A multi-terminal cooperative linkage hierarchical security permission management and compliance audit system

Abstract

The application discloses a multi-terminal cooperative linkage hierarchical security permission management and compliance audit system and belongs to the technical field of multi-device cooperative security and terminal compliance audit. In view of the defects that the traditional single-computer protection mode lacks cross-device linkage, the permission management is extensive, and the audit system is incomplete, the application comprises four modules, i.e. multi-terminal cooperative linkage protection, multi-role hierarchical permission management, whole-process compliance audit traceability and scene adaptive intelligent management. The local networking + cloud dual-link architecture is adopted to realize multi-terminal risk intercommunication, strategy synchronization and linkage alarm; fine hierarchical authorization is implemented based on the user identity; all the security operations and risk events of the terminal are encrypted and time-sequenced stored; and the security management strength is dynamically adjusted in combination with the use scene. The application satisfies the network security protection 2.0 and the confidential terminal management specification, realizes a global multi-terminal cooperative security closed loop, and can be widely applied to multi-terminal management scenes such as government and enterprise field work terminals, vehicle-mounted devices, intelligent wearable clusters and the like.

Description

Technical Field

[0001] This invention relates to a multi-terminal collaborative hierarchical security access control and compliance audit system, specifically in the fields of IoT multi-terminal collaborative security, smart terminal hierarchical access control, network security compliance audit, and terminal intelligent risk control. Background Technology

[0002] Existing smart terminal security protection systems generally adopt a standalone, independent protection architecture, which has significant technical shortcomings. First, the security systems of each terminal are independent and data is isolated, making it impossible to achieve cross-device risk synchronization, early warning collaboration, and emergency response linkage. Security protection for mobile phones, smart wearables, vehicle terminals, and field personnel terminals is fragmented, making it difficult to build a comprehensive, interconnected security protection network and lacking multi-device collaborative protection capabilities. Second, traditional terminal access control models are crude and lack a refined hierarchical authorization architecture, failing to meet the hierarchical control needs of government and enterprise units handling classified information and field operation teams. They do not comply with the principle of least privilege management for classified information and are insufficient to meet the security control standards for high-end government and enterprise scenarios. Third, existing solutions lack complete security log auditing and traceability capabilities. Terminal security operations, risk events, and device status changes cannot be properly documented, failing to meet the mandatory compliance requirements of Cybersecurity Classified Protection 2.0, classified terminal auditing, and industry regulation, thus limiting the implementation of solutions in high-value scenarios such as military, power, and government field operations.

[0003] Currently, the field of multi-terminal security and access control generally adopts a design approach of single-machine protection, static permission configuration, and independent auditing. The three systems of device linkage, user permissions, and security auditing are isolated from each other; conventional solutions only realize device message communication or local permission restrictions, and have not formed an integrated closed-loop architecture of "risk cross-terminal linkage handling - dynamic hierarchical permission control - full behavior compliance auditing", which is difficult to meet the multiple security control requirements of government and enterprise confidentiality and information security compliance standards. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings of existing technologies, such as independent protection of a single machine, lack of multi-terminal collaboration capabilities, coarse access control, and lack of compliance traceability and auditing mechanisms. It provides a hierarchical security access control and compliance auditing system with multi-terminal collaboration, builds a multi-device full-domain collaborative security network, a refined user hierarchical access control system, a full-process compliance traceability and auditing mechanism, and scenario-adaptive security strategies, and makes up for the technical shortcomings of terminal security solutions in government and enterprise scenarios, compliance closed loop, and multi-device linkage protection.

[0005] The beneficial effects of this invention are as follows: 1. It breaks down the barriers of single-machine protection, achieving multi-terminal, full-domain collaborative security protection, supporting risk sharing, joint early warning, and collaborative emergency response; 2. It establishes a refined hierarchical permission system, conforming to the minimum permission management standards for classified scenarios; 3. It achieves tamper-proof log storage of all terminal behaviors, forming a complete compliant audit closed loop, meeting regulatory standards at all levels; 4. It is compatible with multiple classified scenarios in civilian, commercial, and government / enterprise sectors, balancing security control and user experience, and enhancing patent technology barriers, standardization implementation capabilities, bidding competitiveness, and commercial value.

[0006] Existing technical solutions typically only enable simple communication between multiple devices, or single-machine access control and independent log auditing, lacking an organic linkage mechanism among these three elements. Simply integrating these functions cannot achieve synchronous risk response across terminals or dynamic adjustment of control strategies based on identity and scenario. The modules in this invention have specific interaction sequences and triggering conditions, forming a closed loop of comprehensive collaborative security control, producing multiple collaborative technical effects, and are not merely a simple combination of existing functions. Detailed Implementation

[0007] This invention discloses a hierarchical security access control and compliance audit system with multi-terminal collaborative linkage. The specific operation process is as follows: The system relies on a dual architecture of local near-field networking and cloud linkage to achieve multi-terminal collaborative protection. When any terminal, such as a mobile phone, smart wearable, vehicle terminal, or field soldier, identifies a security risk, triggers an emergency alarm, or experiences a security anomaly, the risk information is automatically pushed to the network-related terminals, and the security protection strategies of all devices are switched in a coordinated manner to complete multi-device collaborative risk avoidance, joint rescue, and risk warning.

[0008] As a preferred implementation, multi-terminal short-range networking uses at least one communication method such as Bluetooth, NFC, or LAN TCP networking; scene recognition comprehensively considers location information, external devices, runtime, and network type for multi-dimensional data analysis.

[0009] The multi-role hierarchical access control module automatically matches access policies based on the currently logged-in user's identity; users with confidential information are given strict access isolation, data encryption, and full-process operation auditing policies; field users are assigned controllable operation permissions, and trajectory retention and risk behavior control are enabled; ordinary civilian users are given lightweight security protection policies to achieve on-demand authorization and hierarchical control.

[0010] The end-to-end compliance audit traceability module continuously collects all behaviors, including terminal hardware isolation switching, TEE liveness verification, AI anti-fraud risk interception, emergency alarms, user operations, and device status changes. It performs encrypted time-series evidence storage, solidifies traceability markers, and generates tamper-proof standardized security audit logs, providing legal and effective data support for compliance verification, risk tracing, and incident review.

[0011] The scene-adaptive intelligent management module continuously identifies office, field, vehicle, and home scenarios, dynamically adjusting the security protection level, access control tightness, and log audit retention granularity. While ensuring device security and compliance, it optimizes the terminal operation experience and achieves a balance between security strength and ease of use. Attached Figure Description

[0012] Figure 1 is an overall architecture block diagram of a multi-terminal collaborative hierarchical security access control and compliance audit system according to the present invention; Figure 2 is a schematic diagram of the multi-terminal collaborative risk warning and emergency response process according to the present invention; Figure 3 is a schematic diagram of the execution process of hierarchical access control and full-process compliance audit according to the present invention.

[0013] Figure 1 shows the overall architecture of this invention. The system comprises four core functional modules: a multi-terminal collaborative protection module, a multi-role hierarchical access control module, a full-process compliance audit and traceability module, and a scenario-adaptive intelligent management module. Specifically, the multi-terminal collaborative protection module is responsible for the dual linkage of local networking and cloud access for multiple types of terminals, risk synchronization, policy coordination, and emergency response; the multi-role hierarchical access control module is responsible for refined hierarchical authorization, access isolation, and operation control for users with multiple identities; the full-process compliance audit and traceability module is responsible for the encrypted storage and time-series traceability of terminal security behaviors, operational behaviors, and status changes across all dimensions; and the scenario-adaptive intelligent management module is responsible for scenario identification and dynamic adaptation of security policies. These four modules work together to construct a comprehensive terminal security management system that features multi-device collaboration, hierarchical control, compliance closed-loop, and scenario adaptation.

[0014] Figure 2 illustrates the multi-terminal collaborative risk warning and emergency response process of this invention. The system supports network operation of multiple devices, including smartphones, smart wearables, vehicle terminals, and field soldier terminals. The workflow is as follows: When any terminal detects a security risk, fraud risk, coercion, or device anomaly, it immediately identifies the risk locally and uploads it to the cloud, simultaneously pushing risk warning information to associated network terminals; all associated terminals simultaneously update their security protection strategies, automatically upgrading their protection levels, enabling risk interception, and triggering emergency alarms; after the risk is resolved, multiple terminals simultaneously restore their normal protection strategies, achieving a closed-loop security system of risk co-governance, collaborative protection, and emergency response across all devices.

[0015] Figure 3 is a schematic diagram of the execution process of hierarchical permission control and full-process compliance audit of the present invention. The system first identifies the identity of the currently logged-in user and matches the hierarchical permission policies corresponding to administrators, confidential users, field users, and ordinary users to complete permission isolation and function authorization. During the device operation, the system monitors all behaviors such as hardware isolation operations, TEE liveness verification, AI anti-fraud interception, emergency alarms, user operations, and device status changes. All operations and security events are encrypted and stored in a time sequence, logized, and traced. Finally, an immutable compliance audit log is formed, which supports post-event verification, risk review, and compliance assessment, and fully meets the requirements of the Information Security Protection Standard 2.0 and the audit specifications for confidential devices.

[0016] Conclusion This invention constructs a cross-terminal integrated security management and control closed loop, solving the problems of insufficient collaboration, rigid management strategies, and weak auditing capabilities in traditional stand-alone security solutions. The solution can be deployed on the management and control platform and on the local terminal, adapting to heterogeneous multi-terminal clusters. It can meet the compliance management and control requirements of industries such as government affairs, power, and field security, and can be deployed at scale as a standardized security management and control platform, possessing good commercial transformation value.

Claims

1. A hierarchical security access control and compliance auditing system with multi-terminal collaborative linkage, characterized in that, Deployed on a multi-terminal security management platform and various smart terminals locally, the system includes: a multi-terminal collaborative protection module, used to build a dual-mode collaborative architecture of local near-field networking and cloud linkage, enabling synchronization of security status, interoperability of risk warnings, linkage of alarms for emergencies, and linkage switching of security policies among smartphones, smart wearables, vehicle terminals, and field soldier terminals; a multi-role hierarchical permission management module, used to build a multi-identity user permission isolation system, providing hierarchical authorization and permission locking for administrators, confidential users, field users, and ordinary users regarding device operation permissions, data access permissions, security function usage permissions, and emergency alarm permissions; a full-process compliance audit and traceability module, used to perform full-dimensional encrypted log retention and time-series traceability of terminal hardware isolation operations, TEE liveness verification, AI anti-fraud identification, risk event interception, emergency alarm operations, daily user operations, and device status change behaviors, meeting network security level protection and confidential device audit specifications; and a scenario-adaptive intelligent management module, used to automatically identify office, field, vehicle, and home usage scenarios, dynamically adjusting the terminal security protection strength, permission control tightness, and log audit retention rules.

2. The hierarchical security access control and compliance audit system for multi-terminal collaborative linkage according to claim 1, characterized in that, The multi-terminal collaborative protection module supports cross-device risk synchronous early warning, emergency reporting, multi-terminal collaborative emergency rescue, and synchronous switching of global security strategies.

3. The hierarchical security access control and compliance audit system for multi-terminal collaborative linkage according to claim 1, characterized in that, The multi-role hierarchical permission control module achieves adaptive hierarchical control for different user identities based on the principles of least privilege for classified information, controllable permissions for field work, and relaxed adaptation for civilian use.

4. The hierarchical security access control and compliance audit system for multi-terminal collaborative linkage according to claim 1, characterized in that, The full-process compliance audit and traceability module performs tamper-proof time-series evidence storage for all terminal security events and operational behaviors, supporting post-event traceability verification, compliance evaluation, and security risk assessment.

5. The hierarchical security access control and compliance audit system for multi-terminal collaborative linkage according to claim 1, characterized in that, The scenario-adaptive intelligent management and control module dynamically adjusts the security management and control strategy according to the usage scenario, optimizing the terminal user experience while ensuring device security and compliance.

Images