overly lenient or overly strict configurations due to reliance on human experience. By automatically identifying the call mode type, different call subjects and credential types can be effectively distinguished, allowing for targeted control of password verification and retrieval behaviors, rather than simply uniform rate limiting.

[0100] In some embodiments, step S240, which determines the dynamic access frequency threshold for multiple time windows based on the sensitivity level corresponding to the call mode type and the target credential identifier, includes the following steps:

[0101] Based on the target credential identifier, obtain the sensitivity level from the pre-built credential database;

[0102] Determine the dynamic access frequency threshold based on the call mode type and sensitivity level.

[0103] Specifically, the process of obtaining the sensitivity level can be completed by querying the built-in or external credential metadata service. This service maintains the mapping relationship between credential identifiers and preset sensitivity labels (such as high, medium, and low). For example, the credential with root / admin privileges corresponds to the high sensitivity level, the credential of the database administrator (DBA) corresponds to the medium sensitivity level, and the credential of the operations and maintenance personnel corresponds to the low sensitivity level.

[0104] After obtaining the sensitivity level, the corresponding dynamic access frequency threshold is calculated for different time windows and sensitivity levels. For a given combination of call subject and sensitivity level, the historical average window access frequency, corresponding standard deviation, and corresponding coefficient factor are obtained. The coefficient factor can be configured according to the call pattern and sensitivity level. For example, a smaller coefficient can be set for highly sensitive credentials and suspicious call subjects, thereby tightening the threshold.

[0105] Based on the above parameters, the dynamic access frequency threshold can be calculated. There are several ways to obtain the dynamic access frequency threshold, one of which is to use a mathematical formula to perform a weighted sum of the mean and standard deviation of the window access frequency. If this method is used, the formula for calculating the short-term dynamic access frequency threshold is:

[0106] ;

[0107] in, This is a short-term dynamic access frequency threshold. This represents the average frequency of short-term visits. This is the short-term window coefficient. This represents the standard deviation of short-term access frequency. The formula for calculating the medium-term dynamic access frequency threshold is:

[0108] ;

[0109] in, This is a threshold for the medium-term dynamic access frequency. This represents the average frequency of visits over a medium period. This is the medium-term window coefficient. This represents the standard deviation of the medium-term access frequency. The formula for calculating the long-term dynamic access frequency threshold is:

[0110] ;

[0111] in, This is a long-term dynamic access frequency threshold. This represents the average frequency of visits over a long period. This is the long-term window coefficient. This represents the standard deviation of long-term access frequency.

[0112] In this embodiment, since the dynamic threshold is not pre-configured based on human experience, but adaptively adjusted according to the actual behavior of the calling subject, and dimensions such as the sensitivity level of privileged credentials and the type of access credentials are introduced in the judgment, the pertinence of security protection is effectively improved.

[0113] In some embodiments, step S250 determines the level of behavioral abnormality based on behavioral characteristic parameters and a dynamic access frequency threshold, such as... Figure 4 As shown, it includes the following steps:

[0114] Step S251: Determine the current access frequency based on behavioral feature parameters; the current access frequency includes a first access frequency, a second access frequency, and a third access frequency; the dynamic access frequency threshold includes a first time window frequency threshold, a second time window frequency threshold, and a third time window frequency threshold; compare the first access frequency with the first time window frequency threshold, compare the second access frequency with the second time window frequency threshold, and compare the third access frequency with the third time window frequency threshold.

[0115] Step S252: If only the first access frequency is greater than the first time window frequency threshold, then the behavior abnormality level is determined to be the first abnormality level.

[0116] Step S253: If the second access frequency is greater than the second time window frequency threshold or the third access frequency is greater than the third time window frequency threshold, then the behavior abnormality level is determined to be the second abnormality level.

[0117] Step S254: If the first access frequency is greater than the first time window frequency threshold or the second access frequency is greater than the second time window frequency threshold, and the access ratio of high-sensitivity level credentials in the behavioral feature parameters is greater than the preset access ratio abnormal threshold, then the behavioral abnormality level is determined to be the third abnormality level.

[0118] Specifically, the first access frequency corresponds to the short-term access frequency. The second access frequency corresponds to the intermediate access frequency. The third access frequency corresponds to the long-term access frequency. The first time window frequency threshold corresponds to the short-term dynamic access frequency threshold. The second time window frequency threshold corresponds to the mid-term dynamic access frequency threshold. The third time window frequency threshold corresponds to the long-term dynamic access frequency threshold. The access frequency is compared with the corresponding dynamic threshold.

[0119] like If so, it is considered that there is an abnormally high access frequency in the short term; if If so, the intermediate frequency is considered abnormal; if If the frequency is abnormally high over a long period, then it is considered to be abnormal; if the access ratio of highly sensitive credentials is R high If the access rate exceeds the preset limit (e.g., 50%), it is considered an abnormal access to highly sensitive credentials.

[0120] Based on the above assessment results, the degree of anomaly is classified into different anomaly levels. Anomaly level characterizes the impact of abnormal behavior on the security of privileged credentials, serving as a basis for subsequent decisions on selecting different credential acquisition control methods. When only a short-term window exceeds the limit, it is considered a mild anomaly, with an anomaly level of Level 1; when a medium- or long-term window exceeds the limit, it is considered a moderate anomaly, with an anomaly level of Level 2; when a short- or medium-term window exceeds the limit, accompanied by an abnormal proportion of access to highly sensitive credentials, it is considered a severe anomaly, with an anomaly level of Level 3.

[0121] This embodiment comprehensively considers the access frequency, number of access credentials, and access ratio of highly sensitive key credentials within short-term, medium-term, and long-term time windows. Through multi-time window statistics and dynamic threshold generation mechanisms, it can simultaneously identify short-term brute-force acquisition of key credentials and long-term slow crawling behavior, reducing the space for attackers to steal privileged credentials in bulk under legitimate identities.

[0122] In some embodiments, step S250, determining the corresponding adaptive control operation based on the anomaly level, includes the following steps:

[0123] If the anomaly level is the first anomaly level, then the adaptive control operation is a response delay operation;

[0124] If the anomaly level is the second anomaly level, the adaptive control operation is a downgrade return operation;

[0125] If the anomaly level is the third anomaly level, the adaptive control operation is a temporary blocking operation.

[0126] Specifically, when the anomaly level is Level 1 (mild anomaly), the response to the current request is delayed, and some random jitter is introduced. Simultaneously, the rate of continued access is controlled in the short term (e.g., increasing the minimum interval). When the anomaly level is Level 2 (moderate anomaly), privileged credentials are not returned; instead, restricted credentials (e.g., temporary tokens usable only for a specific asset or with a shorter validity period) are returned, and the frequency of requests to access highly sensitive credentials is more strictly controlled. When the anomaly level is Level 3 (severe anomaly), the caller's ability to retrieve credentials is suspended for a certain period. The caller is marked as restricted; in this state, subsequent retrieval requests will be directly intercepted by the control execution module or trigger a more stringent verification process. Furthermore, the caller is marked as restricted, requiring subsequent access to be restored only after additional verification (e.g., manual verification or secondary confirmation).

[0127] The above control operations are executed automatically by the system without manual intervention. When no anomalies are detected, the system will forward the request to the authentication module and return the target credentials or access token normally. The control operations can be extended in conjunction with internal security policies, such as triggering audit log strengthening, automated work orders, or risk control processes. There are no restrictions on the type of control operations.

[0128] For example, when operations and maintenance personnel obtain privileged account passwords for multiple systems in a short period of time, because the calling entity usually accesses the system infrequently, the historical statistics may show... , The calculated short-term threshold is relatively small. Similarly, at a lower frequency, when the frequency of operations and maintenance personnel suddenly increases, the system will detect short-term anomalies and take mild anomaly control measures, such as increasing response latency and limiting the frequency of password retrieval in the following short period of time, but still allowing operations and maintenance personnel to complete necessary emergency operations.

[0129] When the access token of a specific automated script is leaked, the attacker uses it to access a large number of highly sensitive privileged credentials in a short period of time. This is because the frequency of access and the types of access credentials both increase significantly in both the short and medium term, and the proportion of highly sensitive credentials accessed (R) is high. high The caller's activity level is significantly higher than historical levels. The caller is identified as a suspicious entity and deemed to be severely abnormal. This triggers a heavy-duty control operation, suspending its encryption capabilities and triggering an alarm to prevent further theft of privileged credentials.

[0130] This embodiment provides a dedicated risk management mechanism for the secure output of privileged credentials, enabling progressive and differentiated risk management from mild alerts to strict blocking. Based on a multi-level control strategy, mild restrictions can be applied to minor anomalies, while strong blocking can be implemented for severe anomalies. This prevents high-value credentials from being stolen in bulk or slowly crawled under the cover of legitimate identities, providing a new security paradigm for the reasonable management of privileged credentials.

[0131] In some embodiments, after determining the corresponding adaptive control action based on the anomaly level, the following steps are also included:

[0132] Based on adaptive control operations, statistical parameters within each time window are adjusted; these statistical parameters are used to calculate the dynamic access frequency threshold for subsequent requests.

[0133] Specifically, such as Figure 5 As shown, after the system completes the adaptive control operation, it triggers a statistical model update process. This process recalculates and refreshes the historical statistical parameters of the relevant callers within each time window based on the processing results and behavioral data of the current request. For example, a sliding window mechanism can be used to include the latest requests in the statistical scope and remove expired data; or an exponentially weighted moving average algorithm can be used to assign different weights to new and old data to achieve smooth updates. The updated statistical parameters will be immediately applied to subsequent dynamic threshold calculations, forming real-time feedback.

[0134] This embodiment uses historical behavior data to automatically adjust statistical parameters and dynamic thresholds, reducing reliance on manual experience for configuration and effectively alleviating the burden on operations and maintenance personnel in maintaining complex rate limiting strategies, as well as reducing the chances of missed or incorrect judgments by operations and maintenance personnel.

[0135] This embodiment also provides an adaptive control system for credential access frequency, including a behavior feature extraction module, a call pattern recognition module, a sensitivity level acquisition module, a threshold generation module, an anomaly determination module, and a control execution module;

[0136] The behavior feature extraction module is used to extract behavior feature parameters from the credential query request;

[0137] The call pattern recognition module is used to automatically identify call pattern types based on behavioral feature parameters;

[0138] The sensitivity level acquisition module is used to acquire the sensitivity level corresponding to the target credential identifier;

[0139] The threshold generation module is used to generate dynamic access frequency thresholds based on the call mode type and sensitivity level.

[0140] The anomaly detection module is used to determine the level of behavioral anomaly based on behavioral characteristic parameters and dynamic access frequency thresholds.

[0141] The control execution module is used to perform corresponding adaptive control operations based on the anomaly level.

[0142] Specifically, the credential access frequency adaptive control system includes a behavior feature extraction module, a call pattern recognition module, a sensitivity level acquisition module, a threshold generation module, an anomaly determination module, and a control execution module. The behavior feature extraction module extracts multi-dimensional behavior feature parameters from credential query requests. The call pattern recognition module automatically identifies the call pattern type based on the behavior feature parameters. The sensitivity level acquisition module acquires the sensitivity level corresponding to the target credential identifier. The threshold generation module generates a dynamic access frequency threshold based on the call pattern type and sensitivity level. The anomaly determination module determines the behavior anomaly level based on the behavior feature parameters and the dynamic access frequency threshold. The control execution module executes the corresponding adaptive control operation based on the anomaly level.

[0143] For example, such as Figure 6 As shown, firstly, the calling entity accesses the privileged access management system through a web frontend or application programming interface (API) gateway. After identity authentication by the unified authentication module and permission verification by the unified authorization module, the system-level rate limiting and load protection module performs coarse-grained control based on instance, requests per second, IP address, overall request frequency, or server load. When the system reaches the preset global rate limiting threshold, the access request is rejected or an error code is returned. If the global rate limiting threshold is not reached, the access request is forwarded to the behavior feature extraction module through the credential service interface module.

[0144] Secondly, the behavior feature extraction module receives and parses the credential query request. Based on the request content and historical query records and statistics, it extracts a set of behavior feature parameters across multiple time windows and records the current query record and feature statistics. The call pattern recognition module analyzes the input feature parameters using its built-in rule engine and outputs the corresponding call pattern type. The sensitivity level acquisition module retrieves the sensitivity level of the target privileged credential from the credential database. The threshold generation module generates dynamic access frequency thresholds across multiple time windows based on different call pattern types and sensitivity levels, and according to the statistical parameters provided by the statistical model update module. The anomaly judgment module compares the real-time frequency with the dynamic threshold and combines auxiliary query behavior features such as the high-sensitivity access ratio to complete a comprehensive anomaly level determination. The control execution module performs differentiated execution based on the judgment results. If abnormal behavior exists, access is not allowed, and different levels of adaptive control operations are executed according to the anomaly level. If no abnormal behavior exists, access is allowed, and the credential, key, password, or token is retrieved from the credential database through the query module and returned to the calling entity through the credential service interface module.

[0145] In this embodiment, the modules are linked together through clearly defined interfaces and data formats to form an automated pipeline from behavior perception to decision execution. The clear responsibilities of each module and their sequential collaboration ensure the system's stability.

[0146] In some embodiments, the credential access frequency adaptive control system further includes a statistical model update module, a password lookup module, and a credential database;

[0147] The statistical model update module is used to provide and adjust statistical parameters.

[0148] The authentication module is used to retrieve the requested data from the credential database;

[0149] The credential database is used to persistently store user-configurable sensitivity levels and credential metadata.

[0150] Specifically, after processing the current request, the statistical model update module adjusts the statistical parameters (mean and standard deviation of window access frequency) within each time window based on the latest behavioral data, thereby adaptively adjusting the dynamic threshold as the behavior of the calling entity changes. This update behavior can be implemented using a sliding window method, an exponentially weighted moving average, or a quantile estimation method based on incremental updates; the method of update behavior is not restricted here. The authentication module is used to securely retrieve and return the corresponding privileged credential from the credential database based on the target credential identifier when the control execution module allows access. The credential database provides a data source for the sensitivity level acquisition module, ensuring that the control logic is based on accurate and configurable credential risk metadata.

[0151] In this embodiment, the statistical model update module ensures that the system can continuously learn the behavioral evolution of the calling entity, enabling the dynamic threshold to have true adaptive capability and reducing the maintenance cost of static rules. The introduction of the authentication module and the dedicated credential database clarifies how the system securely and reliably completes credential delivery after the risk control logic has passed.

[0152] It should be noted that all information and data involved in this application are authorized by the user or fully authorized by all parties and will be used legally.

[0153] It should be understood that the specific embodiments described herein are merely illustrative of the application and not intended to limit it. All other embodiments derived by those skilled in the art based on the embodiments provided in this application without inventive effort are within the scope of protection of this application.

[0154] Obviously, the accompanying drawings are merely some examples or embodiments of this application. Those skilled in the art can apply this application to other similar situations based on these drawings without any creative effort. Furthermore, it is understood that although the work done in this development process may be complex and lengthy, for those skilled in the art, certain design, manufacturing, or production modifications made based on the technical content disclosed in this application are merely conventional technical means and should not be considered as insufficient disclosure of this application.

[0155] The term "embodiment" in this application refers to a specific feature, structure, or characteristic described in connection with an embodiment that may be included in at least one embodiment of this application. The appearance of this phrase in various places in the specification does not necessarily imply the same embodiment, nor does it imply that it is mutually exclusive with or independent of other embodiments. It will be clearly or implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0156] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of patent protection. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the appended claims.

Claims

1. A method for adaptive control of credential access frequency, characterized in that, include: Receive a credential query and retrieval request; the credential query and retrieval request includes a target credential identifier; Based on the credential query request, determine the behavioral characteristic parameters; The invocation mode type is determined based on the behavioral characteristic parameters; Based on the call mode type and the sensitivity level corresponding to the target credential identifier, determine the dynamic access frequency threshold for multiple time windows; Based on the behavioral characteristic parameters and the dynamic access frequency threshold, the behavioral anomaly level is determined; and according to the anomaly level, the corresponding adaptive control operation is determined.

2. The adaptive control method for credential access frequency according to claim 1, characterized in that, The determination of behavioral characteristic parameters based on the credential query request includes: Based on the credential query request and the pre-built password retrieval log, the behavioral characteristic parameters within different time windows are determined.

3. The adaptive control method for credential access frequency according to claim 1, characterized in that, The step of determining the invocation mode type based on the behavioral characteristic parameters includes: The access frequency is determined based on the number of password retrieval requests in the behavioral characteristic parameters. The invocation mode type is determined based on the access frequency, the number of privileged credentials accessed, and the proportion of high-sensitivity credentials accessed in the behavioral characteristic parameters.

4. The adaptive control method for credential access frequency according to claim 3, characterized in that, The step of determining the invocation mode type based on the access frequency, the number of privileged credentials accessed, and the proportion of high-sensitivity credentials accessed in the behavioral characteristic parameters includes: If the access frequency falls within a preset first numerical range, then the calling mode type is determined to be manual mode; If the access frequency falls within a preset second numerical range and the access time distribution conforms to a preset periodicity, then the calling mode type is determined to be program mode. If the access frequency falls within a preset third numerical range, and the number of accesses by the privileged credential is greater than a preset access number threshold, then the calling mode type is determined to be batch processing mode. If the access frequency falls within a preset fourth numerical range, and the access ratio of the high-sensitivity credential is greater than a preset access ratio threshold, then the call mode type is determined to be a suspicious mode.

5. The adaptive control method for credential access frequency according to claim 1, characterized in that, The step of determining the dynamic access frequency threshold for multiple time windows based on the sensitivity level corresponding to the call mode type and the target credential identifier includes: Based on the target credential identifier, the sensitivity level is obtained from the pre-built credential database; The dynamic access frequency threshold is determined based on the call mode type and the sensitivity level.

6. The adaptive control method for credential access frequency according to claim 1, characterized in that, The determination of the abnormal behavior level based on the behavioral feature parameters and the dynamic access frequency threshold includes: Based on the behavioral feature parameters, the current access frequency is determined; the current access frequency includes a first access frequency, a second access frequency, and a third access frequency; the dynamic access frequency threshold includes a first time window frequency threshold, a second time window frequency threshold, and a third time window frequency threshold; the first access frequency is compared with the first time window frequency threshold, the second access frequency is compared with the second time window frequency threshold, and the third access frequency is compared with the third time window frequency threshold. If only the first access frequency is greater than the first time window frequency threshold, then the behavior abnormality level is determined to be the first abnormality level; If the second access frequency is greater than the second time window frequency threshold or the third access frequency is greater than the third time window frequency threshold, then the behavior abnormality level is determined to be the second abnormality level. If the first access frequency is greater than the first time window frequency threshold or the second access frequency is greater than the second time window frequency threshold, and the access ratio of high-sensitivity credentials in the behavioral feature parameters is greater than the preset abnormal access ratio threshold, then the behavioral abnormality level is determined to be the third abnormality level.

7. The adaptive control method for credential access frequency according to claim 1, characterized in that, The step of determining the corresponding adaptive control operation based on the anomaly level includes: If the anomaly level is the first anomaly level, then the adaptive control operation is a response delay operation; If the anomaly level is the second anomaly level, then the adaptive control operation is a downgrade return operation; If the anomaly level is the third anomaly level, then the adaptive control operation is a temporary blocking operation.

8. The adaptive control method for credential access frequency according to claim 1, characterized in that, After determining the corresponding adaptive control operation based on the anomaly level, the method further includes: Based on the adaptive control operation, the statistical parameters within each time window are adjusted; the statistical parameters are used to calculate the dynamic access frequency threshold for subsequent requests.

9. A credential access frequency adaptive control system, characterized in that, It includes a behavior feature extraction module, a call pattern recognition module, a sensitivity level acquisition module, a threshold generation module, an anomaly detection module, and a control execution module; The behavior feature extraction module is used to extract behavior feature parameters from the credential query request; The call pattern recognition module is used to automatically identify the call pattern type based on the behavioral feature parameters; The sensitivity level acquisition module is used to acquire the sensitivity level corresponding to the target credential identifier; The threshold generation module is used to generate a dynamic access frequency threshold with multiple time windows based on the call mode type and the sensitivity level. The anomaly determination module is used to determine the level of behavioral anomaly based on the behavioral characteristic parameters and the dynamic access frequency threshold. The control execution module is used to perform corresponding adaptive control operations based on the anomaly level.

10. The credential access frequency adaptive control system according to claim 9, characterized in that, The system also includes a statistical model update module, a password verification module, and a voucher database; The statistical model update module is used to provide statistical parameters and adjust the statistical parameters; The authentication module is used to query the requested data from the credential database; The credential database is used to persistently store the user-configurable sensitivity level and credential metadata.

Images