A data security protection system and method based on multi-level access control

Abstract

A kind of data security protection system and method based on multilevel access control belong to data security encryption technical field, to solve the terminal state real-time change under dynamic network, packet by packet calculation causes communication delay, static token is difficult to respond to exception in time, security protection exists lagging behind vulnerability problem, data security protection method based on multilevel access control includes: obtaining the terminal running state vector of terminal equipment of initiating access request, and the data characteristic head of data to be accessed including data secret level and time stamp;Risk assessment characteristic value is obtained;Generate temporary access credential for the terminal equipment;When the temporary access credential is within the valid period, execute first access control link;While executing the first access control link, trigger second access control link in parallel based on the communication port identifier;The present application improves the real-time performance, accuracy and efficiency of data security protection in high concurrency, multi-secret level data interaction scene.

Description

Technical Field

[0001] This invention relates to the field of data security technology, specifically to a data security protection system and method based on multi-level access control. Background Technology

[0002] In high-concurrency data interaction scenarios such as the Industrial Internet of Things (IIoT) and enterprise multi-level data centers, data typically requires multi-level access control policies to ensure that terminal devices with different permission levels can only read data content that matches their security level. In related technologies, multi-level access control usually adopts the role-based access control model (RBAC) or the method of issuing static tokens. When a terminal device initiates an access request, the system compares the terminal's preset permissions with the data security level by consulting a static mapping table or verifying the token signature, thereby deciding whether to allow the data to pass.

[0003] However, when a terminal device is in a dynamic network environment, its operational security status changes in real time. If the terminal environment is extracted and permissions are recalculated for each data packet, it will lead to severe communication delays and system blockages. Conversely, if control is based solely on a single static token during the access session, when the underlying operational status of the terminal device becomes abnormal, such as when it is hijacked by the network and an abnormal surge in open ports occurs, the relevant technologies cannot interrupt the data flow in time, resulting in the continuous exposure of highly confidential data during the token's validity period, creating a hidden vulnerability with lagging security protection.

[0004] To address the above issues, a data security protection system and method based on multi-level access control is proposed. Summary of the Invention

[0005] The purpose of this invention is to provide a data security protection system and method based on multi-level access control, which solves the problems in the background mentioned above, such as real-time changes in terminal status under dynamic networks, communication delays caused by packet-by-packet calculation, difficulty in timely response to anomalies by static tokens, and the existence of lagging vulnerabilities in security protection.

[0006] To achieve the above objectives, the present invention provides the following technical solution: A data security protection method based on multi-level access control includes: S101, obtain the terminal running state vector of the terminal device that initiated the access request, and the data feature header of the data to be accessed, which includes the data security level and timestamp; S102, Based on the terminal operating state vector and the preset risk judgment rules, obtain the risk assessment feature value; S103, combine the risk assessment feature value and the data feature header to generate a temporary access credential for the terminal device; S104, when the temporary access credential is within its validity period, execute the first access control link, the first access control link including verifying the temporary access credential and allowing the terminal device to read the basic information of the data to be accessed; S105, while executing the first access control link, a second access control link is triggered in parallel. The second access control link includes extracting the communication port identifier and connection frequency of the terminal device in the current request behavior, performing distance comparison based on the communication port identifier, the connection frequency and the historical access trajectory of the terminal device, and issuing a credential cancellation instruction to block the subsequent access of the terminal device when the comparison fails.

[0007] Further, the terminal operating state vector includes network hop frequency, central processing unit load rate, and total number of currently open ports; obtaining the terminal operating state vector of the terminal device initiating the access request includes: Extract the network hopping frequency, central processing unit load rate, and total number of currently open ports of the terminal device within a preset time window; The terminal operating state vector is obtained by concatenating the network hopping frequency, the central processing unit load rate, and the total number of currently open ports.

[0008] Furthermore, the step of obtaining risk assessment feature values ​​based on the terminal's operating state vector and preset risk determination rules includes: Obtain the weighting coefficients corresponding to network hop frequency, central processing unit load rate, and total number of currently open ports, respectively; The risk assessment feature value is calculated based on the network hopping frequency, central processing unit load rate, total number of currently open ports, and their respective weight coefficients.

[0009] Furthermore, the step of combining the risk assessment feature value and the data feature header to generate a temporary access credential for the terminal device includes: Based on the risk assessment feature values, the security time threshold corresponding to the terminal device is determined; The temporary access credential is generated by hashing the security time threshold, the data security level, and the timestamp.

[0010] Further, the step of executing the first access control link while the temporary access credential is valid includes: Obtain the current access time of the terminal device; Calculate the time difference between the current access time and the timestamp; When the time difference is less than the security time threshold, it is determined that the temporary access credential is within its validity period, and the basic information of the data to be accessed is allowed. The total number of currently open ports of the terminal device is updated according to a preset sampling period; When the updated total number of currently open ports exceeds a preset port threshold, the security time threshold is overridden and set to zero, thereby invalidating the temporary access credential.

[0011] Furthermore, the second access control link also includes: When the comparison passes, the terminal device is allowed to read the core payload of the data to be accessed, which is the data portion of the data to be accessed excluding the basic information.

[0012] Further, the distance comparison based on the communication port identifier, the connection frequency, and the historical access trajectory of the terminal device includes: Extract the baseline communication port identifier and baseline connection frequency from the historical access trajectory; Construct the current behavior matrix based on the communication port identifier and the connection frequency; A benchmark behavior matrix is ​​constructed based on the benchmark communication port identifier and the benchmark connection frequency; Calculate the Manhattan distance between the current behavior matrix and the baseline behavior matrix; If the Manhattan distance is greater than a preset distance threshold, the comparison is determined to have failed.

[0013] Further, the step of obtaining the terminal running state vector of the terminal device initiating the access request, and the data feature header containing the data security level and timestamp of the data to be accessed, includes: When it is detected that the terminal device initiates multiple access requests for multiple data to be accessed within a preset time interval, multiple data security levels corresponding to the multiple access requests are extracted; Select the highest security level from the multiple data security levels as the target security level; Based on the target security level and the timestamp, a global data feature header is generated for the multiple access requests, and the global data feature header is transmitted as the data feature header.

[0014] Furthermore, after issuing the credential cancellation instruction to block subsequent access to the terminal device, the method further includes: The cumulative number of times the certificate cancellation instruction was issued within a preset time period is counted; When the cumulative number of times exceeds a preset threshold, the network interconnection layer address of the terminal device is extracted; The network interconnect layer address is written into the hardware isolation list of the network interface controller to reject all data packets from the network interconnect layer address.

[0015] A data security protection system based on multi-level access control includes: The access request core parameter acquisition module obtains the terminal running status vector of the terminal device that initiated the access request, as well as the data feature header of the data to be accessed, which includes the data security level and timestamp. The risk assessment feature value calculation module obtains risk assessment feature values ​​based on the terminal's operating state vector and preset risk determination rules. The temporary access credential generation module combines the risk assessment feature value and the data feature header to generate a temporary access credential for the terminal device. The first access control link execution module executes the first access control link when the temporary access credential is within its validity period. The first access control link includes verifying the temporary access credential and allowing the terminal device to read the basic information of the data to be accessed. The second access control link parallel triggering module triggers the second access control link in parallel while executing the first access control link. The second access control link includes extracting the communication port identifier and connection frequency of the terminal device in the current request behavior, performing distance comparison based on the communication port identifier, the connection frequency and the historical access trajectory of the terminal device, and issuing a credential cancellation instruction to block the subsequent access of the terminal device when the comparison fails.

[0016] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. This invention extracts terminal operating status vectors to construct a multi-dimensional risk assessment system, and deeply correlates the risk assessment results with the validity period of temporary access credentials. The higher the terminal risk, the shorter the validity period of the credentials. This effectively avoids the vulnerability that static tokens cannot expire in time when the terminal is abnormal, and reduces the risk of leakage of high-security data from the root. 2. The first access control link enables low-latency access of basic information, ensuring the smoothness of normal business flow and avoiding system blockage caused by full-process verification of a single link; the second access control link performs deep behavior comparison in parallel in the background without occupying the main link bandwidth, which not only achieves accurate protection of core load data, but also solves the contradiction between security verification and response speed, adapting to the needs of high-concurrency scenarios such as industrial IoT and government data platforms. 3. By adopting a layered strategy of rapid access based on basic information and access after core data verification, differentiated data protection is achieved, balancing efficiency and security. At the same time, multi-level blocking mechanisms such as dynamic port updates, forced invalidation of credentials, and hardware isolation are introduced to form a closed-loop protection process from logical verification to physical interception. This can quickly respond to sudden terminal anomalies, such as network hijacking or sudden surges in ports, and achieve nanosecond-level dynamic blocking. 4. To address multiple concurrent access requests from the same terminal, a global data feature header generation mechanism is introduced, and the highest security level is selected for unified credential management. This avoids system cache conflicts and table lookup delays caused by massive concurrent requests, significantly reducing the system's computing power burden and improving the efficiency of multi-request concurrent processing. At the same time, risk assessment and behavior comparison adopt quantitative calculation to eliminate algorithm black boxes and ensure that the judgment results are objective and repeatable. 5. Each module adopts a modular design, and the weight coefficients and threshold parameters can be dynamically adjusted according to different application scenarios. At the same time, the protection method that combines hardware isolation and software verification can adapt to different security level requirements, satisfying both efficient access to ordinary data and ensuring the security protection of top-secret data, making it highly versatile. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating the steps of the present invention. Figure 2 This is a system architecture diagram of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] Example 1: As Figure 1 As shown, the following preferred technical solutions are provided: This embodiment provides a data security protection method based on multi-level access control, including: Step 101: Obtain the terminal running status vector of the terminal device that initiated the access request, and the data feature header of the data to be accessed; the data feature header includes the data security level and timestamp; Step 102: Based on the terminal's operating state vector and the preset risk determination rules, calculate the risk assessment feature value; Step 103: Combine the risk assessment feature values ​​and data feature headers to generate temporary access credentials for the terminal device; Step 104: When the temporary access credential is within its validity period, execute the first access control link. The first access control link includes verifying the temporary access credential and allowing the terminal device to read the basic information of the data to be accessed. Step 105: While executing the first access control link, the second access control link is triggered in parallel. The second access control link includes extracting the communication port identifier and connection frequency of the terminal device in the current request behavior, performing distance comparison based on the communication port identifier, connection frequency and the historical access trajectory of the terminal device, and issuing a credential cancellation instruction to block the subsequent access of the terminal device when the comparison fails.

[0020] The above solution constructs a multi-dimensional risk assessment system by acquiring terminal operating status and data feature headers, accurately quantifying terminal security risks; it generates dynamic temporary access credentials based on risk levels, achieving a strong binding between risk and credential validity period; it adopts an asynchronous parallel dual-link architecture to achieve collaboration between low-latency basic access and deep risk background verification, solving the problems of slow response and delayed risk identification in traditional single-link protection; and through layered protection and dynamic blocking mechanisms, it balances business smoothness and data security, adapting to complex application scenarios with high concurrency and multiple security levels.

[0021] In some embodiments, step 101 involves obtaining the terminal running state vector of the terminal device initiating the access request, and the data feature header of the data to be accessed, which includes the data security level and timestamp, including: When a terminal device is detected to initiate multiple access requests for multiple pieces of data to be accessed within a preset time interval, multiple data security levels corresponding to the multiple access requests are extracted. Select the highest security level from multiple data security levels as the target security level; Based on the target security level and timestamp, a global data feature header is generated for multiple access requests, and the global data feature header is transmitted as a data feature header.

[0022] Specifically, a time-sliding window is initiated, with a 100ms window being one specific implementation. Concurrent request packets originating from the same Media Access Control (MAC) address are captured using port mirroring technology to avoid confusion between requests from different terminals. The MAC address is a unique hardware identifier for terminal devices, used to accurately distinguish access requests from different terminals. Predefined security classification fields in each request packet are parsed: 01 represents ordinary security level, 02 represents confidential security level, and 03 represents top secret security level. These fields are embedded in the request packet payload using binary encoding for rapid parsing and extraction. The security classification fields are converted into quantifiable numerical forms, where ordinary security level corresponds to the value 1, confidential security level to the value 2, and top secret security level to the value 3. The value 3 facilitates subsequent sorting and comparison. The converted security level value is input into the sorter for comparison, and the value representing the highest level of access requirement is selected as the benchmark. Based on the highest level of access requirement value and the current clock scale of the system, byte padding and checksum calculation are performed. The last 4 bits of the terminal MAC address are added as a specific method of byte padding, which can improve the uniqueness of the global data feature header. The CRC32 algorithm is a specific method of checksum calculation, used to verify the integrity of data transmission and prevent data tampering. A unified verification header is encapsulated and generated as the global data feature header for subsequent credential generation and verification. This verification header includes the target security level, timestamp, last 4 bits of the terminal MAC address, and CRC32 checksum, with a total length of 64 bytes, which can be transmitted and parsed quickly.

[0023] This step introduces a credential folding mechanism in high-concurrency scenarios, integrating multiple concurrent access requests from the same terminal into a single global data header. This avoids system cache conflicts and table lookup delays caused by triggering massive authentication requests on the same terminal device in a very short time, greatly reducing the matching burden of the first access control link and improving the efficiency of multi-request concurrent processing. At the same time, through the highest security level adaptation principle, it ensures that the access security of high-security data is not reduced.

[0024] In some embodiments, step 101, obtaining the terminal running state vector of the terminal device that initiated the access request, includes: Extract the network hopping frequency, central processing unit load rate, and total number of currently open ports of the terminal device within a preset time window; The terminal operating state vector is obtained by concatenating the network hopping frequency, the central processing unit load rate, and the total number of currently open ports; the central processing unit is the CPU.

[0025] Specifically, the system calls the underlying netlink interface of the operating system. This interface is a standard interface used for communication between the kernel and user space in Linux, and can efficiently obtain network routing information. It continuously monitors the switching logs of routing nodes through this interface, counting the number of network route switches for terminal devices within a preset time window, i.e., the network hop frequency. 500ms is a specific implementation of the preset time window, and the window length can be dynamically adjusted according to the terminal type, such as industrial terminals or office terminals. By reading the processor kernel's utilization register, the system obtains the average CPU load percentage within the preset window, i.e., the CPU load rate. The / proc / stat file is a specific representation of the processor kernel's utilization register, and this file records the CPU usage status in real time. The average load rate can be calculated by reading fields such as user, nice, and system from the file; the number of socket handles in the LISTEN state in the local network protocol stack can be scanned to count the total number of currently open ports. The LISTEN state indicates that the port is in a listening request state, and its change can reflect the network connection activity of the terminal device; according to the preset byte width (32 bits is a specific implementation of the preset byte width), the values ​​of the above three dimensions are binary shifted and bitwise ORed to form a one-dimensional vector data structure, namely the terminal running status vector. This vector can be directly used for subsequent risk assessment calculations, where the network jump frequency occupies 8 bits, the CPU load rate occupies 8 bits, and the total number of currently open ports occupies 16 bits, ensuring the compactness and computability of the vector.

[0026] This step transforms the multi-dimensional hardware operating environment into quantifiable deterministic mathematical characteristics, giving the abstract "terminal environment security status" a concrete physical measure. This provides accurate and calculable basic data support for subsequent risk assessment. At the same time, the integration of multi-dimensional parameters is achieved through vector concatenation, simplifying the subsequent calculation process.

[0027] In some embodiments, in step 102, risk assessment feature values ​​are obtained based on the terminal operating state vector and preset risk determination rules, including: Obtain the weighting coefficients corresponding to network hop frequency, central processing unit load rate, and total number of currently open ports, respectively; Risk assessment characteristic values ​​are calculated based on network hopping frequency, central processing unit load rate, total number of currently open ports, and their respective weighting coefficients.

[0028] Specifically, a static parameter table pre-configured in the non-volatile memory mapping area is retrieved. This parameter table is trained based on historical security event data. Machine learning algorithms are used to train on a large amount of historical terminal anomaly data to determine the weights of each dimension parameter on security risks. ROM is a specific implementation of non-volatile memory, which has the characteristic of not losing data when power is off, ensuring the stability of the weight coefficient table. The weight coefficients for network hop frequency, CPU load rate, and total number of currently open ports are set to 0.3, respectively. These weight coefficients can be dynamically adjusted according to the actual scenario. For example, in an industrial IoT scenario, the weight coefficient for network hop frequency can be increased. The weight is set to 0.4 to adapt to the network environment characteristics of industrial terminals. Floating-point coefficients for each dimension are read to ensure calculation accuracy, with coefficients retained to three decimal places. Multiplication is performed based on the network jump frequency and the corresponding weight coefficients to obtain the first product result. Multiplication is performed based on the CPU load rate and the corresponding weight coefficients to obtain the second product result. Multiplication is performed based on the total number of currently open ports and the corresponding weight coefficients to obtain the third product result. The three product results are then summed to generate a scalar result reflecting the comprehensive environmental risk, i.e., the risk assessment feature value. This value ranges from 0 to 1; the larger the value, the higher the security risk of the terminal device.

[0029] This step fully considers the differentiated impact of different hardware indicators on the overall security posture. By allocating weights, it achieves reasonable weighting of multi-dimensional parameters, avoids bias caused by single indicator evaluation, ensures the objectivity of risk assessment results and the ability to prevent and evade risks. At the same time, the weight coefficient table trained based on historical data can be adapted to the security protection needs of different scenarios.

[0030] In some embodiments, step 103, combining risk assessment feature values ​​and data feature headers, generates a temporary access credential for the terminal device, including: Based on risk assessment feature values, determine the corresponding security time threshold for terminal devices; The security time threshold, data security level, and timestamp are hashed to generate temporary access credentials.

[0031] Specifically, by using a lookup table, risk assessment feature values ​​are mapped to time limit variables with a reciprocal relationship, achieving a strong binding between risk level and voucher validity period. That is, the higher the risk, the shorter the voucher validity period, effectively reducing the security risk after voucher leakage. When the risk assessment feature value is 0.2, the security time threshold is 30 seconds; when the feature value is 0.8, the security time threshold is 5 seconds. These are specific examples of time limit variables. The mapping relationship can be implemented through a preset mapping table, which is stored in the high-speed cache of the core gateway for fast lookup. A secure hash algorithm engine is invoked to ensure the security of the calculation process. This engine uses hardware acceleration to improve hash calculation efficiency. SHA-256 is a secure hash algorithm. One specific implementation of the algorithm outputs a 256-bit length, exhibiting irreversibility and collision resistance to effectively prevent credential tampering. It serializes and combines the time limit variable, data security level, and the current timestamp extracted from the hardware clock into a combined string. The data security level is converted to numerical form: Ordinary Security Level 1, Confidential Level 2, and Top Secret Level 3. The current timestamp is accurate to milliseconds to ensure the uniqueness of the combined string. The combined string is then subjected to a SHA-256 hash operation, outputting a 256-bit irreversible verification string as a temporary access credential. This credential contains core information such as terminal access permissions and validity period, and is tamper-proof. The credential format uses hexadecimal encoding for easy transmission and storage.

[0032] This step ensures the timeliness and security of credentials by strongly linking risk with credential validity, avoiding the risk of credentials being stolen and reused over a long period. At the same time, the use of the SHA-256 hash algorithm ensures the uniqueness and immutability of credentials, providing a reliable authentication basis for subsequent access control.

[0033] In some embodiments, step 104, when the temporary access credential is valid, executes the first access control link, including: Get the current access time of the terminal device; Calculate the time difference between the current access time and the timestamp; When the time difference is less than the security time threshold, the temporary access credential is determined to be valid, and the basic information of the data to be accessed is allowed. Update the total number of currently open ports on the terminal device according to the preset sampling period; If the updated total number of currently open ports exceeds the preset port threshold, override the security time threshold and set it to zero to invalidate temporary access credentials.

[0034] Specifically, upon receiving a data retrieval command from the terminal device, the local system clock tick count is read and converted into a standard time format as the current access time. YYYY-MM-DDHH:MM:SS.ms is one specific implementation of the standard time format. The current access time is subtracted from the initial timestamp carried by the temporary access credential to obtain the consumed time scalar, with the unit of the time scalar being milliseconds. Based on the comparison result between the time scalar and the security time threshold, if the time scalar is less than the security time threshold, a read enable signal is sent to the storage controller to grant access to the basic information of the data to be accessed. The terminal device is allowed to obtain the basic information through a preset interface. Data name, creation time, and summary information are all considered basic information. This type of information does not contain sensitive content and can be quickly allowed. If the time scalar is greater than or equal to the security time threshold, the access request is directly rejected, and a credential expiration prompt is returned. The prompt message adopts a standardized protocol format for easy parsing and processing by the terminal device.

[0035] Specifically, a bypass listening daemon is started. This process is independent of the main business process and uses a low-priority scheduling mechanism to avoid affecting the main link response speed. Port probes are sent to terminal devices at millisecond intervals to retrieve the current port dictionary of the terminal. A specific implementation method uses 100ms as the millisecond interval. The ICMP protocol is the specific protocol used by the port probes, which features fast detection speed and low resource consumption. The total number of active key-value pairs in the port dictionary is counted, i.e., the updated total number of currently open ports. A preset port threshold is set, with 60 ports being a specific implementation method. This threshold can be dynamically adjusted according to the terminal type. For example, the preset port threshold can be set to 40 for industrial control terminals and 80 for office terminals. Based on the comparison between the updated total number of open ports and the preset port threshold, when the total number of open ports exceeds the threshold, a zero value is directly written to the shared memory area, forcibly erasing the original security time threshold. When the security time threshold is zero, the temporary access credential immediately becomes invalid, the first access control link stops allowing access, and an anomaly notification is sent to the second link to start deep verification, achieving rapid response to anomalies.

[0036] This step implements extremely low latency response to basic data based on time windows in the first access control link, ensuring the smooth flow of normal business processes. At the same time, it reduces the security risks caused by credential leakage through validity period control. The introduced dynamic dimension reduction blocking mechanism makes up for the defense gap that may be caused by fixed time thresholds during the execution of the first access control link, and realizes nanosecond-level dynamic blocking of sudden terminal hijacking, such as abnormal increase in ports or malicious program intrusion causing port occupation, thereby improving the real-time performance of protection.

[0037] In some embodiments, in step 105, the second access control link further includes: when the comparison is successful, allowing the terminal device to read the core payload of the data to be accessed, wherein the core payload is the data portion of the data to be accessed excluding basic information.

[0038] Specifically, after the second access control link completes the distance comparison, if the comparison passes (meaning the terminal's current behavior matches the historical access trajectory and there are no anomalies), it sends a verification success confirmation flag to the first access control link. 0x00 represents success, and this is one specific implementation of the verification success confirmation flag. This flag uses binary encoding for fast transmission and identification. After receiving the confirmation flag, the first access control link sends a lock release command to the underlying file system driver to release the access restriction on the core load data. The core load data contains key information such as core business data, sensitive parameters, and encryption keys. This information must undergo deep verification before it can be released. Based on the original data access pointer, the memory access offset range of the high-security core load data block is opened, allowing the terminal device to read core business data, sensitive parameters, and other core load data. This achieves layered protection of "rapid release of basic information and release of core data after verification." The memory access offset range is determined by a preset permission mapping table, with different security levels of data corresponding to different offset ranges to ensure data isolation.

[0039] This step achieves physical-level layered isolation protection between sensitive data and basic data through an asynchronous confirmation mechanism, constructing a defense-in-depth system for data flow and preventing unauthorized access to core data. At the same time, the layered access mechanism balances business efficiency and data security.

[0040] In some embodiments, step 105, performing distance comparison based on communication port identifier, connection frequency, and historical access trajectory of the terminal device, includes: Extract the baseline communication port identifier and baseline connection frequency from historical access trajectories; Construct the current behavior matrix based on communication port identifiers and connection frequencies; A baseline behavior matrix is ​​constructed based on the baseline communication port identifier and the baseline connection frequency; Calculate the Manhattan distance between the current behavior matrix and the baseline behavior matrix; If the Manhattan distance is greater than a preset distance threshold, the comparison is determined to have failed.

[0041] Specifically, baseline behavior logs of the terminal device under compliant status for the past 7 days are read from a persistent time-series database. Communication port identifiers and connection frequencies are extracted from the logs as baseline communication port identifiers and baseline connection frequencies. InfluxDB is a specific implementation of a persistent time-series database, which has high write performance and time-series data query advantages, and can efficiently store terminal access behavior logs. Ports 8080 and 443 are specific examples of communication port identifiers, corresponding to the default ports for HTTP and HTTPS protocols, respectively. The number of connections per minute is a specific example of connection frequency, reflecting the terminal's access activity. Based on the extracted terminal's current communication port identifier and current connection frequency, a 2×1 two-dimensional floating-point array is initialized as the current behavior matrix. The first row stores the communication port identifier, and the second row stores the connection frequency. Based on the baseline communication port identifier and baseline connection frequency, a 2×1 two-dimensional floating-point array is initialized as the baseline matrix. The corresponding elements of the two matrices are traversed, and the absolute value operation of the element difference is performed. All absolute values ​​of the differences are accumulated to obtain the Manhattan distance scalar. The Manhattan distance can accurately reflect the degree of difference between the two matrices. A preset distance threshold is set. 5.0 is a specific implementation of the preset distance threshold, which can be adjusted according to the terminal behavior characteristics. For example, the distance threshold for industrial terminals can be set to 3.0, and for office terminals it can be set to 7.0. If the calculated Manhattan distance scalar is greater than the preset distance threshold, the comparison is determined to have failed, triggering credential cancellation and access blocking. If it is less than or equal to the threshold, the comparison is determined to have passed.

[0042] This step forces the fuzzy behavior comparison to be reduced in dimensionality and anchored to the underlying deterministic mathematical matrix calculation steps, eliminating the black box nature of the algorithm, ensuring the absolute objectivity and repeatability of anomaly identification and judgment, avoiding the bias of human judgment, and at the same time, through Manhattan distance calculation, it can quickly and accurately identify terminal behavior anomalies, improving the efficiency and accuracy of risk identification.

[0043] In some embodiments, after issuing a credential cancellation instruction in step 105 to block further access to the terminal device, the method further includes: Count the cumulative number of voucher cancellation instructions issued within a preset time period; When the cumulative number of attempts exceeds a preset threshold, the network interconnection layer address of the terminal device is extracted; The network interconnect layer address is written into the hardware isolation list of the network interface controller to reject all packets from the network interconnect layer address.

[0044] Specifically, a counter instance is instantiated in memory. This counter specifically listens for callback actions of credential cancellation events, employing atomic operations to ensure counting accuracy. The counter automatically increments by 1 each time a credential cancellation command is issued. A preset time period and a preset number of counts are implemented; one hour is one specific implementation of the preset time period, and five counts are another. These can be dynamically adjusted according to security level requirements; in high-security scenarios, the count threshold can be set to three. When the cumulative count of the counter within the preset time period exceeds the preset number of counts, the terminal device is deemed to have malicious access suspicion, potentially involving brute-force attacks or other malicious behaviors. The network interconnection layer address corresponding to the terminal device is intercepted from the network protocol stack layer. The IP layer belongs to the network protocol... At the bottom layer of the stack, IPv4 addresses and MAC addresses belong to the network interconnection layer, enabling precise location of terminal devices. The peripheral component interconnection standard driver interface is called to communicate with the network interface controller (NIC). The peripheral component interconnection standard is PCIe, characterized by high transmission speed and strong compatibility. The NIC is the core hardware for terminal-network connection. The intercepted network interconnection layer address is directly injected into the physical network card's drop register and access control list (ACL), used to filter network packets. When the physical network card receives a packet from this address, it directly performs silent packet dropping, preventing forwarding to the core gateway, thus achieving physical-level access blocking and preventing malicious access from the bottom layer.

[0045] This step introduces physical boundary defense logic when logical interception is frequently triggered, extending the security defense from the pure software algorithm layer to the underlying network hardware layer. This completely prevents malicious port connections from continuously consuming the server's CPU computing power, ensuring the operational security of the core system base, and forming a dual protection system of logical interception and physical blocking.

[0046] Example 2: Figure 2 As shown, the following preferred technical solutions are provided: Based on Example 1, this embodiment also provides a data security protection system based on multi-level access control, including: The access request core parameter acquisition module is used to implement the function of step 101 in embodiment 1. Specifically, it is used to obtain the terminal running status vector of the terminal device that initiates the access request, as well as the data feature header of the data to be accessed. The data feature header includes the data security level and timestamp. At the same time, it is responsible for extracting multiple data security levels and selecting the highest security level as the target security level when the terminal device is detected to be concurrently accessing multiple data to be accessed, generating a global data feature header and transmitting it.

[0047] Specifically, this module comprises three sub-units: a port listening unit, a parameter extraction unit, and a concurrent processing unit. The port listening unit listens for access request data packets from terminal devices via network sockets, parses the packet protocol headers, and extracts basic information such as the request source and target data identifier. The network sockets use the TCP protocol to ensure reliable data transmission. The parameter extraction unit calls the underlying interface of the operating system to extract the terminal's running state vector and the data feature header of the data to be accessed. Network jump frequency, CPU load rate, and the total number of currently open ports are all components of the terminal's running state vector. The parameter extraction frequency is synchronized with the terminal's access request frequency. The concurrent processing unit starts a time-sliding window to capture concurrent requests from the same terminal, processes multi-level data, and generates a global data feature header to avoid system congestion caused by concurrent requests. This unit uses a multi-threaded scheduling mechanism to ensure efficient processing of concurrent requests.

[0048] The risk assessment feature value calculation module is used to implement the function of step 102 in embodiment 1. Specifically, it is used to calculate the risk assessment feature value based on the terminal running status vector obtained by the access request core parameter acquisition module and combined with the preset risk judgment rules, so as to provide a risk basis for the subsequent generation of temporary access credentials.

[0049] Specifically, this module comprises three sub-units: a weight retrieval unit, a multiplication unit, and an accumulation unit. The weight retrieval unit retrieves a pre-configured weight coefficient table in non-volatile memory to obtain the weight coefficients corresponding to each dimension of the terminal's operating state vector. Network jump frequency, CPU load rate, and the total number of currently open ports are all dimensions of the terminal's operating state vector, and the weight coefficients can be dynamically adjusted through the system configuration interface. The multiplication unit performs multiplication operations on the three dimension parameters of the terminal's operating state vector with their corresponding weight coefficients to obtain three product results. The calculations are performed using floating-point numbers to ensure accuracy. The accumulation unit accumulates the three product results to generate a risk assessment feature value, which is then output to the temporary access credential generation module. This unit uses a pipelined operation method to improve computational efficiency.

[0050] The temporary access credential generation module is used to implement the function of step 103 in embodiment 1. Specifically, it combines the risk assessment feature value output by the risk assessment feature value calculation module and the data feature header output by the access request core parameter collection module to generate a temporary access credential for the terminal device, specify the validity period of the credential, and ensure the security and uniqueness of the credential.

[0051] Specifically, this module comprises three sub-units: a threshold mapping unit, a string combination unit, and a hash operation unit. The threshold mapping unit maps risk assessment feature values ​​to corresponding security time thresholds, binding risk levels with the validity period of credentials. The mapping relationship is implemented through a preset mapping table and can be dynamically updated. The string combination unit serializes and combines the security time threshold, data security level, and timestamp to form a combined string. The combination order is timestamp, data security level, and security time threshold, ensuring the uniqueness of the combined string. The hash operation unit calls the SHA-256 hash algorithm engine to perform hash operations on the combined string, generating an irreversible temporary access credential, which is then output to the first access control link execution module. This unit uses hardware acceleration to improve the hash operation speed.

[0052] The first access control link execution module is used to implement the function of step 104 in embodiment 1. Specifically, it is used to determine whether the temporary access credential is valid. If it is valid, the first access control link is executed to verify the temporary access credential and allow the terminal device to read the basic information of the data to be accessed. At the same time, it is responsible for dynamically updating the total number of open ports of the terminal and forcing the temporary access credential to become invalid when the port is abnormal, so as to achieve dynamic blocking.

[0053] Specifically, this module comprises three sub-units: a validity period verification unit, a basic information release unit, and a port update unit. The validity period verification unit obtains the current access time, calculates the difference between the current access time and the voucher timestamp, and determines whether the voucher is valid. The verification frequency is once every 10ms to ensure timeliness. When the voucher is valid, the basic information release unit sends a read enable signal to the storage controller to grant read access to basic information. This unit communicates with the storage controller via a high-speed interface to improve data transmission speed. The port update unit starts a bypass listening daemon process to periodically update the total number of open ports on the terminal. When the total number of ports exceeds a preset port threshold, the security time threshold is set to zero, causing the voucher to become invalid. This unit adopts a low-resource-consumption design and does not affect the performance of the main link.

[0054] The second access control link parallel triggering module is used to implement the function of step 105 in embodiment 1. Specifically, it is used to trigger in parallel with the first access control link, extract the communication port identifier and connection frequency of the current request behavior of the terminal device, and perform distance comparison with the terminal's historical access trajectory. If the comparison fails, a credential cancellation instruction is issued to block access. If the comparison passes, the terminal is allowed to read the core load. At the same time, it is responsible for counting the number of credential cancellations and performing hardware isolation when the number exceeds the limit.

[0055] Specifically, this module comprises four sub-units: a behavior parameter extraction unit, a distance comparison unit, an access control unit, and a hardware isolation unit. The behavior parameter extraction unit extracts the terminal's current communication port identifier and connection frequency, synchronizing the extraction frequency with the terminal's request behavior. The distance comparison unit extracts historical baseline parameters from a time-series database, constructs a current behavior matrix and a baseline behavior matrix, calculates the Manhattan distance, and compares it with a preset threshold. This unit employs parallel computing to improve comparison efficiency. The access control unit issues a credential cancellation command when the comparison fails and allows reading the core payload when the comparison succeeds. This unit communicates with the first access control link execution module via interruption to ensure response speed. The hardware isolation unit counts the cumulative number of credential cancellations. When the limit is exceeded, it extracts the terminal's network interconnection layer address, writes it to the network card hardware isolation list, and implements physical blocking. This unit communicates directly with the network interface controller to ensure timely blocking.

[0056] The system provided in this embodiment, through the collaborative work of five core modules, perfectly adapts to the protection method in Embodiment 1, achieving asynchronous parallel dual-link protection. This ensures both low-latency access to basic data and precise control of deep risks. Simultaneously, through module decomposition and sub-unit design, the system's scalability and maintainability are improved. Parameter thresholds and weight coefficients can be adjusted according to different application scenarios to adapt to the security protection needs of different scenarios. Industrial IoT and government data platforms are specific examples of different application scenarios. This system can be configured to adapt to the high-concurrency, multi-level data protection needs of various scenarios.

[0057] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0058] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A data security protection method based on multi-level access control, characterized in that, include: S101, obtain the terminal running state vector of the terminal device that initiated the access request, and the data feature header of the data to be accessed, which includes the data security level and timestamp; S102, Based on the terminal operating state vector and the preset risk determination rules, obtain the risk assessment feature value; S103, combine the risk assessment feature value and the data feature header to generate a temporary access credential for the terminal device; S104, when the temporary access credential is within its validity period, execute the first access control link, the first access control link including verifying the temporary access credential and allowing the terminal device to read the basic information of the data to be accessed; S105, while executing the first access control link, a second access control link is triggered in parallel. The second access control link includes extracting the communication port identifier and connection frequency of the terminal device in the current request behavior, performing distance comparison based on the communication port identifier, the connection frequency and the historical access trajectory of the terminal device, and issuing a credential cancellation instruction to block the subsequent access of the terminal device when the comparison fails.

2. The data security protection method based on multi-level access control according to claim 1, characterized in that, The terminal operating state vector includes network hop frequency, central processing unit load rate, and total number of currently open ports; obtaining the terminal operating state vector of the terminal device initiating the access request includes: Extract the network hopping frequency, central processing unit load rate, and total number of currently open ports of the terminal device within a preset time window; The terminal operating state vector is obtained by concatenating the network hopping frequency, the central processing unit load rate, and the total number of currently open ports.

3. The data security protection method based on multi-level access control according to claim 1, characterized in that, The risk assessment feature values ​​obtained based on the terminal's operating state vector and preset risk determination rules include: Obtain the weighting coefficients corresponding to network hop frequency, central processing unit load rate, and total number of currently open ports, respectively; The risk assessment feature value is calculated based on the network hopping frequency, central processing unit load rate, total number of currently open ports, and their respective weight coefficients.

4. The data security protection method based on multi-level access control according to claim 1, characterized in that, The step of combining the risk assessment feature value and the data feature header to generate a temporary access credential for the terminal device includes: Based on the risk assessment feature values, the security time threshold corresponding to the terminal device is determined; The temporary access credential is generated by hashing the security time threshold, the data security level, and the timestamp.

5. A data security protection method based on multi-level access control according to claim 1, characterized in that, The step of executing the first access control link while the temporary access credential is valid includes: Obtain the current access time of the terminal device; Calculate the time difference between the current access time and the timestamp; When the time difference is less than the security time threshold, it is determined that the temporary access credential is within its validity period, and the basic information of the data to be accessed is allowed. The total number of currently open ports of the terminal device is updated according to a preset sampling period; When the updated total number of currently open ports exceeds a preset port threshold, the security time threshold is overridden and set to zero, thereby invalidating the temporary access credential.

6. A data security protection method based on multi-level access control according to claim 1, characterized in that, The second access control link also includes: When the comparison passes, the terminal device is allowed to read the core payload of the data to be accessed, which is the data portion of the data to be accessed excluding the basic information.

7. A data security protection method based on multi-level access control according to claim 1, characterized in that, The distance comparison based on the communication port identifier, the connection frequency, and the historical access trajectory of the terminal device includes: Extract the baseline communication port identifier and baseline connection frequency from the historical access trajectory; Construct the current behavior matrix based on the communication port identifier and the connection frequency; A benchmark behavior matrix is ​​constructed based on the benchmark communication port identifier and the benchmark connection frequency; Calculate the Manhattan distance between the current behavior matrix and the baseline behavior matrix; If the Manhattan distance is greater than a preset distance threshold, the comparison is determined to have failed.

8. A data security protection method based on multi-level access control according to claim 1, characterized in that, The step of obtaining the terminal operating state vector of the terminal device initiating the access request, and the data feature header containing the data security level and timestamp of the data to be accessed, includes: When it is detected that the terminal device initiates multiple access requests for multiple data to be accessed within a preset time interval, multiple data security levels corresponding to the multiple access requests are extracted; Select the highest security level from the multiple data security levels as the target security level; Based on the target security level and the timestamp, a global data feature header is generated for the multiple access requests, and the global data feature header is transmitted as the data feature header.

9. A data security protection method based on multi-level access control according to claim 1, characterized in that, After issuing the credential cancellation instruction to block further access to the terminal device, the method further includes: The cumulative number of times the certificate cancellation instruction was issued within a preset time period is counted; When the cumulative number of times exceeds a preset threshold, the network interconnection layer address of the terminal device is extracted; The network interconnect layer address is written into the hardware isolation list of the network interface controller to reject all data packets from the network interconnect layer address.

10. A data security protection system based on multi-level access control, characterized in that, A data security protection method based on multi-level access control, as described in any one of claims 1-9, comprises: The access request core parameter acquisition module obtains the terminal running status vector of the terminal device that initiated the access request, as well as the data feature header of the data to be accessed, which includes the data security level and timestamp. The risk assessment feature value calculation module obtains risk assessment feature values ​​based on the terminal's operating state vector and preset risk determination rules. The temporary access credential generation module combines the risk assessment feature value and the data feature header to generate a temporary access credential for the terminal device. The first access control link execution module executes the first access control link when the temporary access credential is within its validity period. The first access control link includes verifying the temporary access credential and allowing the terminal device to read the basic information of the data to be accessed. The second access control link parallel triggering module triggers the second access control link in parallel while executing the first access control link. The second access control link includes extracting the communication port identifier and connection frequency of the terminal device in the current request behavior, performing distance comparison based on the communication port identifier, the connection frequency and the historical access trajectory of the terminal device, and issuing a credential cancellation instruction to block the subsequent access of the terminal device when the comparison fails.

Images