A method for dynamically adjusting data trust space permission control based on data security weight

Abstract

The application relates to the technical field of data processing, and discloses a data security weight-based dynamic adjustment data trusted space permission control method. The method comprises the following steps: constructing a correlation permission matrix; assigning a basic security weight value to a data object, assigning a credit basic value to a data account, coupling the basic security weight value and the credit basic value to obtain a data security weight value; monitoring the attribute change of the data object and the behavior characteristic change of the data account in real time, updating the data security weight value to obtain an updated permission matrix; receiving an operation request, calling a north-south control permission, and checking the access permission of a target data object; when the north-south control permission is checked, the real-time security weight value is obtained, the east-west control permission in the updated permission matrix is matched, and the target operation permission is confirmed; after the target operation permission is confirmed, an operation record is generated, and the behavior characteristic is updated; and the application can improve the efficiency of dynamically adjusting the data trusted space permission control.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method for dynamically adjusting data trust space access control based on data security weights. Background Technology

[0002] Existing technologies have significant shortcomings in the permission configuration stage. They cannot construct an associated permission matrix that includes north-south and east-west control permissions for data accounts, and they do not quantify the security weights and credit base values ​​for data objects and data accounts respectively. This makes it difficult to achieve bidirectional coupling calculation between the two, resulting in a lack of scientific and unified quantitative basis for permission control.

[0003] Existing technologies have significant shortcomings in the dynamic adjustment and verification of permissions. They cannot monitor changes in data object attributes and account behavior characteristics in real time, cannot dynamically update security weights and adaptively adjust the permission matrix, do not employ a dual verification mechanism to verify access and operation permissions, and cannot generate operation records and update behavior characteristics in a closed loop after permission confirmation. This results in insufficient flexibility, accuracy, and security in permission control, making it difficult to meet the security management requirements of a trusted data space. Summary of the Invention

[0004] To address the aforementioned technical shortcomings, the present invention aims to propose a data trust space permission control method based on dynamic adjustment of data security weights. This method seeks to solve the technical problems in the prior art, such as the lack of quantitative basis and dynamic coupling mechanism for permission configuration, and the lack of real-time, adaptive, and closed-loop security guarantees in the permission adjustment and verification process.

[0005] To solve the above-mentioned technical problems, the present invention adopts the following technical solution: The present invention provides a method for dynamically adjusting the access control of trusted data space based on data security weights. The method for dynamically adjusting data trust space access control based on data security weights includes: S1: Assign north-south and east-west control permissions to the data account, and construct the associated permission matrix of the data account; S2: Assign a basic security weight value to the data object and a basic credit value to the data account. Perform bidirectional data coupling between the basic security weight value and the basic credit value to obtain the data security weight value of the data account. S3: Monitor the changes in the attributes of the data object and the changes in the behavioral characteristics of the data account in real time, update the data security weight value, and dynamically adjust the associated permission matrix to obtain the updated permission matrix of the data account; S4: Receive the operation request from the data account and call the north-south control permissions in the update permission matrix to verify the access permissions to the target data object; S5: When the north-south control permission verification passes, obtain the real-time security weight value of the target data object, match it with the east-west control permission in the updated permission matrix, and confirm the target operation permission of the data account. S6: After confirming the target operation permissions, generate the operation record of the data account and update the behavioral characteristics of the data account.

[0006] Preferably, the step of assigning north-south and east-west control permissions to data accounts and constructing an association permission matrix for the data accounts includes: Obtain the account identifier, organization identifier, and role identifier of the data account; Based on a preset access control policy library, assign north-south control permissions related to the organization identifier to the data account; Based on a preset authorization policy library, east-west control permissions related to the role identifier are assigned to the data account; Using the account identifier as an index, the north-south control permissions and the east-west control permissions are associated and mapped to obtain the association permission matrix of the data account.

[0007] Preferably, the step of assigning a basic security weight value to the data object and assigning a basic credit value to the data account includes: Obtain the data type identifier and sensitivity level identifier of the data object, and obtain the account identifier and historical behavior records of the data account. By jointly mapping the data type identifier and the sensitivity level identifier, the basic security weight value of the data object is obtained; The credibility score of the historical behavior records of the account is determined by the account identifier to obtain the basic credit value of the data account.

[0008] Preferably, the step of bidirectionally coupling the basic security weight value with the basic credit value to obtain the data security weight value of the data account includes: Using the account identifier of the data account as the association key, the basic security weight value as a static factor, and the basic credit value as a dynamic factor; By performing a bidirectional association between the static factor and the dynamic factor, the constraint relationship of the data account is obtained; The dynamic factor and the static factor are optimized by reverse compensation to obtain the correction relationship of the data account; The constraint relationship and the correction relationship are synergistically integrated to obtain the data security weight value of the data account.

[0009] Preferably, the real-time monitoring of attribute changes of the data object and behavioral characteristic changes of the data account, and updating the data security weight value, includes: Listen for data attribute change events of data objects, and dynamically parse the attribute parameters of the data attribute change events to determine the attribute change signal of the data object; Collect the operation behavior logs of the data account, extract the behavior features from the operation behavior logs, and obtain the behavior feature change signal of the data account; Based on the attribute change signal and the behavioral characteristic change signal, the data security weight value is dynamically updated to obtain the optimized security weight value of the data account.

[0010] Preferably, the step of dynamically adjusting the associated permission matrix to obtain the update permission matrix of the data account includes: Using the account identifier of the data account as an index, the data security weight value is matched with the north-south control permissions in the associated permission matrix to determine the permission level, and the north-south control permissions are adjusted according to the matching result. The optimized security weight value is matched with the east-west control permissions in the associated permission matrix at the operational granularity, and the east-west control permissions are finely adjusted according to the matching result; The control permissions after dimensional adjustment and the control permissions after fine adjustment are remapped to the associated permission matrix to obtain the update permission matrix of the data account.

[0011] Preferably, the step of receiving the operation request from the data account and invoking the north-south control permissions in the update permission matrix to verify access permissions to the target data object includes: Receive the operation request initiated by the data account, and parse the account identifier and the target data object identifier from the operation request; Using the account identifier as an index, the north-south control permissions of the data account are extracted from the update permission matrix to obtain the data domain boundary information of the data account; Based on the target data object identifier as the query condition, determine the target data field of the target data object; If the target data domain is within the range defined by the data domain boundary information, the verification is deemed successful, and the data account is allowed to access the target data object.

[0012] Preferably, when the north-south control permission verification passes, the real-time security weight value of the target data object is obtained, and the east-west control permissions in the updated permission matrix are matched to confirm the target operation permissions of the data account, including: When the data account accesses the target data object, the real-time security weight value of the target data object is obtained using the target data object identifier as an index; Extract the east-west control permissions of the data account from the updated permission matrix. The east-west control permissions include a set of operation types and a permission level threshold. The real-time security weight value is matched with the permission level threshold to determine the permission level range into which the real-time security weight value falls; Based on the permission level range, filter out the target operation types that are allowed to be executed from the operation type set; Preferably, after confirming the target operation permission, generating the operation record of the data account and updating the behavioral characteristics of the data account includes: After confirming the target operation permissions of the data account; Capture the operation type, target data object identifier, operation timestamp, and operation result status from the operation request, and combine them to obtain the operation record object of the data account; Based on the operation record object, the behavioral characteristics of the data account are incrementally updated to obtain the updated behavioral characteristics of the data account.

[0013] The beneficial effects of this invention are as follows: 1. This invention constructs an associated permission matrix and achieves bidirectional coupling of security weights, accurately associating the security attributes of data objects with the credit status of accounts, forming a unified permission control foundation, and improving the standardization and rationality of permission configuration.

[0014] 2. This invention dynamically updates security weights by monitoring data attributes and account behavior in real time, enabling adaptive adjustment of the permission matrix. It also employs a dual verification mechanism of north-south and east-west directions to confirm operation permissions and records operation behaviors to form a closed-loop management system, significantly improving the real-time performance, accuracy, and security of data trust space permission control. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is a flowchart illustrating a method for dynamically adjusting data trust space access control based on data security weights, according to an embodiment of the present invention. The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Example 1: As Figure 1 The diagram shown is a flowchart of the first embodiment of a data trust space permission control method based on data security weights according to the present invention. The present invention proposes a first embodiment of a data trust space permission control method based on data security weights.

[0019] In the first embodiment, the method for dynamically adjusting data trust space access control based on data security weights includes: S1: Assign north-south and east-west control permissions to the data account, and construct the associated permission matrix of the data account; In this embodiment of the invention, the step of assigning north-south and east-west control permissions to data accounts and constructing an association permission matrix for the data accounts includes: Obtain the account identifier, organization identifier, and role identifier of the data account; Based on a preset access control policy library, assign north-south control permissions related to the organization identifier to the data account; Based on a preset authorization policy library, east-west control permissions related to the role identifier are assigned to the data account; Using the account identifier as an index, the north-south control permissions and the east-west control permissions are associated and mapped to obtain the association permission matrix of the data account.

[0020] The system retrieves the core identification information of data accounts that have been pre-registered and archived in the system. It extracts the account identifier used to uniquely identify the account, the organization identifier used to identify the department or institution to which the account belongs, and the role identifier used to define the account's job responsibilities. This identification information comes from the account registration and archiving records of the data account management system and is the core basis for allocating permissions.

[0021] The system retrieves permission configuration rules corresponding to the organization's identifier from the system's preset access control policy library. This policy library contains standardized rules for each organization's north-south access scope and access level. Based on the organization's identifier, the system accurately matches the corresponding rules and assigns north-south control permissions to the data account that are only for the data related to the organization, ensuring that the account can only access the data at the upper and lower levels within its own organization.

[0022] The system retrieves the permission configuration rules corresponding to the role identifier from the system's preset authorization policy library. This authorization policy library contains standardized rules such as east-west operation permissions and data interaction permissions corresponding to each role. Based on the role identifier, the system accurately matches the corresponding rules and assigns east-west control permissions that are consistent with the user's job responsibilities to the data account, ensuring that the account can only perform data interaction operations at the same level that are allowed by the role.

[0023] Using the account identifier of the data account as the unique retrieval index, the allocated north-south control permissions and east-west control permissions are bound one-to-one, clarifying the relationship and scope of application of the two types of permissions. The bound permission information is organized and integrated in a unified format to form a relational permission matrix that can comprehensively reflect all permissions of the data account.

[0024] The beneficial effects are that it accurately extracts account identifiers, organization identifiers, and role identifiers, providing a unique and reliable basis for identity and ownership for permission allocation, avoiding permission mismatch and omission issues from the source, and ensuring that the basic permission configuration is accurate and stable.

[0025] Based on the access control policy library, north-south permissions are assigned to organizations, strictly limiting the data domain boundaries that accounts can access, achieving vertical data isolation between organizational levels, and reducing the security risks of unauthorized access across organizations.

[0026] Assigning east-west permissions to roles according to the authorization policy library ensures that operational permissions are precisely matched with job responsibilities, standardizes data interaction behavior among peers, and improves the compliance of business operations and the accuracy of permission control.

[0027] By using account identifiers as indexes to complete the dual-permission association mapping, a unified and complete permission matrix is ​​formed, enabling rapid permission retrieval and retrieval, improving permission management efficiency, and laying a solid foundation for subsequent dynamic adjustments.

[0028] S2: Assign a basic security weight value to the data object and a basic credit value to the data account. Perform bidirectional data coupling between the basic security weight value and the basic credit value to obtain the data security weight value of the data account. In this embodiment of the invention, assigning a basic security weight value to the data object and assigning a basic credit value to the data account includes: Obtain the data type identifier and sensitivity level identifier of the data object, and obtain the account identifier and historical behavior records of the data account. By jointly mapping the data type identifier and the sensitivity level identifier, the basic security weight value of the data object is obtained; The credibility score of the historical behavior records of the account is determined by the account identifier to obtain the basic credit value of the data account.

[0029] The step of bidirectionally coupling the basic security weight value with the basic credit value to obtain the data security weight value of the data account includes: Using the account identifier of the data account as the association key, the basic security weight value as a static factor, and the basic credit value as a dynamic factor; By performing a bidirectional association between the static factor and the dynamic factor, the constraint relationship of the data account is obtained; The dynamic factor and the static factor are optimized by reverse compensation to obtain the correction relationship of the data account; The constraint relationship and the correction relationship are synergistically integrated to obtain the data security weight value of the data account.

[0030] The system retrieves the identification information of data objects that have been pre-labeled and archived in the data management system, extracts the data type identifier used to distinguish the category to which the data belongs, and the data sensitivity level identifier used to define the confidentiality level of the data. At the same time, it retrieves the account identifier of the data account in the system and all past operation records. The identification information of the data object comes from the classification and labeling records when the data object is entered into the system, and the relevant information of the data account comes from the account file and operation log of the data account management system.

[0031] The data type identifier and sensitivity level identifier of the data object are simultaneously input into the preset mapping rules. Based on the security importance corresponding to the data type and the confidentiality requirements corresponding to the sensitivity level, a joint comparison and matching is performed to clarify the security weight standard corresponding to different combinations of types and sensitivity levels. The basic security weight value of the data object is determined according to the standard. The mapping rules are derived from the system's preset security management specifications and are used to quantify the security protection priority of the data object.

[0032] Using the account identifier of the data account as the retrieval basis, the historical behavior records of the account are retrieved one by one to check whether there are any misconducts such as unauthorized access, unauthorized operation, or data leakage in the historical operations. At the same time, the positive behaviors such as the frequency of compliant operation and the standardization of operation are confirmed. Based on the verification results, the credibility of the account is comprehensively scored, and the score result is directly used as the basic credit value of the data account. The historical behavior records are derived from the real-time operation log archive data of the data account management system.

[0033] Using the account identifier of the data account as the unique association key, the basic security weight value corresponding to the data object is used as a static factor. This basic security weight value comes from the security protection priority result determined after the data object is matched by mapping rules. The basic credit value corresponding to the data account is used as a dynamic factor. This basic credit value comes from the credibility score result obtained after verifying the historical operation behavior of the data account. The two factors are accurately associated through the account identifier to ensure that the static factor and dynamic factor of each data account correspond one-to-one, without confusion or mismatch, and to ensure the accuracy and relevance of subsequent coupling calculations.

[0034] The determined static and dynamic factors are subjected to bidirectional correlation processing. During the correlation process, the relevant values ​​of the same data account are strictly matched. The basic data security requirements reflected by the static factors and the account credibility reflected by the dynamic factors are compared one by one to clarify the correlation logic between the two. This ensures that the security priority of the static factors corresponds to the account credibility of the dynamic factors, and finally forms a constraint relationship between the data accounts. The constraint relationship can clarify the matching ratio between static and dynamic factors, providing a basis for subsequent optimization and adjustment.

[0035] Reverse compensation optimization is performed on dynamic and static factors. Combining the historical behavior records of data accounts and the security level requirements of data objects, when the credit score corresponding to a dynamic factor is low, the weight ratio of the static factor is appropriately increased to ensure that the basic requirements of data security protection are not reduced. When the credit score corresponding to a dynamic factor is high, the weight ratio of the static factor is appropriately adjusted to avoid resource waste caused by over-protection. Through this reverse compensation method, the compatibility of the two factors is ensured to reach the optimal level, and the corrected relationship of the data account is finally obtained. The corrected relationship can make up for the limitations of a single factor and improve the rationality of the overall data.

[0036] The constraints and correction relationships obtained in the early stage are synergistically integrated. During the integration process, the corresponding logic of static and dynamic factors in the constraints is fully preserved, while the optimization and adjustment ratios in the correction relationships are absorbed and redundant information is discarded. This ensures that the result of the integration not only meets the security level requirements of the data object, but also adapts to the credit status of the data account. Finally, the data security weight value of the data account is obtained. This weight value can comprehensively reflect the adaptability of the data account in data security protection, and provide an accurate basis for subsequent data security management and access control.

[0037] The beneficial effects are that it comprehensively obtains the type and sensitivity level identifiers of data objects, data account identifiers, and historical behavior records, providing a complete basis for security weight and credit value calculation, and ensuring that subsequent quantitative assessments are comprehensive and without omissions.

[0038] By jointly mapping data type and sensitivity level, a basic security weight value is obtained, realizing the standardization and quantification of data object security level, and providing a unified benchmark for data hierarchical protection and access control.

[0039] A basic credit score is obtained by conducting a credibility score based on account identifiers and historical behavior records. This score objectively reflects the compliance of account operations and provides a reliable reference for account credit rating and permission adaptation.

[0040] By using account identifiers as association keys to distinguish between static and dynamic factors, precise binding of data object security attributes and account credit status can be achieved, avoiding mismatches and omissions in coupled calculations and improving the accuracy of association.

[0041] By establishing a two-way correlation between static and dynamic factors to form a constraint relationship, the adaptation logic between data security and account credit can be clarified, providing a stable and reliable basic rule for the quantitative allocation of permissions.

[0042] By optimizing the relationship through reverse compensation of dynamic and static factors, a balance between security and efficiency can be achieved, avoiding excessively strict or lenient permissions due to deviations of a single factor, and improving the rationality of control.

[0043] By synergistically integrating constraint relationships and modification relationships to output security weight values, a comprehensive reflection of account adaptation levels can be achieved, providing a unified quantitative basis for dynamic adjustment of permissions and enhancing the scientific nature of permission control.

[0044] S3: Monitor the changes in the attributes of the data object and the changes in the behavioral characteristics of the data account in real time, update the data security weight value, and dynamically adjust the associated permission matrix to obtain the updated permission matrix of the data account; In this embodiment of the invention, the real-time monitoring of attribute changes of the data object and behavioral characteristic changes of the data account, and the updating of the data security weight value, includes: Listen for data attribute change events of data objects, and dynamically parse the attribute parameters of the data attribute change events to determine the attribute change signal of the data object; Collect the operation behavior logs of the data account, extract the behavior features from the operation behavior logs, and obtain the behavior feature change signal of the data account; Based on the attribute change signal and the behavioral characteristic change signal, the data security weight value is dynamically updated to obtain the optimized security weight value of the data account.

[0045] The step of dynamically adjusting the associated permission matrix to obtain the updated permission matrix of the data account includes: Using the account identifier of the data account as an index, the data security weight value is matched with the north-south control permissions in the associated permission matrix to determine the permission level, and the north-south control permissions are adjusted according to the matching result. The optimized security weight value is matched with the east-west control permissions in the associated permission matrix at the operational granularity, and the east-west control permissions are finely adjusted according to the matching result; The control permissions after dimensional adjustment and the control permissions after fine adjustment are remapped to the associated permission matrix to obtain the update permission matrix of the data account.

[0046] The system monitors data attribute change events for data objects originating from a dataset with pre-configured security weights. These events include various changes that may affect data security, such as data type adjustments, sensitivity level changes, and content updates. During monitoring, the system continuously captures the specific behavior of each attribute change and dynamically analyzes the attribute parameters for each event. It meticulously analyzes the changed attribute category, the specific content before and after the change, and the scope of the change, clearly distinguishing the impact of different types of attribute changes. Ultimately, it determines the attribute change signal for the data object. This signal accurately reflects the specific changes in the data object's attributes, providing a foundation for subsequent weight updates.

[0047] The system collects operation behavior logs of data accounts, which are derived from all operations performed by the data accounts within the system, including data access, modification, transmission, deletion, and other operations. During the collection process, key information such as operation time, operation content, and operation object are fully extracted from the logs. Then, behavioral feature extraction is performed on the extracted operation behavior logs to filter out core features that can reflect the account's behavioral habits and the degree of operational standardization. The frequency and scope of account operations are identified, as well as whether there are any abnormal operations. Finally, a signal of changes in the behavioral characteristics of the data account is obtained, which can comprehensively reflect the specific changes in the behavioral characteristics of the data account.

[0048] Based on the identified attribute change signals and behavioral characteristic change signals, and combined with the previously generated data security weight values, the original weight values ​​are dynamically adjusted. During the adjustment process, the changes in security requirements brought about by changes in data object attributes and the changes in creditworthiness brought about by changes in data account behavioral characteristics are fully considered. If the sensitivity level of a data object increases, the security weight ratio is increased accordingly. If an abnormal operation occurs in a data account, the weight adaptation ratio is adjusted to ensure that the adjusted weight value can accurately match the current data security requirements and account credit status. Finally, an optimized security weight value for the data account is obtained. This optimized security weight value can adapt to changes in data objects and data accounts in real time, providing a dynamic and accurate basis for data security management.

[0049] Using the account identifier of the data account as the sole retrieval criterion, which is a unique identifier generated by the system during data account registration, the system accurately locates the corresponding data account. The previously calculated data security weight value is compared and matched one by one with the north-south control permissions already assigned in the associated permission matrix. During the matching process, the system strictly adheres to the security level corresponding to the data security weight value, adjusting the level range of the north-south control permissions accordingly. If the data security weight value increases, the access level of the north-south control permissions is increased, expanding the accessible data range; if the data security weight value decreases, the access level of the north-south control permissions is decreased, narrowing the access range. This ensures that the level of the north-south control permissions accurately matches the data security weight value, completing the dimensional adjustment of the north-south control permissions. The adjusted north-south control permissions are adapted to current data security needs, avoiding security risks caused by excessively high permissions or the impact of insufficient permissions on normal use.

[0050] The optimized security weight values ​​obtained in the early stage are precisely matched with the east-west control permissions already assigned in the associated permission matrix at the operational granularity. The optimized security weight values ​​are derived from the dynamic adjustment results after changes in data object attributes and account behavior. During the matching process, the operation scope, operation permissions, and operation restrictions corresponding to the east-west control permissions are clearly defined. Based on the level of the optimized security weight values, the east-west control permissions are finely adjusted. For example, when the optimized security weight value is high, the operation restrictions can be appropriately relaxed and the types of executable operations can be increased. When the optimized security weight value is low, the operation restrictions are tightened and unnecessary operation permissions are reduced. This ensures that each east-west control permission is adapted to the optimized security weight value, realizes the fine-grained adjustment of east-west control permissions, and improves the rationality and security of permission allocation.

[0051] The north-south control permissions, adjusted by dimensionality, and the east-west control permissions, refined by fine-tuning, are unified and remapped back to the original associated permission matrix. During the mapping process, the correspondence between permissions and account identifiers is strictly maintained to ensure that each adjusted permission is accurately associated with its corresponding data account. Redundant and invalid permission information is removed from the matrix, while all valid permissions are retained, and their applicable scope and usage conditions are clearly defined. This results in an updated permission matrix for data accounts. This updated permission matrix can adapt to changes in data security weights in real time, comprehensively reflecting all current permission ranges for data accounts. It provides accurate and reliable data for controlling data access and operations. All data sources are previously confirmed account information, permission information, and security weight data, ensuring the accuracy and practicality of the updated permission matrix.

[0052] The beneficial effects are that by monitoring data object attribute change events in real time and dynamically parsing parameters, changes in data security levels can be quickly captured, and accurate attribute change signals can be generated in a timely manner, providing a reliable basis for weight updates.

[0053] By comprehensively collecting account operation logs and extracting behavioral features, the system can accurately identify the compliance and abnormal status of account operations, generate objective behavioral feature signals, and support dynamic assessment of credit dimensions.

[0054] By synchronously updating security weights based on changes in two dimensions, the weight values ​​can be matched with data risks and account credit in real time, resulting in optimized security weights and improved timeliness and accuracy of access control.

[0055] By using account identifiers as indexes to match security weights with north-south permission levels, permission dimensions can be adjusted according to security levels, allowing for precise matching of vertical access scope with data risks and strengthening boundary control capabilities.

[0056] By optimizing security weights and matching the granularity of east-west permissions, it is possible to finely control operation permissions according to risk levels, so as to achieve a proper balance between data security and business efficiency.

[0057] By remapping and integrating the adjusted permissions from both dimensions, an adaptive and updated permission matrix is ​​formed, enabling permission configuration to respond in real time to changes in data and account status, thereby improving the dynamism and accuracy of permission control.

[0058] S4: Receive the operation request from the data account and call the north-south control permissions in the update permission matrix to verify the access permissions to the target data object; In this embodiment of the invention, receiving the operation request from the data account and invoking the north-south control permissions in the update permission matrix to verify access permissions to the target data object includes: Receive the operation request initiated by the data account, and parse the account identifier and the target data object identifier from the operation request; Using the account identifier as an index, the north-south control permissions of the data account are extracted from the update permission matrix to obtain the data domain boundary information of the data account; Based on the target data object identifier as the query condition, determine the target data field of the target data object; If the target data domain is within the range defined by the data domain boundary information, the verification is deemed successful, and the data account is allowed to access the target data object.

[0059] The system receives operation requests initiated by data accounts on the system operation interface. These requests contain account authentication information and target data access instructions. The system parses the complete content of the operation request segment by segment, extracting the unique corresponding account identifier and target data object identifier. The account identifier is used to locate the data account that initiated the request, and the target data object identifier is used to locate the target data object to be accessed. Both types of identifiers are derived from the standard interaction information carried in the operation request.

[0060] Using the parsed account identifier as the unique search index, a precise search and match is performed in the system's stored updated permission matrix. The updated permission matrix is ​​derived from the permission configuration results dynamically adjusted in the early stage based on security weights. After a successful search, the north-south control permissions corresponding to the data account are extracted. From the north-south control permissions, the upper and lower limits of the data range that the account can access are further parsed to form the data domain boundary information of the data account.

[0061] The extracted target data object identifier is used as the core query condition. A full-domain search is performed in the system data resource catalog to locate the actual storage location and data category of the target data object in the system. Based on the data classification and hierarchical division results, the specific data range to which the target data object belongs is determined, and finally the target data domain of the target data object is determined.

[0062] The system compares the identified target data domain with the data domain boundary information of the data account item by item to determine whether the target data domain is completely within the accessible range defined by the data domain boundary information. If the comparison result satisfies the inclusion relationship, the access permission verification is directly determined to be successful, the system allows the current operation request, and the data account is allowed to perform subsequent access operations on the target data object.

[0063] The beneficial effect is that it can accurately parse the account identifier and the target data object identifier from the operation request, providing a unique and reliable basis for identity and object verification, and avoiding confusion and errors in verification objects from the source.

[0064] By using account identifiers as indexes to extract north-south control permissions and obtain data domain boundary information, the legitimate access scope of an account can be quickly identified, providing a clear judgment standard for vertical permission verification.

[0065] Determining the target data domain based on the target data object identifier can accurately locate the range of the data to be accessed, providing a precise reference for boundary comparison and ensuring the authenticity and validity of the verification results.

[0066] By comparing the target data domain with boundary information to determine the verification result, automated access permission verification is achieved, effectively blocking unauthorized access and improving the access security of the data trust space.

[0067] S5: When the north-south control permission verification passes, obtain the real-time security weight value of the target data object, match it with the east-west control permission in the updated permission matrix, and confirm the target operation permission of the data account. In this embodiment of the invention, when the north-south control permission verification passes, the real-time security weight value of the target data object is obtained, and the east-west control permissions in the updated permission matrix are matched to confirm the target operation permissions of the data account, including: When the data account accesses the target data object, the real-time security weight value of the target data object is obtained using the target data object identifier as an index; Extract the east-west control permissions of the data account from the updated permission matrix. The east-west control permissions include a set of operation types and a permission level threshold. The real-time security weight value is matched with the permission level threshold to determine the permission level range into which the real-time security weight value falls; Based on the permission level range, filter out the target operation types that are allowed to be executed from the operation type set; The target operation type is used as the target operation permission for the data account.

[0068] Upon receiving a request to access a target data object from a data account, the system first accurately identifies the data account identifier and the target data object identifier in the request. The data account identifier is a unique identity identifier that the data account has pre-registered and archived in the system. The target data object identifier is a core identifier of the target data object that has been configured with security weights and archived in the system. Using the target data object identifier as the sole retrieval criterion, the system locates the corresponding target data object in the system's data resource library. The system then extracts the real-time security weight value of the target data object after dynamic security weight calculation. This real-time security weight value is derived from the security weight result that has been dynamically adjusted in the early stage based on data attributes and account credit, and can accurately reflect the security level and access priority of the target data object.

[0069] Using the parsed data account identifier as a unique index, a comprehensive search is performed in the updated permission matrix. The updated permission matrix is ​​derived from the complete permission configuration results dynamically adjusted in the early stage by combining data security weights and account credit levels. During the search process, the unique identifier of the data account is strictly matched to ensure that the extracted permission information completely corresponds to the data account. From this, the east-west control permissions corresponding to the data account are accurately extracted. All content of the east-west control permissions comes from the system's preset permission configuration specifications and the data account's credit level assessment results. This includes an operation type set consisting of all operation types that the data account can execute, as well as permission level thresholds used to define the scope of operations and permission levels. The operation type set clarifies all compliant operations that the data account can perform, and the permission level thresholds are used to divide the scope of operation permissions corresponding to different security weights.

[0070] The real-time security weight value of the extracted target data object is comprehensively compared with the permission level threshold in the east-west control permissions extracted from the updated permission matrix. During the comparison process, the real-time security weight value is compared with the permission level threshold of each level one by one to clarify the specific range of the real-time security weight value, ensuring the accuracy and uniqueness of the matching process and preventing permission level confusion. This matching process does not require complex calculations and is completed only through fixed range comparison rules, ensuring the consistency and reliability of the results. The data sources are all permission configuration and security weight data that have been archived in the system.

[0071] Based on the permission level range into which the real-time security weight value falls, the extracted set of operation types for east-west control permissions is filtered. The filtering process strictly follows the operation permission range corresponding to the permission level range, filtering out all operation types in the set that meet the requirements of the current permission level range and removing operation types that exceed the current permission level. The filtering basis comes from the system's preset rules for the correspondence between permission levels and operation types, ensuring that the filtered operation types all conform to the permission range of the data account. The filtering result is the target operation type that the data account can execute.

[0072] The selected target operation types are summarized and organized, and the specific operation scope and execution requirements of each target operation type are clarified. It is ensured that all target operation types are fully matched with the real-time security weight and east-west control permissions of the data account. The summarized target operation types are determined as the target operation permissions of the data account for the current target data object. All content of the target operation permissions comes from the matching results of east-west control permissions and real-time security weights. This can ensure that the data account can operate on the target data object within the scope of compliance, avoid security risks caused by unauthorized access or improper operation, and at the same time ensure the rationality and relevance of permission allocation, providing a clear basis for the security management of subsequent data operations.

[0073] The beneficial effect is that by using the target data object identifier as an index to obtain the real-time security weight value, it can accurately reflect the current security level of the data and provide an objective and dynamic quantitative basis for determining operation permissions.

[0074] Extracting east-west permissions containing operation type sets and thresholds from the updated permission matrix can provide standardized rules for permission matching, ensuring unified, standardized, and traceable permission control.

[0075] By matching real-time security weights with permission level thresholds to define the range, permission levels can be automatically divided, improving the efficiency of permission determination and avoiding errors and delays caused by manual judgment.

[0076] By filtering compliant operation types according to permission level ranges, it is possible to accurately limit the operations that an account can perform, achieve fine-grained control, and take into account both data security and reasonable business operation needs.

[0077] Using the screening results as the final target for operation permissions, a complete closed-loop verification is formed to ensure that permissions are highly compatible with data risks and account credit, thereby improving the level of security control in the trusted space.

[0078] S6: After confirming the target operation permissions, generate the operation record of the data account and update the behavioral characteristics of the data account.

[0079] In this embodiment of the invention, the step of generating an operation record for the data account and updating the behavioral characteristics of the data account after confirming the target operation permission includes: After confirming the target operation permissions of the data account; Capture the operation type, target data object identifier, operation timestamp, and operation result status from the operation request, and combine them to obtain the operation record object of the data account; Based on the operation record object, the behavioral characteristics of the data account are incrementally updated to obtain the updated behavioral characteristics of the data account.

[0080] After receiving an operation request from a data account for a target data object, the system first completes the target operation permission verification process to confirm that the data account has the permission to perform the corresponding operation. The verification is based on the north-south and east-west control permissions corresponding to the data account in the updated permission matrix. The result of the permission verification directly corresponds to the previously determined target operation permission, ensuring that the data account's operation request complies with the system's security control requirements. All permission information used in this permission verification process comes from the updated permission matrix, and the information in the permission matrix comes from the data account's identity information, behavior records, and security weight calculation results.

[0081] The system comprehensively analyzes operation requests initiated by data accounts, accurately capturing key information, including the type of operation the data account intends to perform (which must be completely consistent with the allowed operation types in the target operation permissions), the target data object identifier (derived from the unique identifier of the target data object already archived in the system), and the timestamp of the operation initiation (generated according to the system's unified time recording standard, accurately recording the specific moment the operation was initiated) and the result status after the operation execution (divided into success and failure). All captured information is integrated according to a fixed format to form a complete operation record object. This operation record object fully retains all key information of the operation, serving as the core basis for subsequent behavioral feature updates.

[0082] Based on the generated operation record object, the original behavioral characteristics of the data account are incrementally updated. During the update process, the original archived historical behavioral records are not changed. Only the relevant characteristics of the current operation are added to the original records. Specifically, the operation type, operation time, operation object, operation result and other information of the current operation are integrated into the original behavioral characteristics. The operation preferences, operation frequency and operation norms of the data account are clearly recorded. The updated behavioral characteristics can comprehensively reflect the latest operation habits and behavior patterns of the data account. The data sources are all the operation record objects generated this time and the historical operation records of the data account, ensuring that the updated behavioral characteristics are true and complete, and providing a reliable behavioral basis for subsequent permission adjustment and security control.

[0083] The beneficial effect is that by confirming the target's operation permissions before executing subsequent processes, all operations can be carried out within the scope of legal authorization, eliminating unauthorized operations from the source and improving the operational security of the data trust space.

[0084] It accurately captures operation type, data object identifier, timestamp and result status and generates record objects, which can completely retain the information of the entire operation chain and provide a reliable basis for audit traceability and risk verification.

[0085] Based on incremental updates of account behavior characteristics based on operation records, the latest operation habits and compliance status of accounts can be synchronized in real time, providing real and reliable data support for subsequent dynamic adjustments to security weights and permissions.

[0086] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0087] This application embodiment can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence is the theory, method, technology, and application system that uses digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0088] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A method for dynamically adjusting data trust space access control based on data security weights, characterized in that, The method includes: S1: Assign north-south and east-west control permissions to the data account, and construct the associated permission matrix of the data account; S2: Assign a basic security weight value to the data object and a basic credit value to the data account. Perform bidirectional data coupling between the basic security weight value and the basic credit value to obtain the data security weight value of the data account. S3: Monitor the changes in the attributes of the data object and the changes in the behavioral characteristics of the data account in real time, update the data security weight value, and dynamically adjust the associated permission matrix to obtain the updated permission matrix of the data account; S4: Receive the operation request from the data account and call the north-south control permissions in the update permission matrix to verify the access permissions to the target data object; S5: When the north-south control permission verification passes, obtain the real-time security weight value of the target data object, match it with the east-west control permission in the updated permission matrix, and confirm the target operation permission of the data account. S6: After confirming the target operation permissions, generate the operation record of the data account and update the behavioral characteristics of the data account.

2. The method for dynamically adjusting data trust space access control based on data security weights as described in claim 1, characterized in that, The process of assigning north-south and east-west control permissions to data accounts and constructing an associated permission matrix for the data accounts includes: Obtain the account identifier, organization identifier, and role identifier of the data account; Based on a preset access control policy library, assign north-south control permissions related to the organization identifier to the data account; Based on a preset authorization policy library, east-west control permissions related to the role identifier are assigned to the data account; Using the account identifier as an index, the north-south control permissions and the east-west control permissions are associated and mapped to obtain the association permission matrix of the data account.

3. The method for dynamically adjusting data trust space access control based on data security weights as described in claim 1, characterized in that, Assigning basic security weight values ​​to data objects and assigning basic credit values ​​to data accounts includes: Obtain the data type identifier and sensitivity level identifier of the data object, and obtain the account identifier and historical behavior records of the data account. By jointly mapping the data type identifier and the sensitivity level identifier, the basic security weight value of the data object is obtained; The credibility score of the historical behavior records of the account is determined by the account identifier to obtain the basic credit value of the data account.

4. The data trust space access control method based on dynamic adjustment of data security weight as described in claim 3, characterized in that, The step of bidirectionally coupling the basic security weight value with the basic credit value to obtain the data security weight value of the data account includes: Using the account identifier of the data account as the association key, the basic security weight value as a static factor, and the basic credit value as a dynamic factor; By performing a bidirectional association between the static factor and the dynamic factor, the constraint relationship of the data account is obtained; The dynamic factor and the static factor are optimized by reverse compensation to obtain the correction relationship of the data account; The constraint relationship and the correction relationship are synergistically integrated to obtain the data security weight value of the data account.

5. The method for dynamically adjusting data trust space access control based on data security weights as described in claim 1, characterized in that, The real-time monitoring of attribute changes of the data object and behavioral characteristic changes of the data account, and updating the data security weight value, includes: Listen for data attribute change events of data objects, and dynamically parse the attribute parameters of the data attribute change events to determine the attribute change signal of the data object; Collect the operation behavior logs of the data account, extract the behavior features from the operation behavior logs, and obtain the behavior feature change signal of the data account; Based on the attribute change signal and the behavioral characteristic change signal, the data security weight value is dynamically updated to obtain the optimized security weight value of the data account.

6. The method for dynamically adjusting data trust space access control based on data security weights as described in claim 5, characterized in that, The step of dynamically adjusting the associated permission matrix to obtain the updated permission matrix of the data account includes: Using the account identifier of the data account as an index, the data security weight value is matched with the north-south control permissions in the associated permission matrix to determine the permission level, and the north-south control permissions are adjusted according to the matching result. The optimized security weight value is matched with the east-west control permissions in the associated permission matrix at the operational granularity, and the east-west control permissions are finely adjusted according to the matching result; The control permissions after dimensional adjustment and the control permissions after fine adjustment are remapped to the associated permission matrix to obtain the update permission matrix of the data account.

7. The method for dynamically adjusting data trust space access control based on data security weights as described in claim 1, characterized in that, The step of receiving the operation request from the data account and invoking the north-south control permissions in the update permission matrix to verify access permissions to the target data object includes: Receive the operation request initiated by the data account, and parse the account identifier and the target data object identifier from the operation request; Using the account identifier as an index, the north-south control permissions of the data account are extracted from the update permission matrix to obtain the data domain boundary information of the data account; Based on the target data object identifier as the query condition, determine the target data field of the target data object; If the target data domain is within the range defined by the data domain boundary information, the verification is deemed successful, and the data account is allowed to access the target data object.

8. The method for dynamically adjusting data trust space access control based on data security weights as described in claim 1, characterized in that, When the north-south control permission verification passes, the real-time security weight value of the target data object is obtained, and it is matched with the east-west control permissions in the updated permission matrix to confirm the target operation permissions of the data account, including: When the data account accesses the target data object, the real-time security weight value of the target data object is obtained using the target data object identifier as an index; Extract the east-west control permissions of the data account from the updated permission matrix. The east-west control permissions include a set of operation types and a permission level threshold. The real-time security weight value is matched with the permission level threshold to determine the permission level range into which the real-time security weight value falls; Based on the permission level range, filter out the target operation types that are allowed to be executed from the operation type set; The target operation type is used as the target operation permission for the data account.

9. The method for dynamically adjusting data trust space access control based on data security weights as described in claim 1, characterized in that, After confirming the target operation permissions, the step of generating the operation record of the data account and updating the behavioral characteristics of the data account includes: After confirming the target operation permissions of the data account; Capture the operation type, target data object identifier, operation timestamp, and operation result status from the operation request, and combine them to obtain the operation record object of the data account; Based on the operation record object, the behavioral characteristics of the data account are incrementally updated to obtain the updated behavioral characteristics of the data account.

Images