Intranet information security integrated comprehensive management platform

Abstract

The application belongs to the technical field of internal network information security, and discloses an internal network information security integrated comprehensive management platform, which comprises a traffic collection module, a secret level constraint module and a permission control module. The traffic collection module is used for performing bypass mirroring and terminal probe collection on internal network traffic, generating traffic marking records, performing illegal external connection and network access verification on the traffic marking records, and outputting compliance event records. The secret level constraint module is used for constructing a data object derived directed graph according to the traffic marking records, setting the secret level attribute of the data object as the maximum value in the predecessor node secret level attribute when the data object is copied, excerpted or merged, and performing authorized constraint on the secret level reduction operation, and only allowing the execution when there is an authorized decryption record, otherwise a secret level violation alarm is generated. The permission control module is used for generating a permission time token based on the secret level attribute. Thus, the real-time monitoring capability of internal network information security and the rapid disposal capability of illegal behavior are significantly improved.

Description

Technical Field

[0001] This invention relates to the field of intranet information security technology, and more specifically, to an integrated management platform for intranet information security. Background Technology

[0002] In existing intranet information security management, the issue of security identifier inheritance during the copying, extraction, or merging of data objects is often involved. However, most solutions only perform simple permission or security level inheritance processing on data from a single source, lacking unified constraints on the security level relationship between multiple sources of data. Therefore, inaccurate security level identification is prone to occur during data flow, such as low-security level data covering high-security level data, or derived data failing to accurately reflect the highest security level of its source data.

[0003] In terms of adjusting data security levels, existing technologies often rely on manual approval or decentralized access control to achieve data declassification. This approach lacks a strong binding mechanism with authorized behavior, resulting in insufficient transparency in the declassification process and difficulty in achieving full traceability. At the same time, it also lacks the ability to automatically identify and alert on abnormal declassification behavior.

[0004] In terms of access control, existing token or permission management mechanisms typically use fixed expiration dates or simple time-based polling to manage token status. In scenarios with a large number of tokens or high concurrency, this makes it difficult to handle token expiration issues promptly and efficiently, easily leading to permission remnants or delayed expiration. Furthermore, these mechanisms generally only consider the time dimension and do not incorporate usage frequency control, potentially causing tokens to be overused within their validity period.

[0005] Furthermore, when a token expires or is revoked, existing systems often fail to effectively link failed access behavior with security audit logs, resulting in a lack of unified records of abnormal access and making subsequent security analysis and tracing difficult.

[0006] In view of this, the present invention proposes an integrated management platform for intranet information security to solve the above problems. Summary of the Invention

[0007] To overcome the aforementioned deficiencies of the existing technology and to achieve the above objectives, the present invention provides the following technical solution: an integrated management platform for intranet information security, comprising: The traffic acquisition module is used to perform bypass mirroring and terminal probe acquisition on intranet traffic, generate traffic tag records, perform unauthorized external connections and network access verification on the traffic tag records, and output compliance event records. The security level constraint module is used to construct a directed graph of data object derivation based on traffic marking records. When a data object undergoes a derivation operation, the security level attribute of the data object is set to the maximum value in the security level attribute of the predecessor node, and authorization constraints are applied to the security level reduction operation. It is only allowed to be executed when there is an authorized decryption record; otherwise, a security level violation alarm is generated. The access control module is used to generate time-limited access tokens based on security level attributes, automatically recycle expired tokens using a min-heap structure, and trigger invalidation processing when the token's usage count reaches zero, outputting access exception records. The event logging module is used to combine compliance event logs and access anomaly logs to generate security event work orders, and drive the preset state machine to generate intranet security data. The execution module is used to visualize intranet security data, generate compliance monitoring views and provide them to security management personnel. It also provides an instruction issuance interface to trigger execution blocking or token revocation instructions.

[0008] Preferably, the method for generating traffic tag records includes: By setting up a bypass mirroring acquisition channel in the intranet communication link, the mirrored traffic in the switching or routing equipment is copied and acquired, and network traffic data is collected without changing the original service forwarding path. Meanwhile, probe components deployed on intranet terminals are used to monitor the network communication behaviors initiated, received, and forwarded by the terminals, and to obtain corresponding terminal behavior data. The collected network traffic data and terminal behavior data are aligned according to timestamps, and a session 5-tuple is constructed based on the source address, destination address, source port, destination port and transmission protocol type to associate data belonging to the same communication session. Based on the association results, terminal identification information, session 5-tuple information, and traffic load feature information are extracted, and then encapsulated to generate corresponding traffic tag records.

[0009] Preferably, the method for outputting compliance event logs includes: The destination address information in the traffic tagging record is parsed and compared with the preset set of trusted internal network addresses to determine whether there is any unauthorized external connection behavior to access an unauthorized external network. Based on the session 5-tuple information in the traffic tagging record, the protocol type and port access characteristics are verified to identify whether there is unauthorized protocol communication or uncontrolled port access behavior; based on the terminal identifier in the traffic tagging record, the preset access permission set of the corresponding terminal is queried; the preset access permission set is matched with the current access target to determine whether the network access conditions are met. When any verification result does not meet the preset verification conditions, the traffic tag record is marked as abnormal, and the abnormal state, terminal identifier, session 5-tuple information and abnormal type are encapsulated to generate the corresponding compliance event record.

[0010] Preferably, the method for constructing a directed graph derived from data objects includes: Traffic marker records are used as data object nodes, and several data object nodes belonging to the same terminal are merged based on terminal identification information to form a set of data object nodes indexed by the terminal. The communication session relationships between different data object nodes are matched based on the session quintuple information to determine the session-level association between data object nodes; the generation sequence relationship between data object nodes is sorted and identified based on the timestamp information in the traffic tag record. Directed edges are established between data object nodes with sequential temporal dependencies to represent the generative associations between data objects; the data object nodes and directed edge relationships are structurally encapsulated to generate a data object derived directed graph.

[0011] Preferably, the method for generating a security level violation alarm includes: After the data object derivation directed graph is constructed, when a data object derivation operation is detected, the set of predecessor data object nodes of the data object participating in the current derivation operation is determined in the data object derivation directed graph, and the security level attribute value corresponding to each predecessor data object node in the predecessor data object node set is obtained; the derivation operation includes copy, extract or merge operation; Set the security level attribute of the derived data object to the maximum value among the security level attribute values ​​of the predecessor data object node; and set authorization constraints for the security level reduction operation of the data object. The security level reduction operation is allowed only if an authorized decryption record corresponding to the target data object is detected. Otherwise, the security level reduction operation is rejected and a security level violation alarm record is generated.

[0012] Preferably, the method for generating a time-limited access token based on the security level attribute includes: The basic permission set is determined based on the security level attribute of the target data object, and the access permission boundary is defined for different security levels based on the preset security level and permission mapping relationship. When there is a need for temporary authorization, the basic permission set is expanded to form a temporary authorization permission set, and the temporary authorization permission set is merged with the basic permission set to obtain the token authorization permission set. The temporary authorization permission set is structured and encapsulated to generate a permission expiration token. The permission expiration token includes the authorization subject identifier, permission set, effective timestamp, expiration timestamp, and maximum number of uses parameter. The effective timestamp, expiration timestamp, and maximum number of uses of the permission expiration token are dynamically adjusted according to the security level attribute to realize the mapping relationship between the security level and the permission constraint strength.

[0013] Preferably, the method for outputting access exception records includes: Construct a min-heap queue with the expiration timestamp of the permission expiration token as the priority key, automatically recycle expired tokens, and maintain valid permission expiration tokens in an ordered manner according to their expiration timestamps; Based on the current platform time, the top token of the min-heap queue is periodically checked. When the current time is detected to be greater than the expiration timestamp of the top token, the top token is removed from the queue and the corresponding permission revocation operation is performed. At the same time, a maximum number of uses parameter is set for each permission-validated token, and the remaining number of uses is decremented each time the token is accessed and hit. When the remaining usage count decreases to zero, the token invalidation mechanism is immediately triggered and the access permissions corresponding to the token are revoked; when the token invalidation or revocation causes the access request to fail to meet the access control judgment conditions, a corresponding access exception record is generated.

[0014] Preferably, the method for generating intranet security data includes: Compliance event records and access anomaly records are correlated and matched according to timestamp and terminal identifier, and records that meet the conditions of the same terminal identifier or the same session identifier are aggregated to generate security event description units; security event work orders are generated based on security event description units; The security event work order is input into the preset state machine for state transition processing. Based on the event triggering conditions, the state is driven to migrate between different stages. When the state machine completes all transitions and enters the closed loop state, intranet security data is generated.

[0015] Preferably, the method for generating a compliance monitoring view and providing it to security management personnel includes: The internal network security data is parsed to extract security event type information, terminal identification information, time information, and event processing status information. The security event type information is classified according to different event categories, and statistical charts showing the distribution of different event quantities are generated based on the classification results. Terminal identification information is categorized and summarized according to terminal dimension, and a correlation chart is generated to show the correspondence between terminals and events; time information is sorted according to chronological order, and a time series chart is generated to show the order in which events occur; event processing status information is categorized according to status type, and a process display chart is generated to show the progress of event processing. The platform summarizes and displays statistical charts, correlation charts, time series charts, and process display charts to generate a compliance monitoring view, and provides different display contents in the compliance monitoring view to security management personnel.

[0016] Preferably, the method for triggering the execution of a blocking or token revocation instruction includes: Based on the handling instructions input by the compliance monitoring view, the security management personnel parse the handling instructions, identify the handling instruction type and the corresponding target object identifier; when the handling instruction is a blocking instruction, the target terminal identifier is sent to the traffic acquisition module, triggering the blocking of the network communication corresponding to the target terminal; When the disposal instruction is a token revocation instruction, the target permission expiration token identifier is sent to the permission control module to trigger the expiration process of the corresponding permission expiration token; and the execution result of the disposal instruction is recorded to update the corresponding display content in the compliance monitoring view.

[0017] Compared with the prior art, the present invention has the following beneficial effects: This invention constructs a directed graph of data object derivation and determines the security level of derived data objects based on the maximum value of the security level attribute of the predecessor data object node. This allows derived data to automatically inherit the highest security level of the source data, achieving security level consistency maintenance in multi-source data fusion scenarios, avoiding the problem of low security levels overwriting high security levels, and improving the security and consistency of data throughout its entire lifecycle. Secondly, a constraint mechanism based on authorized decryption records is added to the security level reduction operation. Declassification is only allowed when authorized records that meet the conditions are detected, constraining security level change behavior from a control perspective and improving the controllability and auditability of security level adjustments. Simultaneously, violation alarms are automatically generated for declassification behaviors that do not meet the authorization conditions, enabling real-time detection of abnormal declassification records and improving the response and risk prevention capabilities of internal network data security.

[0018] By constructing a min-heap queue with token expiration timestamps as priority keys, all time-limited permission tokens are managed in a unified and orderly manner. This allows the system to prioritize processing the earliest expired tokens, enabling rapid identification and automatic revocation of expired tokens and improving the efficiency of token lifecycle management. Simultaneously, a usage count decrement mechanism is incorporated into token management. A maximum usage limit is set for each token; the count is decremented with each successful access, and the token is immediately invalidated when the count reaches zero. This dual constraint of time and usage count enhances the granularity of access control. Finally, during access control judgment, token validity and permission sets are integrated into a unified judgment logic. When token expiration or revocation causes access to fail, an access exception record is automatically generated, enabling structured recording and traceable management of access failures, thus improving the auditing and security management capabilities of internal network access behavior. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of the integrated management platform for intranet information security according to the present invention; Figure 2 This is a schematic diagram of the integrated management method for intranet information security according to the present invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Example

[0021] Please see Figure 1 As shown, this embodiment provides an integrated management platform for intranet information security, specifically including the following steps: The traffic acquisition module is used to perform bypass mirroring and terminal probe acquisition on intranet traffic, generate traffic tag records, perform unauthorized external connections and network access verification on the traffic tag records, and output compliance event records. The security level constraint module is used to construct a directed graph of data object derivation based on traffic marking records. When a data object undergoes a derivation operation, the security level attribute of the data object is set to the maximum value in the security level attribute of the predecessor node, and authorization constraints are applied to the security level reduction operation. It is only allowed to be executed when there is an authorized decryption record; otherwise, a security level violation alarm is generated. The access control module is used to generate time-limited access tokens based on security level attributes, automatically recycle expired tokens using a min-heap structure, and trigger invalidation processing when the token's usage count reaches zero, outputting access exception records. The event logging module is used to combine compliance event logs and access anomaly logs to generate security event work orders, and drive the preset state machine to generate intranet security data. The execution module is used to visualize intranet security data, generate compliance monitoring views and provide them to security management personnel. It also provides an instruction issuance interface to trigger execution blocking or token revocation instructions.

[0022] Methods for generating traffic tag records include: By setting up a bypass mirroring acquisition channel in the intranet communication link, the mirrored traffic in the switching or routing equipment is copied and acquired, and network traffic data is collected without changing the original service forwarding path. Meanwhile, probe components deployed on intranet terminals are used to monitor the network communication behaviors initiated, received, and forwarded by the terminals, and to obtain corresponding terminal behavior data. The collected network traffic data and terminal behavior data are aligned according to timestamps, and a session 5-tuple is constructed based on the source address, destination address, source port, destination port and transmission protocol type to associate data belonging to the same communication session. Based on the association results, terminal identification information, session 5-tuple information, and traffic load feature information are extracted, and then encapsulated to generate corresponding traffic tag records.

[0023] For example, in an intranet operating environment, user Zhang accesses an intranet file server (IP address 10.10.5.100) via terminal Y (IP address 10.10.1.25) and downloads a file named "Project Materials.docx". During this process, the platform first replicates the network traffic of this communication session through a bypass mirroring acquisition channel deployed on the switching or routing equipment. Without affecting the original service forwarding path, it collects the corresponding data packet information, including the source address 10.10.1.25, destination address 10.10.5.100, source port 52341, destination port 445, and the transport protocol TCP, thus forming the basic communication traffic data.

[0024] Simultaneously, the probe component deployed on terminal Y monitors the terminal's local behavior, capturing user Zhang's file download operation in the Word process (WINWORD.EXE), identifying the file name as "Project Materials.docx," and recording the file's local path and operation time. Subsequently, the platform aligns the network traffic data collected by the bypass mirror with the behavioral data obtained by the terminal probe based on timestamps, and constructs a session 5-tuple based on source address, destination address, source port, destination port, and protocol type, thereby classifying network transmission behavior and terminal operation behavior into the same communication session.

[0025] After completing the association, the platform further extracts terminal identification information, session 5-tuple information, and traffic payload characteristic information. The payload characteristics are used to create a structured summary of the transmitted content, characterizing the file type and attribute features carried in the communication. Finally, the platform uniformly encapsulates the terminal identification, session 5-tuple, and payload characteristics to generate a corresponding traffic tag record. This record is used for subsequent compliance checks, access control verification, and data object association analysis, thereby achieving a structured and traceable representation of intranet communication behavior.

[0026] Methods for outputting compliance event logs include: The destination address information in the traffic tagging record is parsed and compared with the preset set of trusted internal network addresses to determine whether there is any unauthorized external connection behavior to access an unauthorized external network. Specifically, the platform extracts session-level network identification information from traffic tagging records and standardizes the destination address field, converting it into a comparable network identification representation. This representation includes one or more combinations of IP addresses, domain names, or Uniform Resource Identifiers. Subsequently, the parsed destination address information is compared item by item with a pre-built set of trusted internal network addresses. This set represents the range of internal network addresses or controlled communication addresses that the platform allows access to. If the destination address information does not belong to the pre-built set of trusted internal network addresses, it is determined that there is unauthorized external connection behavior attempting to access an unauthorized external network.

[0027] Based on the session 5-tuple information in the traffic tagging record, the protocol type and port access characteristics are verified to identify whether there is unauthorized protocol communication or uncontrolled port access behavior; based on the terminal identifier in the traffic tagging record, the preset access permission set of the corresponding terminal is queried; the preset access permission set is matched with the current access target to determine whether the network access conditions are met. The platform extracts the source address, destination address, source port, destination port, and transport protocol type from the session's 5-tuple. It then matches the protocol type against a preset set of allowed protocols and compares the port information against a preset set of controlled ports to identify any unauthorized protocol communication or uncontrolled port access. If the protocol type does not belong to the allowed protocol set, or the port information does not belong to the controlled port range, the platform determines that the session has an abnormal communication protocol or port access.

[0028] The access permission scope of the user or device to which the terminal belongs is determined based on the terminal identifier, and this permission scope is compared with the access object pointed to by the current session's five-tuple to determine whether the terminal has the authorized ability to access the network resource or service. If the access target is not in the terminal's access permission set, the access behavior is determined to not meet the network access conditions.

[0029] When any verification result does not meet the preset verification conditions, the traffic tag record is marked as abnormal, and the abnormal state, terminal identifier, session 5-tuple information and abnormal type are encapsulated to generate the corresponding compliance event record.

[0030] In this embodiment, it should be noted that the preset verification conditions are a comprehensive set of constraint rules used by the platform to determine whether a traffic tagging record conforms to the intranet security access specification. These conditions include one or more of the following: the destination address belongs to the intranet trusted address set; the protocol type belongs to the allowed protocol set; the access port belongs to the controlled port set; and the terminal access target belongs to its preset access permission set. These conditions can be met individually or in combination, and are used to comprehensively determine access behavior. When any verification result fails to meet the preset verification conditions, the platform marks the traffic tagging record as abnormal and generates a compliance event record.

[0031] For example, in a specific application scenario, terminal Y accesses an external internet IP address, 8.8.8.8. After resolving the destination address, the platform finds that it does not belong to the internal network's trusted address set, thus determining it as unauthorized external connection behavior. Simultaneously, this access uses a non-permitted protocol type for communication, and the destination port is not within the controlled port range. Furthermore, the terminal's access permission set does not include this external access target. Since any of the above conditions fail to meet the preset verification criteria, the platform ultimately marks this traffic as abnormal and generates a corresponding compliance event record for subsequent security auditing and handling.

[0032] Methods for constructing directed graphs derived from data objects include: Traffic marker records are used as data object nodes, and several data object nodes belonging to the same terminal are merged based on terminal identification information to form a set of data object nodes indexed by the terminal. The communication session relationships between different data object nodes are matched based on the session quintuple information to determine the session-level association between data object nodes; the generation sequence relationship between data object nodes is sorted and identified based on the timestamp information in the traffic tag record. In this embodiment, it should be noted that the platform uses a 5-tuple as a unified matching key to index and match data object nodes. When two or more data object nodes meet the consistency conditions in source address, destination address, port combination, and protocol type, they are determined to belong to the same communication session, and a session-level association relationship is established between these data object nodes, thus forming a node association structure centered on the communication session. This session-level association relationship is used to characterize the logical consistency and attribution relationship of the same network communication process among different data objects. Multiple data object nodes belonging to the same communication session set are arranged in ascending order according to their timestamps, and the generation sequence of data objects is determined according to the chronological order. When the data object corresponding to a subsequent timestamp is a continuation record or derived record generated based on the previous data object, the previous data object is used as the generation source of the subsequent data object, thereby establishing a directed time dependency relationship between data objects.

[0033] For example, in a specific application scenario of the platform, terminal Y initiates a connection request to the server at 09:30:01, generating the first traffic marker record; at 09:30:03, it continues downloading a file, generating the second traffic marker record; and at 09:30:05, it completes the file writing, generating the third traffic marker record. The platform identifies that all three records belong to the same source and destination address communication process through the session 5-tuple, and classifies them into the same session set accordingly. Furthermore, based on the timestamp order, it determines that the first record was generated before the second, and the second record before the third, thus forming a data object derivation link structure with a clear temporal order, used for the subsequent construction and analysis of the directed graph of data object derivation.

[0034] Directed edges are established between data object nodes with sequential temporal dependencies to represent the generative associations between data objects; the data object nodes and directed edge relationships are structurally encapsulated to generate a data object derived directed graph.

[0035] Methods for generating security violation alerts include: After the data object derivation directed graph is constructed, when a data object derivation operation is detected, the set of predecessor data object nodes of the data object participating in the current derivation operation is determined in the data object derivation directed graph, and the security level attribute value corresponding to each predecessor data object node in the predecessor data object node set is obtained; the derivation operation includes copy, extract or merge operation; Security classification value: ;in, Represents the newly generated data object node The security classification value; Represents the newly generated data object node The first one with a derivation relationship One predecessor data object node; This represents the set of directed edges in the directed graph derived from the data object; Indicates the conditions for the establishment of a derivation relationship, from point to There exists a directed edge; This represents the maximum value operation function, used to select the highest security level among all predecessor data object security levels; This variable represents the index of the predecessor data object node that participated in generating the new data object node. When the operation is a file merge: ;in, This represents the new data object node generated by the merge operation; Indicates the first One data object node participating in the merge operation; The index variable representing the data object node involved in the merge operation; Indicates the first The security level attribute value of each data object node; Indicates the first The security level attribute value of each data object node; This indicates the total number of data object nodes involved in the merge.

[0036] Set the security level attribute of the derived data object to the maximum value among the security level attribute values ​​of the predecessor data object node; and set authorization constraints for the security level reduction operation of the data object. The security level reduction operation is allowed only if an authorized decryption record corresponding to the target data object is detected. Otherwise, the security level reduction operation is rejected and a security level violation alarm record is generated.

[0037] Authorization constraints: ;in, Represents data object nodes The current security classification value; Represents data object nodes The security classification value after performing the security classification adjustment operation; This indicates that a declassification action has occurred; This indicates that once a declassification action is taken, subsequent conditions must be met; This indicates an existence quantifier, meaning that there is at least one authorized record that meets the condition; Indicates authorized user At the current time point For data object nodes Log of initiated decryption operations; Index identifier representing authorized users; The index identifier representing the current time point.

[0038] Here's an example: if data object A (security level 2) and data object B (security level 3) are merged to generate data object C, then according to the security level contagion rule, the platform automatically determines the security level of C to be 3. If a subsequent security downgrade operation is performed on C to security level 1, but the platform does not detect the corresponding authorized decryption record, then the security downgrade operation is rejected and a security level violation alarm is generated.

[0039] Methods for generating time-limited access tokens based on security level attributes include: The basic permission set is determined based on the security level attribute of the target data object, and the access permission boundary is defined for different security levels based on the preset security level and permission mapping relationship. When there is a need for temporary authorization, the basic permission set is expanded to form a temporary authorization permission set, and the temporary authorization permission set is merged with the basic permission set to obtain the token authorization permission set. Furthermore, the platform formally defines the permission expiration token, as follows: ;in, Indicates the first One permission time-limited token; The index representing the permission expiration token; Represents the set of token-authorized permissions; Indicates the token's effective timestamp; Indicates the token's expiration timestamp; Represents the set of authorization constraints; Token authorization permission set: ;in, Represents the basic set of permissions; This represents a set of temporary authorization permissions; Represents the union; In this embodiment, it should be noted that the platform receives the security level value of the target data object and performs a query and matching based on a pre-built security level permission mapping table. The mapping table is used to define the basic operation permission range corresponding to different security levels, such as read permission, edit permission, download permission, or dissemination permission. Through this mapping relationship, the platform converts the security level attribute of the target data object into the corresponding basic permission set, thereby forming the accessible operation boundary of the data object under the default security policy.

[0040] When there are needs for cross-departmental collaboration, access for specific tasks, or temporary auditing, the platform expands the basic permission set according to the temporary authorization requirements. It performs a union operation between the newly added temporary permission set and the basic permission set to form a temporary authorization permission set. This set supports controlled permission expansion in cross-departmental collaboration or temporary auditing scenarios. This process enables temporary expansion of access capabilities that bypasses regular permission restrictions but remain under control.

[0041] The temporary authorization permission set is structured and encapsulated to generate a permission expiration token. The permission expiration token includes the authorization subject identifier, permission set, effective timestamp, expiration timestamp, and maximum number of uses parameter. The effective timestamp, expiration timestamp, and maximum number of uses of the permission expiration token are dynamically adjusted according to the security level attribute to realize the mapping relationship between the security level and the permission constraint strength.

[0042] The platform encapsulates the permission set along with the authorized entity identifier, effective timestamp, expiration timestamp, and maximum usage count parameters in a unified encoding, forming a token structure that can be directly parsed and verified. This enables standardized expression and controllable transmission of permissions. The platform dynamically adjusts the token's effective time interval and maximum usage count based on the security level of the target data object. When the security level increases, the effective time interval is shortened and the maximum usage count is reduced; conversely, when the security level decreases, the effective time interval is extended and the maximum usage count is increased, thus establishing a mapping relationship between security level and access constraint strength.

[0043] For example, when the target data object has a security level of 3, the platform sets the validity period of the temporary permission token generated after extending the basic read permission to 10 minutes and allows a maximum of 3 accesses; while when the security level is 1, the validity period can be extended to 2 hours and multiple accesses are allowed. Through this method, differentiated access control and dynamic constraints are achieved for data objects with different security levels in temporary authorization scenarios.

[0044] Methods for outputting access exception records include: Construct a min-heap queue with the expiration timestamp of the permission expiration token as the priority key, automatically recycle expired tokens, and maintain valid permission expiration tokens in an ordered manner according to their expiration timestamps; Min-heap structure queue: ;in, This represents a min-heap structure queue (token expiration priority queue) used to maintain all valid permission expiration tokens. This represents the function for constructing a min-heap data structure, where the top element of the heap is always the element with the smallest key value, used to prioritize scheduling the earliest expired token; This represents a set of permission expiration tokens; This represents the min-heap sort key, used to determine the priority of the heap structure; Indicates permission expiration token Expiration timestamp; Based on the current platform time, the top token of the min-heap queue is periodically checked. When the current time is detected to be greater than the expiration timestamp of the top token, the top token is removed from the queue and the corresponding permission revocation operation is performed. At the same time, a maximum number of uses parameter is set for each permission-validated token, and the remaining number of uses is decremented each time the token is accessed and hit. Define the remaining number of token uses as Decreasing processing: ;in, Indicates the remaining number of uses for the token. The numerical representation after performing a single decrement operation; This indicates an assignment / update operation; When the remaining usage count decreases to zero, the token invalidation mechanism is immediately triggered and the access permissions corresponding to the token are revoked; when the token invalidation or revocation causes the access request to fail to meet the access control judgment conditions, a corresponding access exception record is generated.

[0045] Access control decision criteria: ;in, This represents the access authorization decision function. An output of 1 indicates that access is allowed, and an output of 0 indicates that access is allowed. This indicates the permissions requested for access, such as file read permission, data download permission, and modification permission; Indicates authorized user The basic set of permissions; Represents the logical OR operator; This represents the logical AND operator. This indicates the existence of a certain permission expiration token. ; Indicates token The set of authorized permissions; Indicates a permission request Overwritten by this token; This represents a function for determining the validity of a token. At the current time point Whether it meets the time constraint and the remaining number of uses constraint determines whether it is in an available state.

[0046] For example, the platform maintains a set of permission expiration tokens, such as tokens... , and Each token corresponds to a different user's temporary authorization access permission, and each token is set with an expiration timestamp and a maximum number of uses parameters.

[0047] The platform first constructs a min-heap queue of all valid permission tokens according to their expiration timestamps: The token with the earliest expiration time is placed at the top of the stack. For example, if... The expiration time is 10:00. It is 11:00. If the time is 12:00, then the top of the min-heap is... .

[0048] The platform checks the top-of-the-stack token at preset time intervals. When the current platform time exceeds the token's expiration time, the platform automatically... Remove it from the min-heap and revoke its corresponding access permissions, while recording the audit log to complete the automatic reclamation of expired tokens.

[0049] During the access process, the user In time Request permission (For example, "file download permissions"), the platform performs access control checks, such as user... Basic permission set It does not include "download permission"; however, a token is present. Its set of authorized permissions It includes "download permission" to further determine whether the token is valid.

[0050] In a specific access instance: Initial maximum number of uses Decrease the count after each successful access: After a user uses the token to perform 3 download operations consecutively: The platform immediately triggers the token expiration mechanism, which will forcibly revoke the token and remove it from the access control platform, even if the token has not yet expired.

[0051] If a user requests the same permission again after the token expires, then: This does not satisfy the condition. And there is no valid token that satisfies ,but The platform determines that the access has failed and generates an access exception record, such as: user ID, requested permission type, reason for failure (token expired / use count exhausted) and timestamp, for subsequent security audit and risk tracing analysis.

[0052] Methods for generating intranet security data include: Compliance event records and access anomaly records are associated and matched according to timestamp and terminal identifier, and records that meet the conditions of the same terminal identifier or the same session identifier are aggregated to generate security event description units; based on the security event description units, security event work orders are generated, and the security event work orders include event source identifier, associated terminal identifier, event type set and risk identifier fields; In this embodiment, it should be noted that the platform performs association matching processing on compliance event records and access anomaly records based on timestamps and identification information. Both compliance event records and access anomaly records carry event timestamps and terminal identification information. The platform uses a preset time window as the matching range and performs candidate pairing on records whose timestamps fall within that time window. Further, it performs secondary filtering based on terminal identification information; when two types of records have the same terminal identification, they are determined to be events associated with the same terminal. On this basis, the platform further combines session identification information for enhanced matching; when there is the same session identification or the same communication session five-tuple mapping relationship, the corresponding records are grouped into the same session-level event chain. After completing the association matching, records that meet the conditions of the same terminal identification or the same session identification are aggregated, integrating multiple scattered event records into a unified security event description unit.

[0053] The platform classifies and maps the event type set in the security event description unit, and uniformly maps different types of events such as unauthorized external connections, abnormal access, and token-invalid access to standardized work order fields, and generates security event work orders that include event source information, risk type tags, associated asset identifiers, and initial handling suggestions.

[0054] The security event work order is input into the preset state machine for state transition processing. Based on the event triggering conditions, the state is driven to migrate between different stages. When the state machine completes all transitions and enters the closed loop state, intranet security data is generated.

[0055] It should be noted that the preset state machine is used to control the processing flow of security event work orders in stages and to drive the transitions in a condition-driven manner. Its preset process includes three steps: defining the state set, defining the state transition rules, and mapping the trigger conditions.

[0056] Among them, the state set definition is used to divide the life cycle of a security event work order into the pending confirmation state, the analysis state, the handling state, and the closed-loop state; the state transition rule definition is used to determine the permissible transition relationship between different states; and the trigger condition mapping relationship is used to establish the correspondence between event types and state transition rules.

[0057] During the state machine's operation, the platform inputs security event work orders into the preset state machine to perform state transition processing, driving state transitions based on trigger conditions. For example, when the same security event work order is associated with both an unauthorized external connection event and an access anomaly event, a transition from the pending confirmation state to the analysis state is triggered; when access blocking or token revocation operations are completed, a transition from the analysis state to the handling state is triggered; when all associated risk items have been handled and confirmed, a transition to the closed-loop state is triggered.

[0058] Furthermore, the platform uses compliance event records, access anomaly records, and security handling results as trigger input sources, and matches them with state transition rules through trigger condition mapping relationships to achieve automatic control of the state transition path. This allows security event work orders to automatically flow according to the rule path in the preset state machine. During the operation of the state machine, the platform continuously records the state transition sequence of security event work orders. When the state transitions step by step from the initial state to the closed-loop state, the complete transition path is stored as internal network security data to characterize the entire lifecycle handling process of the security event.

[0059] For example, if two types of security events occur on an intranet terminal device within the same time window: Event a: The terminal accesses an unauthorized external IP address, generating a compliance event record for unauthorized external connections; Event b: The terminal triggers the exhaustion of the permission expiration token when accessing internal data resources, generating an access anomaly record.

[0060] The platform first performs correlation analysis on the two types of records, identifying that they share the same terminal identifier and that their timestamps fall within a preset time window. Therefore, they are determined to be part of the same security event chain, and a security event work order is generated accordingly. The platform initializes the security event work order by inputting it into a preset state machine. At this point, the work order status is: pending confirmation; indicating that risk classification and handling analysis have not yet been completed.

[0061] Since the work order contains both an unauthorized external connection event (compliance event record) and an access anomaly event (authorization invalidation trigger), the state machine triggers the preset migration rule: "multi-source risk event joint trigger rule". Therefore, the status changes from: pending confirmation status to analysis status; the platform enters the risk analysis stage.

[0062] Two operations are performed on the terminal: blocking its external network access path and revoking the corresponding permission validity token; when the platform detects that the above actions have been completed, the state transition rule is triggered: "Risk Handling Completed Rule"; the state transition is: Analysis in progress → Handling in progress. During subsequent monitoring, the platform confirmed that no new unauthorized external connections occurred, no new abnormal access records were recorded, and all associated risk items had been closed. At this point, the closed-loop rule was triggered: "Risk Completely Eliminated Rule". The state transition was: in progress → closed loop. After the state machine completed all the above transitions, the platform recorded the complete state path as: pending confirmation → in analysis → in progress → closed loop. The platform also stored this transition sequence along with the associated event information to form internal network security data.

[0063] Methods for generating compliance monitoring views and providing them to security managers include: The internal network security data is parsed to extract security event type information, terminal identification information, time information, and event processing status information. The security event type information is classified according to different event categories, and statistical charts showing the distribution of different event quantities are generated based on the classification results. It should be noted that when the platform parses intranet security data, it first breaks the data down according to a preset data structure. The intranet security data is based on security event records as the basic unit. Each security event record includes an event identifier field, a terminal identifier field, a timestamp field, and an event processing status field. The platform parses the security event records according to either the field location identifier or the field name identifier, extracting security event type information, terminal identifier information, time information, and event processing status information from each security event record.

[0064] Specifically, security event type information is obtained by reading the corresponding event type field from the security event record; terminal identification information is obtained by reading the terminal identification field; time information is obtained by reading the timestamp field; and event processing status information is obtained by reading the event status field. After the fields are extracted, the platform reorganizes and stores the extraction results in a manner that one security event record corresponds to one data object, thereby forming structured intranet security data for subsequent visualization processing.

[0065] Terminal identification information is categorized and summarized according to terminal dimension, and a correlation chart is generated to show the correspondence between terminals and events; time information is sorted according to chronological order, and a time series chart is generated to show the order in which events occur; event processing status information is categorized according to status type, and a process display chart is generated to show the progress of event processing. The platform summarizes and displays statistical charts, correlation charts, time series charts, and process display charts to generate a compliance monitoring view, and provides different display contents in the compliance monitoring view to security management personnel.

[0066] For example, the platform might parse and process internal network security data. Suppose three internal network security event records are collected within a certain time period: Record 1: The event type is "unauthorized external connection", the terminal identifier is "Host-A01", the time is "10:01:03", and the processing status is "pending confirmation"; Record 2: The event type is "Access Abnormality", the terminal identifier is "Host-A01", the time is "10:03:20", and the processing status is "Analyzing". Record 3: The event type is "unauthorized external connection", the terminal identifier is "Host-B07", the time is "10:05:11", and the processing status is "in progress".

[0067] The platform first parses the aforementioned intranet security data, extracting security event type information, terminal identification information, time information, and event processing status information, and then forms structured data units.

[0068] The platform categorizes security incident information, classifying "unauthorized external connections" and "abnormal access" into different categories, and counts the number of incidents in each category. Specifically, "unauthorized external connections" occurred twice, and "abnormal access" occurred once. Based on this, the platform generates a statistical chart of the distribution of the number of incidents to show the distribution of different security incident types.

[0069] The platform categorizes and summarizes terminal identification information and associates security events occurring on the same terminal. For example, Host-A01 is associated with 2 security event records; Host-B07 is associated with 1 security event record. Based on this, the platform generates a terminal-event association chart to show the correspondence between terminals and security events.

[0070] The platform sorts the time information according to the order of time, and obtains the order of events as: 10:01:03→10:03:20→10:05:11, and generates a time series chart to show the order of occurrence and evolution of security events.

[0071] The platform categorizes the event handling status information, resulting in the status distribution as: pending confirmation, under analysis, and in progress; and generates a process display chart to show the progress of a security event from initial discovery to step-by-step handling.

[0072] The platform summarizes and displays the above statistical charts, correlation charts, time series charts, and process display charts to generate a compliance monitoring view. Different display contents are provided to security management personnel for comprehensive analysis of the internal network security situation and management decision support.

[0073] Methods that trigger the execution of blocking or token revocation instructions include: Based on the handling instructions input by the compliance monitoring view, the security management personnel parse the handling instructions, identify the handling instruction type and the corresponding target object identifier; when the handling instruction is a blocking instruction, the target terminal identifier is sent to the traffic acquisition module, triggering the blocking of the network communication corresponding to the target terminal; When the disposal instruction is a token revocation instruction, the target permission expiration token identifier is sent to the permission control module to trigger the expiration process of the corresponding permission expiration token; and the execution result of the disposal instruction is recorded to update the corresponding display content in the compliance monitoring view.

[0074] For example, if the compliance monitoring view shows that terminal "Host-A01" has an unauthorized external connection event, the security administrator selects the terminal in the view interface and clicks the "Block Communication" button to generate a blocking command. The execution module parses the blocking command, identifies it as a network blocking command, and extracts the target terminal identifier "Host-A01". It then sends this terminal identifier to the traffic acquisition module via the command delivery interface. Upon receiving the terminal identifier, the traffic acquisition module restricts the terminal's subsequent network traffic in its compliance event verification and traffic processing logic, thereby blocking the terminal's external communication behavior. Example

[0075] Please see Figure 2 As shown, parts not described in detail in this embodiment are described in Embodiment 1. This embodiment provides an integrated management method for intranet information security, including: S1. Perform bypass mirroring and terminal probe collection on internal network traffic, generate traffic tag records, and perform unauthorized external connection and network access verification on the traffic tag records, and output compliance event records; S2. Construct a data object derivation directed graph based on the traffic marking records. When a data object undergoes a derivation operation, set the security level attribute of the data object to the maximum value in the security level attribute of the predecessor node, and impose authorization constraints on the security level reduction operation. It is only allowed to be executed when there is an authorized decryption record; otherwise, a security level violation alarm is generated. S3. Generate permission time-limited tokens based on security level attributes, automatically recycle expired tokens using a min-heap structure, and trigger invalidation processing when the token's usage count reaches zero, outputting access exception records. S4. Combine compliance event logs and access anomaly logs to generate security event work orders, and drive the preset state machine to generate intranet security data; S5 provides visualization of internal network security data, generates compliance monitoring views and provides them to security management personnel, and provides an instruction issuance interface to trigger the execution of blocking or token revocation instructions. Example

[0076] This embodiment discloses an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the operation mode of the integrated intranet information security management platform provided above.

[0077] Since the electronic device described in this embodiment is the one used in implementing the integrated intranet information security management platform described in this application, those skilled in the art can understand the specific implementation methods and various variations of the electronic device in this embodiment based on the integrated intranet information security management platform described in this application. Therefore, how the electronic device implements the method in this application embodiment will not be described in detail here. Any electronic device used by those skilled in the art in implementing the integrated intranet information security management platform described in this application falls within the scope of protection of this application.

[0078] It should be noted that all formulas in this manual are calculated by removing dimensions and taking their numerical values. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters and thresholds in the formulas are set by those skilled in the art according to the actual situation.

[0079] The above description is merely a preferred embodiment of the present invention, and the scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for users of ordinary technical skills, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. An integrated management platform for intranet information security, characterized in that, include: The traffic acquisition module is used to perform bypass mirroring and terminal probe acquisition on intranet traffic, generate traffic tag records, perform unauthorized external connections and network access verification on the traffic tag records, and output compliance event records. The security level constraint module is used to construct a directed graph of data object derivation based on traffic marking records. When a data object undergoes a derivation operation, the security level attribute of the data object is set to the maximum value in the security level attribute of the predecessor node, and authorization constraints are applied to the security level reduction operation. It is only allowed to be executed when there is an authorized decryption record; otherwise, a security level violation alarm is generated. The access control module is used to generate time-limited access tokens based on security level attributes, automatically recycle expired tokens using a min-heap structure, and trigger invalidation processing when the token's usage count reaches zero, outputting access exception records. The event logging module is used to combine compliance event logs and access anomaly logs to generate security event work orders, and drive the preset state machine to generate intranet security data. The execution module is used to visualize intranet security data, generate compliance monitoring views and provide them to security management personnel. It also provides an instruction issuance interface to trigger execution blocking or token revocation instructions.

2. The integrated management platform for intranet information security according to claim 1, characterized in that, The method for generating traffic marker records includes: By setting up a bypass mirroring acquisition channel in the intranet communication link, the mirrored traffic in the switching or routing equipment is copied and acquired, and network traffic data is collected without changing the original service forwarding path. Meanwhile, probe components deployed on intranet terminals are used to monitor the network communication behaviors initiated, received, and forwarded by the terminals, and to obtain corresponding terminal behavior data. The collected network traffic data and terminal behavior data are aligned according to timestamps, and a session 5-tuple is constructed based on the source address, destination address, source port, destination port and transmission protocol type to associate data belonging to the same communication session. Based on the association results, terminal identification information, session 5-tuple information, and traffic load feature information are extracted, and then encapsulated to generate corresponding traffic tag records.

3. The integrated management platform for intranet information security according to claim 2, characterized in that, The method for outputting compliance event logs includes: The destination address information in the traffic tagging record is parsed and compared with the preset set of trusted internal network addresses to determine whether there is any unauthorized external connection behavior to access an unauthorized external network. Based on the session 5-tuple information in the traffic tagging record, the protocol type and port access characteristics are verified to identify whether there is unauthorized protocol communication or uncontrolled port access behavior; based on the terminal identifier in the traffic tagging record, the preset access permission set of the corresponding terminal is queried; the preset access permission set is matched with the current access target to determine whether the network access conditions are met. When any verification result does not meet the preset verification conditions, the traffic tag record is marked as abnormal, and the abnormal state, terminal identifier, session 5-tuple information and abnormal type are encapsulated to generate the corresponding compliance event record.

4. The integrated management platform for intranet information security according to claim 3, characterized in that, The method for constructing a directed graph derived from data objects includes: Traffic marker records are used as data object nodes, and several data object nodes belonging to the same terminal are merged based on terminal identification information to form a set of data object nodes indexed by the terminal. The communication session relationships between different data object nodes are matched based on the session quintuple information to determine the session-level association between data object nodes; the generation sequence relationship between data object nodes is sorted and identified based on the timestamp information in the traffic tag record. Directed edges are established between data object nodes with sequential temporal dependencies to represent the generative associations between data objects; the data object nodes and directed edge relationships are structurally encapsulated to generate a data object derived directed graph.

5. The integrated management platform for intranet information security according to claim 4, characterized in that, The method for generating security level violation alerts includes: After the data object derivation directed graph is constructed, when a data object derivation operation is detected, the set of predecessor data object nodes of the data object participating in the current derivation operation is determined in the data object derivation directed graph, and the security level attribute value corresponding to each predecessor data object node in the predecessor data object node set is obtained; the derivation operation includes copy, extract or merge operation; Set the security level attribute of the derived data object to the maximum value among the security level attribute values ​​of the predecessor data object node; and set authorization constraints for the security level reduction operation of the data object. The security level reduction operation is allowed only if an authorized decryption record corresponding to the target data object is detected. Otherwise, the security level reduction operation is rejected and a security level violation alarm record is generated.

6. The integrated management platform for intranet information security according to claim 5, characterized in that, The method for generating permission time-limited tokens based on security level attributes includes: The basic permission set is determined based on the security level attribute of the target data object, and the access permission boundary is defined for different security levels based on the preset security level and permission mapping relationship. When there is a need for temporary authorization, the basic permission set is expanded to form a temporary authorization permission set, and the temporary authorization permission set is merged with the basic permission set to obtain the token authorization permission set. The temporary authorization permission set is structured and encapsulated to generate a permission expiration token. The permission expiration token includes the authorization subject identifier, permission set, effective timestamp, expiration timestamp, and maximum number of uses parameter. The effective timestamp, expiration timestamp, and maximum number of uses of the permission expiration token are dynamically adjusted according to the security level attribute to realize the mapping relationship between the security level and the permission constraint strength.

7. The integrated management platform for intranet information security according to claim 6, characterized in that, The method for outputting access exception records includes: Construct a min-heap queue with the expiration timestamp of the permission time-limited token as the priority key, automatically recycle expired tokens, and maintain valid permission time-limited tokens in an ordered manner according to their expiration timestamps; Based on the current platform time, the top token of the min-heap queue is periodically checked. When the current time is detected to be greater than the expiration timestamp of the top token, the top token is removed from the queue and the corresponding permission revocation operation is performed. At the same time, a maximum number of uses parameter is set for each permission-validated token, and the remaining number of uses is decremented each time the token is accessed and hit. When the remaining usage count decreases to zero, the token invalidation mechanism is immediately triggered and the access permissions corresponding to the token are revoked; when the token invalidation or revocation causes the access request to fail to meet the access control judgment conditions, a corresponding access exception record is generated.

8. The integrated management platform for intranet information security according to claim 7, characterized in that, The method for generating intranet security data includes: Compliance event records and access anomaly records are correlated and matched according to timestamp and terminal identifier, and records that meet the conditions of the same terminal identifier or the same session identifier are aggregated to generate security event description units; security event work orders are generated based on security event description units; The security event work order is input into the preset state machine for state transition processing. Based on the event triggering conditions, the state is driven to migrate between different stages. When the state machine completes all transitions and enters the closed loop state, intranet security data is generated.

9. The integrated management platform for intranet information security according to claim 8, characterized in that, The methods for generating compliance monitoring views and providing them to security administrators include: The internal network security data is parsed to extract security event type information, terminal identification information, time information, and event processing status information. The security event type information is classified according to different event categories, and statistical charts showing the distribution of different event quantities are generated based on the classification results. Terminal identification information is categorized and summarized according to terminal dimension, and a correlation chart is generated to show the correspondence between terminals and events; time information is sorted according to chronological order, and a time series chart is generated to show the order in which events occur; event processing status information is categorized according to status type, and a process display chart is generated to show the progress of event processing. The platform summarizes and displays statistical charts, correlation charts, time series charts, and process display charts to generate a compliance monitoring view, and provides different display contents in the compliance monitoring view to security management personnel.

10. The integrated management platform for intranet information security according to claim 9, characterized in that, The method for triggering the execution of blocking or token revocation instructions includes: Based on the handling instructions input by the compliance monitoring view, the security management personnel parse the handling instructions, identify the handling instruction type and the corresponding target object identifier; when the handling instruction is a blocking instruction, the target terminal identifier is sent to the traffic acquisition module, triggering the blocking of the network communication corresponding to the target terminal; When the disposal instruction is a token revocation instruction, the target permission expiration token identifier is sent to the permission control module to trigger the expiration process of the corresponding permission expiration token; and the execution result of the disposal instruction is recorded to update the corresponding display content in the compliance monitoring view.

Images