A layered permission isolation information system operation and maintenance risk management and control system

Abstract

The application discloses a layered permission isolation information system operation and maintenance risk management and control system, which allocates a globally unique resource identifier and a security classification label for operation and maintenance resources, generates an operation and maintenance context vector in combination with an operation and maintenance personnel identity, post responsibility, authorized operation record and terminal environment parameter, identifies an operation and maintenance scene category according to a target resource identifier, an operation type and a current post responsibility, screens a scene permission subset from a benchmark permission set, corrects the permission according to an environment security level and a resource security classification label to generate a dynamically effective permission set, calculates a risk prediction value based on the execution frequency of an operation sequence within a historical time window, a same type operation concurrent conflict index and a behavior deviation degree, and performs hierarchical intervention, realizes dynamic adaptation of permission configuration, operation and maintenance scenes, personnel responsibilities and terminal environments, improves the fine degree of sensitive resource access control, and improves the pre-identification and real-time disposal capability of operation and maintenance risks.

Description

Technical Field

[0001] This invention relates to the field of operation and maintenance risk management technology for transportation information systems, and in particular to a hierarchical access control system for operation and maintenance risk management of information systems. Background Technology

[0002] Information system operation and maintenance (O&M) involves the daily management of various resources such as servers, databases, network devices, and business applications. Permission configuration and risk control are directly related to business continuity and data security. Existing O&M control solutions often use roles as the smallest authorization unit, resulting in insufficient correlation between permissions and specific operation objects, business scenarios, and real-time responsibilities of personnel. This leads to different personnel within the same role, or the same personnel in different scenarios, holding the same set of permissions. Access control for sensitive resources is too coarse-grained, making it difficult to effectively contain the risks of unauthorized operations and permission spread. At the same time, existing solutions focus on identity authentication and post-event auditing for O&M risk management, lacking the ability to proactively assess and intervene in dynamic risks triggered by environmental changes, operation sequence combinations, or abnormal behavior patterns during operation execution. Abnormal operations are often only discovered through log backtracking after actual impact, resulting in a significant time lag in risk handling. These problems hinder further improvement in the security level of information system O&M.

[0003] Therefore, there is an urgent need to provide a technical solution to address the above problems. Summary of the Invention

[0004] To address the aforementioned technical problems, this invention provides a hierarchical access control system for information system operation and maintenance risk management. The technical solution of this hierarchical access control system for information system operation and maintenance risk management is as follows:

[0005] The operation and maintenance resource management module is used to assign globally unique resource identifiers and security classification labels to the operation and maintenance resources involved in the integration and implementation services of the transportation information system.

[0006] The operation and maintenance context acquisition module is used to obtain the identity of operation and maintenance personnel, their current job responsibilities, authorized operation records, and terminal environment parameters, and generate an operation and maintenance context vector.

[0007] The operation scenario identification module is used to determine the operation scenario category to which the operation request belongs based on the target resource identifier, operation type and operation parameters extracted from the operation request initiated by the operation and maintenance personnel, combined with the current job responsibilities in the operation and maintenance context vector.

[0008] The dynamic permission adjudication module is used to retrieve the corresponding baseline permission set based on the identity identifier and current job responsibilities in the operation and maintenance context vector, filter the scenario permission subset from the baseline permission set according to the operation and maintenance scenario category, evaluate the environment security level according to the terminal environment parameters, and modify the permissions of the scenario permission subset according to the security level label corresponding to the target resource identifier and the environment security level, thereby generating a dynamically effective permission set for the current operation session.

[0009] The operation risk prediction module is used to obtain the execution frequency of the operation sequence corresponding to the operation request within a preset historical time window, the concurrency conflict index of the same type of operation on the same resource, and the behavioral deviation degree between the operation sequence and the authorized operation record after determining that the operation request belongs to the set of dynamically effective permissions, and to calculate the risk prediction value based on the execution frequency, the concurrency conflict index and the behavioral deviation degree.

[0010] The dynamic intervention execution module is used to allow the operation request when the risk prediction value is less than a first threshold, trigger secondary authentication and allow the operation after successful authentication when the risk prediction value is between the first threshold and a second threshold, and intercept the operation request and generate an alarm when the risk prediction value is not less than the second threshold.

[0011] The technical solution of this invention assigns globally unique resource identifiers and security classification labels to operation and maintenance resources. It generates an operation and maintenance context vector by combining the identity of operation and maintenance personnel, job responsibilities, authorized operation records, and terminal environment parameters. Based on the target resource identifier, operation type, and current job responsibilities, it identifies the operation and maintenance scenario category. It then selects a subset of scenario permissions from the baseline permission set and modifies permissions according to the environmental security level and resource security classification labels to generate a dynamically effective permission set. Simultaneously, it calculates risk prediction values ​​and performs graded intervention based on the execution frequency of operation sequences within historical time windows, the concurrent conflict index of similar operations, and behavioral deviation. This solves the problems of insufficient real-time correlation between permissions and operation objects, business scenarios, and personnel responsibilities in existing operation and maintenance management, resulting in coarse-grained access control. It also addresses the lack of proactive assessment and real-time intervention for dynamic risks triggered by environmental changes, operation sequence combinations, or abnormal behavior patterns during operations. This achieves dynamic adaptation of permission configuration to operation and maintenance scenarios, personnel responsibilities, and terminal environments, improving the granularity of access control for sensitive resources and enhancing the proactive identification and real-time handling capabilities of operation and maintenance risks.

[0012] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0013] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without any creative effort.

[0014] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0015] Figure 1 This is a schematic diagram of an embodiment of an information system operation and maintenance risk management system with hierarchical permission isolation according to the present invention. Detailed Implementation

[0016] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be limited to the embodiments set forth herein.

[0017] Figure 1 This diagram illustrates the structure of an embodiment of a hierarchical access control system for information system operation and maintenance risks, provided by the present invention. Figure 1 As shown, this hierarchical access control information system operation and maintenance risk management system includes:

[0018] The Operation and Maintenance Resource Management Module 110 is used to allocate globally unique resource identifiers and security classification labels to the operation and maintenance resources involved in the integration and implementation services of the transportation information system.

[0019] The traffic information system refers to an integrated operating platform consisting of traffic signal control equipment, traffic flow detection equipment, traffic information dissemination equipment, and communication network equipment, used to realize traffic signal control, traffic condition monitoring, and traffic guidance information dissemination functions. For example, a city's smart traffic management platform deploys intersection traffic signal controllers, geomagnetic coil traffic flow detectors, variable message signs, and fiber optic communication gateway equipment. The above equipment is connected to the traffic management and control center through a dedicated network, constituting the city's traffic information system.

[0020] Operation and maintenance resources refer to the collective term for hardware equipment, software services, and configuration data that need to be managed and maintained in the traffic information system, including traffic signal controllers, traffic flow detectors, variable message signs, communication gateway devices, and firmware programs and configuration parameter files running on the aforementioned devices. For example, the traffic signal controller deployed at a certain intersection and its internally stored signal timing parameter table, the geomagnetic detector at the intersection and its calibration parameters, and the variable message signs on the roadside and their display content configuration files are all operation and maintenance resources.

[0021] The resource identifier refers to a globally unique code assigned by the operation and maintenance resource management module 110 to each operation and maintenance resource, used to uniquely distinguish and locate different operation and maintenance resources in the information system. For example, the operation and maintenance resource management module 110 assigns the resource identifier "SC-2026-07-01-A001" to the east-west traffic signal controller at an intersection, and assigns the resource identifier "VD-2026-07-01-B003" to the geomagnetic traffic flow detector at the same intersection. The security classification label refers to the security level label assigned by the operation and maintenance resource management module 110 to each operation and maintenance resource based on its sensitivity and impact on traffic operation, including the resource confidentiality level and the resource impact level. For example, the operation and maintenance resource management module 110 labels the traffic signal controller at an intersection with a security classification label of confidentiality level L3 and impact level A, and labels the geomagnetic traffic flow detector at the same intersection with a security classification label of confidentiality level L1 and impact level B.

[0022] The operation and maintenance context acquisition module 120 is used to obtain the identity of operation and maintenance personnel, current job responsibilities, authorized operation records and terminal environment parameters, and generate operation and maintenance context vectors.

[0023] Among them, operation and maintenance personnel refer to staff who are responsible for performing daily inspections, configuration adjustments, fault handling, and parameter optimization of operation and maintenance resources in the traffic information system; for example, Mr. A is an operation and maintenance engineer at a city's traffic management and control center, responsible for adjusting the signal timing parameters of the traffic signal controller at the intersection.

[0024] The "identity identifier" refers to the unique identification information used to identify maintenance personnel in the information system. It is generated and bound to the personnel during registration. For example, Mr. A's identity identifier in the maintenance management platform is "USER-A-10086". "Current job responsibilities" refers to the work functions and task scope assigned or confirmed to the maintenance personnel during the current working period, used to limit the types of resources and scenarios that the personnel can operate on. For example, Mr. A's job responsibilities during the current working period are "Signal Timing Engineer," responsible for adjusting and optimizing traffic signal timing parameters. "Authorized operation records" refers to historical logs of maintenance operations that have been authorized and approved. Each record includes the operation time, maintenance personnel identity identifier, target resource identifier, operation type, operation parameters, and operation result. For example, Mr. A executed three authorized operation records in the past 24 hours: adjusting the signal cycle duration of traffic signal controller A at 9:00 AM, adjusting the green ratio of traffic signal controller B at 10:00 AM, and adjusting the signal cycle duration of traffic signal controller C at 2:00 PM. Terminal environment parameters refer to the operating environment information of the terminal device used by the maintenance personnel when initiating the operation request, including the IP address location, terminal geographical coordinates, and terminal device fingerprint information. For example, when Mr. A initiated the operation request, the IP address of the terminal device used was located in the intranet address range of the city's traffic management control center, the terminal geographical coordinates were 121.47 degrees east longitude and 31.23 degrees north latitude, and the terminal device fingerprint information was the encrypted hash value corresponding to the device serial number "T-2026-0088".

[0025] The operation and maintenance context vector refers to a structured data object generated by the operation and maintenance context acquisition module 120 by combining the identity of the operation and maintenance personnel, their current job responsibilities, authorized operation records, and terminal environment parameters, which serves as the input parameters for subsequent scenario identification and permission determination. For example, the operation and maintenance context acquisition module 120 packages Mr. A's identity "USER-A-10086", his current job responsibilities "signal timing engineer", the set of authorized operation records, and terminal environment parameters to generate an operation and maintenance context vector in JSON format.

[0026] The operation scenario identification module 130 is used to determine the operation scenario category to which the operation request belongs based on the target resource identifier, operation type and operation parameters extracted from the operation request initiated by the operation and maintenance personnel, combined with the current job responsibilities in the operation and maintenance context vector.

[0027] An operation request refers to a data packet sent by maintenance personnel to the information system via a terminal device to perform a specific operation on a specific maintenance resource. It contains three basic elements: target resource identifier, operation type, and operation parameters. For example, Mr. A sends a data packet to the platform on his terminal device to execute the instruction "adjust signal cycle duration" on the traffic signal controller "SC-2026-07-01-A001" and set the target cycle duration to "120 s". This data packet is an operation request.

[0028] The target resource identifier refers to the resource identifier of the maintenance resource to be operated on, specified in the operation request. It is used to locate the specific resource being operated on and obtain its security classification label during the authorization process. For example, the target resource identifier carried in Mr. A's operation request is "SC-2026-07-01-A001," which points to a traffic signal controller at a certain intersection. The operation type refers to the category of actions that the maintenance personnel intend to perform on the target resource, specified in the operation request. This includes reading configuration parameters, modifying configuration parameters, restarting the device, upgrading firmware, and calibrating detection parameters. For example, the operation type in Mr. A's operation request is "modify configuration parameters." The operation parameters refer to the specific input values ​​or configuration item values ​​required to execute the operation type, specified in the operation request. These parameters are used to limit the specific content and scope of the operation. For example, the operation parameters in Mr. A's operation request are signal cycle duration "120 s" and green signal ratio "0.45."

[0029] The operation and maintenance scenario category refers to the business scenario classification of the operation and maintenance operation determined by the operation scenario identification module 130 based on the target resource identifier, operation type, and operation parameters in the operation request, combined with the current job responsibilities of the operation and maintenance personnel. For example, the operation scenario identification module 130 maps the operation request initiated by Mr. A to the "traffic signal timing parameter adjustment scenario" based on the target resource identifier "SC-2026-07-01-A001" (pointing to the traffic signal controller), the operation type "modify configuration parameters", and Mr. A's current job responsibility "signal timing engineer".

[0030] The dynamic permission adjudication module 140 is used to retrieve the corresponding baseline permission set based on the identity identifier and current job responsibilities in the operation and maintenance context vector, filter the scenario permission subset from the baseline permission set according to the operation and maintenance scenario category, evaluate the environment security level according to the terminal environment parameters, and modify the permissions of the scenario permission subset according to the security classification label corresponding to the target resource identifier and the environment security level, thereby generating a dynamically effective permission set for the current operation session.

[0031] It should be noted that the dynamic permission adjudication module 140 follows the formula Calculate the corrected permission values, where The basic weight value of the resource determined by the security classification label of the target resource; the higher the sensitivity of the resource, the lower the weight value. The larger the value, the more restricted the permissions for highly sensitive resources will be. The environmental adjustment coefficient is determined by the environmental safety level obtained from the assessment of terminal environmental parameters. The lower the environmental safety level, the more... The smaller the value, the more restricted the permissions are in insecure terminal environments; The weighting coefficients for operation and maintenance scenarios are categorized by scenario type, with lower coefficients for high-risk scenarios. The value is used to lower the permission limit; It is a time-exponential decay term. This represents the unused time since the last operation request was executed by the operations and maintenance personnel in the current scenario. The longer the unused time, the closer the decay factor is to 0, and the permission value shrinks accordingly, forming a use-and-use dynamic convergence mechanism where permissions are naturally revoked as they are not used.

[0032] The baseline permission set refers to the complete list of permissions granted to the maintenance personnel based on their identity and current job responsibilities, retrieved from the permission management database under conditions without any scenario or environmental constraints. For example, the permission management database retrieves the baseline permission set for the "Signal Timing Engineer" role based on Mr. A's identity "USER-A-10086" and current job responsibilities "Signal Timing Engineer." This set includes permissions to read and modify the timing parameters of all traffic signal controllers in the city. The scenario permission subset refers to the subset of permission items related to the current maintenance scenario, selected by the dynamic permission adjudication module 140 from the baseline permission set based on the maintenance scenario category. For example, the dynamic permission adjudication module 140 selects permission items related to signal cycle length adjustment and green ratio adjustment from Mr. A's baseline permission set based on the maintenance scenario category "Traffic Signal Timing Parameter Adjustment Scenario," forming the scenario permission subset.

[0033] The environmental security level refers to the security level of the network and physical environment of the current operating terminal, as assessed by the dynamic permission adjudication module 140 based on terminal environmental parameters. For example, the dynamic permission adjudication module 140 assesses the environmental security level as "high security level" based on the IP address location (internal network address range) and geographical coordinates (located within the traffic management control center building) of the terminal device when Mr. A initiates the operation request. The current operation session refers to a complete operation process from login to logout for the operations and maintenance personnel, during which the dynamic set of active permissions for that personnel is continuously maintained. For example, if Mr. A logs into the operations and maintenance platform at 9:00 AM and logs out at 11:00 AM, this two-hour login period constitutes one of Mr. A's current operation sessions.

[0034] The dynamically effective permission set refers to the set of permissions that the dynamic permission adjudication module 140 generates for the operation and maintenance personnel in the current operation session, which is actually effective after scenario filtering and dual correction of environment security level and security classification label. For example, the dynamic permission adjudication module 140 generates a dynamically effective permission set for Mr. A in the current operation session. This set includes permissions for resource identifier "SC-2026-07-01-A001" that allow the execution of signal cycle duration adjustment operation, and the cycle duration parameter value is limited to the range of "60 s to 180 s".

[0035] The operation risk prediction module 150 is used to obtain the execution frequency of the operation sequence corresponding to the operation request within a preset historical time window, the concurrency conflict index of the same type of operation on the same resource, and the behavioral deviation between the operation sequence and the authorized operation record after determining that the operation request belongs to the set of dynamically effective permissions, and to calculate the risk prediction value based on the execution frequency, the concurrency conflict index and the behavioral deviation.

[0036] It should be noted that the concurrency conflict index The value is determined by: counting the number of all operation requests within a preset historical time window that have the same operation type as the current operation request and act on the same target resource identifier, and then dividing the count by the preset maximum concurrent conflict index. The resulting ratio serves as a concurrency conflict index. The value of is determined by the fact that there is any overlap between the execution time periods of each operation request.

[0037] The preset historical time window refers to the time range of historical operation records examined by the operation risk prediction module 150 when performing risk prediction. For example, when calculating the risk prediction value of Mr. A's current operation request, the operation risk prediction module 150 retrieves historical operation records within 24 hours prior to the operation request as the basis for analysis; this 24 hours is the preset historical time window. The execution frequency refers to the number of times the operation sequence corresponding to the operation request is executed by the same maintenance personnel or all maintenance personnel under the same job responsibility within the preset historical time window. For example, Mr. A's current request for the "adjust signal cycle duration" operation sequence was executed 15 times by all maintenance personnel under the signal timing engineer position within the preset historical time window of 24 hours; this 15 times is the execution frequency.

[0038] The concurrency conflict index refers to the normalized number of concurrent operations of the same type as the current operation request executed simultaneously or interleaved on the same target resource within a preset historical time window. For example, within 24 hours before the current time, three maintenance personnel simultaneously performed signal cycle duration adjustment operations on the traffic signal controller "SC-2026-07-01-A001", and the concurrency conflict index corresponding to this number of concurrent operations is 0.6. Behavior deviation refers to the quantitative value of the difference between the operation type and operation parameters in the current operation request and the operation type and operation parameters in the authorized operation records. Specifically, it is the ratio of the number of authorized operation records with inconsistent operation types and operation parameter differences exceeding a preset difference threshold to the total number of authorized operation records. For example, Mr. A currently requests to set the signal cycle duration to "200 s". There are 10 records in the authorized operation records for traffic signal timing parameter adjustment scenarios. Among them, the operation type is all to modify configuration parameters and the signal cycle duration is all within the range of "90 s to 150 s". There are 0 records with inconsistent operation types and parameter differences exceeding the preset difference threshold. Therefore, the behavior deviation is 0.1.

[0039] The risk prediction value refers to a value calculated by the operation risk prediction module 150 based on three indicators: execution frequency, concurrency conflict index, and behavioral deviation, which represents the risk level of the current operation request. The value range is normalized to between 0 and 1. For example, the operation risk prediction module 150 calculates a risk prediction value of 0.32 by substituting the execution frequency, concurrency conflict index, and behavioral deviation of Mr. A's current operation request into the risk prediction value calculation formula.

[0040] The dynamic intervention execution module 160 is used to allow the operation request when the risk prediction value is less than the first threshold, trigger secondary identity authentication and allow the operation after successful authentication when the risk prediction value is between the first threshold and the second threshold, and intercept the operation request and generate an alarm when the risk prediction value is not less than the second threshold.

[0041] The first threshold refers to a preset lower limit of the risk prediction value used to distinguish between requests that allow operation requests and requests that require secondary authentication. For example, the preset first threshold is 0.5. Mr. A's current operation request has a risk prediction value of 0.32, which is less than the first threshold of 0.5, so the operation request is allowed. The second threshold refers to a preset upper limit of the risk prediction value used to distinguish between operations that trigger secondary authentication and operations that are directly blocked. For example, the preset second threshold is 0.8. If Mr. A's current operation request has a risk prediction value of 0.85, and the risk prediction value is greater than the second threshold of 0.8, then the operation request is directly blocked and an alarm is generated.

[0042] The secondary authentication refers to an additional authentication process whereby, when the dynamic intervention execution module 160 determines that the risk prediction value is between the first threshold and the second threshold, the operation and maintenance personnel are required to provide identity verification information again to confirm the operation intention. For example, assuming that the risk prediction value of Mr. A's current operation request is 0.65, and the value is determined to be between the first threshold of 0.5 and the second threshold of 0.8, secondary authentication is triggered and a dynamic verification code is sent to Mr. A's mobile terminal. Mr. A can only continue to perform the operation after entering the correct verification code.

[0043] It should be noted that the first threshold is a preset lower limit of the risk prediction value used to distinguish between a release operation and an operation requiring secondary identity authentication, and the second threshold is a preset upper limit of the risk prediction value used to distinguish between a secondary identity authentication operation and a direct interception operation. The first threshold is less than the second threshold. When the risk prediction value is less than the first threshold, the operation risk is determined to be within an acceptable range and the operation is released directly. When the risk prediction value is between the first threshold and the second threshold, the operation is determined to have a moderate risk and secondary identity authentication is triggered. When the risk prediction value is not less than the second threshold, the operation is determined to have a high risk and the operation is directly intercepted, forming a three-level progressive real-time intervention architecture.

[0044] The technical solution of this embodiment assigns globally unique resource identifiers and security classification labels to operation and maintenance resources. It generates operation and maintenance context vectors by combining operation and maintenance personnel identity identifiers, job responsibilities, authorized operation records, and terminal environment parameters. Based on the target resource identifier, operation type, and current job responsibilities, it identifies the operation and maintenance scenario category, selects a subset of scenario permissions from the baseline permission set, and then modifies permissions according to the environmental security level and resource security classification labels to generate a dynamically effective permission set. At the same time, it calculates risk prediction values ​​and performs graded intervention based on the execution frequency of operation sequences within historical time windows, the concurrent conflict index of similar operations, and behavioral deviation. This solves the problems in existing operation and maintenance management where insufficient correlation between permissions and operation objects, business scenarios, and real-time responsibilities of personnel leads to coarse access control granularity, and the lack of pre-judgment and real-time intervention for dynamic risks triggered by environmental changes, operation sequence combinations, or abnormal behavior patterns during operation. It realizes dynamic adaptation of permission configuration with operation and maintenance scenarios, personnel responsibilities, and terminal environments, improves the fineness of access control for sensitive resources, and enhances the ability to pre-identify and handle operation and maintenance risks in real time.

[0045] The technical solution of this embodiment integrates three risk factors—execution frequency, concurrent conflict index, and behavioral deviation—using a nonlinear Sigmoid function and introducing frequency-deviation cross terms and concurrent-deviation cross terms. This enables the risk prediction value to capture the nonlinear amplification effect of risks triggered by multiple coupled factors. Compared with the post-audit method of independent thresholds or linear weighting in the prior art, it realizes dynamic risk quantification assessment before operation execution. By introducing an exponential decay term with time as the independent variable into the permission correction formula, long-term unused permissions automatically shrink as the unused time increases. This suppresses the risk of permission spread from the perspective of permission value quantification and constructs a dynamic permission convergence mechanism with multi-dimensional joint correction.

[0046] In one alternative approach, the maintenance resources include traffic signal controllers, traffic flow detectors, variable message signs, and communication gateway devices.

[0047] Traffic signal controllers refer to hardware devices deployed at traffic intersections or traffic control centers for generating traffic signal timing schemes and controlling signal light phase switching. For example, a traffic signal controller is deployed at an intersection to control the timing of traffic light switching in the east-west and north-south directions. Traffic flow detectors refer to sensing devices deployed on roads to collect real-time traffic flow parameters such as vehicle volume, speed, and occupancy. For example, a set of geomagnetic traffic flow detectors is buried in the ground at the east-west entrances of an intersection to collect traffic flow data during the daily morning rush hour.

[0048] Variable message signs (VMS) refer to electronic display devices deployed on or above roads to provide traffic guidance and control information to drivers. For example, an LED VMS is installed above the entrance to an expressway to display congestion warnings and detour suggestions in the event of a traffic accident. Communication gateway devices refer to network interconnection devices deployed between nodes of a traffic information system to enable the conversion of different communication protocols and data forwarding. For example, an industrial-grade communication gateway is configured in a cabinet at an intersection to convert serial communication data from traffic signal controllers into IP network data and upload it to the traffic management and control center.

[0049] Among the above-mentioned optional methods, the operation and maintenance resources are further limited to traffic signal controllers, traffic flow detectors, variable message signs and communication gateway devices, so that security classification labels and access control can be managed differently according to the operating characteristics of various traffic information devices, thereby improving the accuracy of resource identification and classification.

[0050] In one alternative approach, the security classification labels correspond to individual labels for each operation and maintenance resource, and the resource security level of the traffic signal controller and the communication gateway device is higher than that of the traffic flow detector and the variable message sign.

[0051] Among them, the resource confidentiality level refers to the classification index used in the security classification label to characterize the sensitivity of the data involved in the operation and maintenance resources. The higher the level, the more serious the impact caused by the unauthorized access or leakage of the resource. For example, the signal timing scheme data stored in the traffic signal controller "SC-2026-07-01-A001" involves the city's traffic coordination and control strategy, and its resource confidentiality level is marked as L3, which is higher than the L1 level of the traffic flow detector "VD-2026-07-01-B003".

[0052] Among the above optional methods, by setting different confidentiality levels for different operation and maintenance resources, traffic signal controllers and communication gateway devices can obtain stricter access control, while traffic flow detectors and variable message signs can maintain operational flexibility, thus achieving a match between permission configuration and resource sensitivity.

[0053] In one optional approach, the terminal environment parameters include the IP address location, geographical coordinates, and fingerprint information of the terminal device used by the maintenance personnel when initiating the operation request.

[0054] The IP address attribution refers to the geographical location information of the IP address assigned to the terminal device used by the maintenance personnel to initiate the operation request, including the network segment, city, and access network type to which the IP address belongs. For example, when Mr. A initiates the operation request, the IP address of the terminal device is "10.88.120.45", and the IP address attribution is within the intranet address segment of the city's traffic management and control center. The terminal geographical coordinates refer to the latitude and longitude coordinates obtained by the terminal device used by the maintenance personnel to initiate the operation request through GPS or Wi-Fi positioning. For example, when Mr. A initiates the operation request, the GPS positioning data reported by the terminal device is 121.47 degrees east longitude and 31.23 degrees north latitude, which corresponds to the area inside the traffic management and control center building. Terminal device fingerprint information refers to the combination of hardware characteristics of the terminal device used by maintenance personnel to initiate operation requests, including the device serial number, MAC address, and operating system version number, which are hashed to generate a unique identifier string. For example, when Mr. A initiates an operation request, the terminal device's serial number is "T-2026-0088", the MAC address is "AA-BB-CC-DD-EE-FF", and the operating system version number is "Windows 11 22H2". The above information is hashed using SHA-256 to generate the terminal device fingerprint information "A1B2C3D4E5F6".

[0055] Among the above-mentioned optional methods, the terminal environment parameters are further expanded to include the IP address location, the terminal's geographical coordinates, and the terminal device fingerprint information, providing a multi-dimensional data foundation for environmental security level assessment and enabling permission correction to reflect the trustworthiness of the terminal initiating the operation.

[0056] In one alternative approach, the operation and maintenance scenario categories include traffic signal timing parameter adjustment scenarios, traffic flow detector calibration scenarios, variable message sign content update scenarios, and communication gateway device configuration change scenarios.

[0057] The traffic signal timing parameter adjustment scenario refers to the maintenance scenario where maintenance personnel modify timing parameters such as signal cycle duration, green ratio, and phase difference in the traffic signal controller. For example, the operation scenario identification module 130 maps Mr. A's operation request for "modify configuration parameters" on the traffic signal controller "SC-2026-07-01-A001," with operation parameters of signal cycle duration "120 s" and green ratio "0.45," to the traffic signal timing parameter adjustment scenario. The traffic flow detector calibration scenario refers to the maintenance scenario where maintenance personnel perform calibration operations on the sensitivity parameters, sampling frequency, and detection threshold of the traffic flow detector. For example, the operation scenario identification module 130 maps Mr. B's operation request for "calibrate detection parameters" on the geomagnetic traffic flow detector "VD-2026-07-01-B003," with operation parameters of sensitivity "85%" and sampling frequency "10 Hz," to the traffic flow detector calibration scenario.

[0058] The variable message sign (VMS) content update scenario refers to an operations and maintenance (O&M) scenario where maintenance personnel update the displayed content, font size, and display duration of a VMS. For example, the operation scenario identification module 130 maps Mr. C's request to modify configuration parameters for the LED VMS "VMS-2026-07-01-C007" with the content "Congestion Ahead, Please Detour" and a display duration of "300 s" to the VMS content update scenario. The communication gateway device configuration change scenario refers to an O&M scenario where maintenance personnel modify the IP address, routing table entries, and protocol conversion rules of a communication gateway device. For example, the operation scenario identification module 130 maps Mr. D's request to modify configuration parameters for the communication gateway device "GW-2026-07-01-D005" with the IP address "192.168.1.100" and the routing table entry "Add Static Route" to the communication gateway device configuration change scenario.

[0059] Among the above optional methods, the operation and maintenance operations are further divided into scenario categories such as traffic signal timing parameter adjustment, traffic flow detector calibration, variable message sign content update, and communication gateway equipment configuration change, so that the selection of the baseline permission set is more in line with actual business needs.

[0060] In one optional approach, the dynamic set of permissions for the current operation session includes the target resource identifier corresponding to the operation request, a set of allowed operation types, and the parameter value range for each operation type in the operation type set. The parameter value range includes the signal cycle duration range and the green ratio range when the target resource identifier corresponds to the traffic signal controller, and includes the upper limit of the number of characters in the published content and the display duration range when the target resource identifier corresponds to the variable message sign.

[0061] The signal cycle duration range refers to the lower and upper limits of the allowed values ​​set for the signal cycle duration parameter in the dynamic permission set for traffic signal timing parameter adjustment scenarios. For example, in the dynamic permission set generated by the dynamic permission adjudication module 140 for Mr. A, the signal cycle duration parameter of traffic signal controller "SC-2026-07-01-A001" is constrained within the range of "60 s to 180 s," and Mr. A's operation of setting the signal cycle duration to "200 s" will be intercepted. The green ratio range refers to the lower and upper limits of the allowed values ​​set for the green ratio parameter in the dynamic permission set for traffic signal timing parameter adjustment scenarios. For example, in the dynamic permission set generated by the dynamic permission adjudication module 140 for Mr. A, the green ratio parameter of traffic signal controller "SC-2026-07-01-A001" is constrained within the range of "0.30 to 0.70," and Mr. A's operation of setting the green ratio to "0.75" will be intercepted.

[0062] The upper limit for the number of characters in the published content refers to the maximum allowed value set for the length of the published content string in the dynamic permission set for the variable message sign (VMS) content update scenario. For example, in the dynamic permission set generated by the dynamic permission adjudication module 140 for Mr. C, the upper limit for the number of characters in the published content of the variable message sign "VMS-2026-07-01-C007" is "50 Chinese characters". If Mr. C enters a published content length exceeding 50 characters, the operation will be rejected. The display duration range refers to the lower and upper limits of the allowed values ​​set for the duration of continuous display of published content in the dynamic permission set for the variable message sign content update scenario. For example, in the dynamic permission set generated by the dynamic permission adjudication module 140 for Mr. C, the display duration range of the variable message sign "VMS-2026-07-01-C007" is constrained to the range of "30 s to 600 s". Mr. C's operation of setting the display duration to "900 s" will be blocked.

[0063] In the above optional methods, specific parameter value ranges can be set for different operation types in the dynamic effective permission set, such as signal cycle duration range, green signal ratio range, upper limit of the number of characters in the published content, and display duration range, so as to form fine constraints on operation and maintenance operations and avoid parameter configuration exceeding reasonable boundaries.

[0064] In one alternative embodiment, the operational risk prediction module 150 is specifically used for:

[0065] The operation type and operation parameters corresponding to the operation request are compared with the operation type and operation parameters of each record in the authorized operation records. The number of records with inconsistent operation types and operation parameter differences exceeding a preset difference threshold is counted. The number of records is divided by the total number of authorized operation records, and the resulting ratio is used as the behavior deviation.

[0066] The preset difference threshold refers to the critical value preset by the operation risk prediction module 150 when calculating the deviation of behavior, used to determine whether there is a significant difference between the operation parameter and the parameter in the authorized operation record. For example, when the operation risk prediction module 150 compares the operation parameters, the preset difference threshold for the signal cycle duration is "30 s". If the signal cycle duration requested by Mr. A is "200 s" and the difference between it and the signal cycle duration "150 s" in the authorized operation record is 50 s, the difference exceeds the preset difference threshold of 30 s, and it is determined that the parameter difference exceeds the preset difference threshold.

[0067] In the above-mentioned optional methods, the operation type and operation parameters in the current operation request and the authorized operation records are further compared. The proportion of records with inconsistent operation types and parameter differences exceeding the threshold is counted. The obtained ratio is used as the behavior deviation degree, which provides a quantifiable assessment basis for risk prediction.

[0068] In one optional approach, the duration of the preset historical time window and the preset difference threshold are dynamically determined based on the security classification label corresponding to the target resource identifier. When the target resource identifier corresponds to the traffic signal controller or the communication gateway device, the duration of the preset historical time window is less than the duration of the preset historical time window when the target resource identifier corresponds to the traffic flow detector or the variable message sign. The preset difference threshold when the target resource identifier corresponds to the traffic signal controller or the communication gateway device is less than the preset difference threshold when the target resource identifier corresponds to the traffic flow detector or the variable message sign.

[0069] Among the above-mentioned optional methods, differentiated monitoring time windows and deviation judgment thresholds are further set for resources with different security levels, so that traffic signal controllers and communication gateway devices can obtain stricter behavior monitoring standards, and traffic flow detectors and variable message signs can maintain reasonable operational flexibility.

[0070] In one alternative approach, the formula for calculating the risk prediction value is:

[0071]

[0072] in, This represents the predicted risk value. This indicates the execution frequency of the operation sequence within a preset historical time window. This represents the index of concurrency conflicts among similar operations on the same resources. This indicates the degree of behavioral deviation between the operation sequence and the authorized operation record. To normalize the execution frequency, To normalize the concurrent conflict index, This indicates the maximum allowed execution frequency of the same type of operation within a preset historical time window. This represents the preset maximum concurrent conflict index. This represents the cross-influence term between the execution frequency and the deviation of the behavior. This represents the cross-influence term between the concurrent conflict index and the behavioral deviation. , , , , These are the preset weight coefficients for the normalized execution frequency term, the normalized concurrency conflict index term, the behavior deviation term, the first cross term, and the second cross term, respectively. .

[0073] It should be noted that the risk prediction value calculation formula uses three types of indicators as independent risk input factors: the execution frequency of the operation sequence corresponding to the operation request within a preset historical time window, the concurrent conflict index of the same type of operation on the same resource, and the behavioral deviation between the operation sequence and the authorized operation record. The execution frequency and concurrent conflict index are normalized to eliminate the difference in dimensions. On this basis, in addition to retaining the linear weighting terms of the three independent factors, an additional product term of normalized execution frequency and behavioral deviation, and a product term of normalized concurrent conflict index and behavioral deviation are introduced as cross-influence terms to capture the real characteristic that the risk is non-linearly amplified when high-frequency operation and abnormal behavior pattern occur simultaneously or when high-concurrency operation and abnormal behavior pattern occur simultaneously. The above five terms are weighted and summed by preset weight coefficients and then input into the Sigmoid function for non-linear mapping.

[0074] The above formula integrates multi-dimensional heterogeneous risk input factors into a risk prediction value normalized to the range of 0 to 1. This allows the risk prediction value to comprehensively reflect the independent and cross-coupled effects of three types of risk factors—abnormal operation frequency, concurrent conflicts, and high behavioral deviations—on the current operation request, providing a unified and quantitative basis for subsequent graded interventions.

[0075] Among the above-mentioned optional methods, a multi-dimensional risk quantification calculation model is further constructed by integrating three types of indicators: normalized execution frequency, normalized concurrent conflict index, and behavioral deviation, and introducing cross-influence terms, so that the risk prediction results can reflect the synergistic effect between indicators.

[0076] In one optional approach, the dynamically effective permission set includes permission values ​​corresponding to each permission item, and the dynamic permission adjudication module 140 is specifically used to calculate the corrected permission values ​​according to the following formula, wherein the corrected permission values ​​are the permission values ​​corresponding to each permission item in the dynamically effective permission set:

[0077]

[0078] in, Indicates maintenance personnel In the category of operation and maintenance scenarios Download the revised permission values. This indicates the operation and maintenance personnel in the scenario permission subset. In the category of operation and maintenance scenarios The original permission values ​​below, This represents the basic weight value of the resource determined by the security classification label corresponding to the target resource identifier. This represents the environmental adjustment coefficient determined by the environmental safety level obtained from the assessment of the terminal environmental parameters. Indicates the category of the operation and maintenance scenario. The corresponding scene weight coefficients, Indicates the time decay coefficient. Indicates maintenance personnel In the category of operation and maintenance scenarios The time interval between the last time the operation request was executed and the current time.

[0079] It should be noted that the revised formula for calculating permission values ​​is based on the subset of scenario permissions selected by the operation scenario identification module 130. The original permission value of the operation and maintenance personnel in the current operation and maintenance scenario category within the subset of scenario permissions is used as the base value. This base value is then multiplied by the following factors in sequence: the resource base weight value determined by the security classification label corresponding to the target resource identifier; the environment adjustment coefficient determined by the environment security level obtained from the terminal environment parameter assessment; the scenario weight coefficient corresponding to the current operation and maintenance scenario category; and an exponential decay term with a natural constant as the base and the product of the time decay coefficient and the time interval between the last time the operation and maintenance personnel executed the operation request in the current operation and maintenance scenario category and the current time. The resource base weight value reflects the scaling requirements of permissions based on resource sensitivity; the environment adjustment coefficient reflects the contraction or relaxation requirements of permissions based on the terminal environment security status; the scenario weight coefficient reflects the inherent differences in the operational risk levels of different operation and maintenance scenarios; and the exponential decay term reflects the time-sensitive characteristic of permission values ​​gradually shrinking as the inactivity time increases. The above formula realizes the four-fold joint correction of the permission values ​​of each permission item in the scene permission subset in terms of resource sensitivity dimension, terminal environment dimension, scene risk dimension and operation timeliness dimension. This enables the values ​​of each permission in the dynamically effective permission set to be dynamically adjusted in real time according to resource attributes, environmental conditions, scene type and operation timeliness, and achieves dynamic convergence of minimum permissions from the perspective of permission value quantification.

[0080] Among the above optional methods, the permission value is further modified by introducing a resource base weight value, an environment adjustment coefficient, a scenario weight coefficient, and a time decay coefficient, so that the permission value can be dynamically adjusted according to resource attributes, terminal environment, business scenario, and operation timeliness.

[0081] In an alternative approach, the dynamic intervention execution module is specifically used to: calculate the adaptive authentication complexity coefficient according to the following formula when the risk prediction value is between the first threshold and the second threshold:

[0082]

[0083] in, This represents the adaptive authentication complexity coefficient. This represents the predicted risk value. This represents the first threshold. This represents the second threshold. This represents the preset exponential growth coefficient. This indicates the preset maximum authentication complexity multiple. This represents a trust correction factor determined based on the terminal environment parameters. The trust correction factor has a value of 0.8 to 1.0 when the IP address in the terminal environment parameters belongs to a preset trusted address range, and a value of 1.2 to 1.5 when the terminal's geographical location coordinates in the terminal environment parameters deviate from a preset physical location range. When the risk prediction value is between the first threshold and the second threshold, the dynamic intervention execution module determines the number and type of verification factors required for this secondary identity authentication based on the adaptive authentication complexity coefficient. The larger the adaptive authentication complexity coefficient, the more verification factors are required and the higher the security level of the verification factors.

[0084] It should be noted that the formula for calculating the adaptive authentication complexity coefficient nonlinearly maps the normalized relative position of the risk prediction value with respect to the first and second thresholds as the independent variable into an exponential function with a preset exponential growth coefficient. This causes the adaptive authentication complexity coefficient to increase nonlinearly as the risk prediction value approaches the second threshold. Based on this, a trust correction factor determined by terminal environment parameters is introduced to scale the exponential mapping result. The trust correction factor takes a value less than 1 when the terminal environment is trustworthy to reduce authentication complexity, and a value greater than 1 when the terminal environment is untrustworthy to increase authentication complexity. The product of the above exponential mapping result and the trust correction factor is multiplied by an upper limit multiple and then 1 is added to make the minimum value of the adaptive authentication complexity coefficient 1 and the maximum value the preset maximum authentication complexity multiple. The above formula provides the dynamic intervention execution module with a basis for adjusting the authentication complexity according to the risk level when triggering secondary authentication. This allows the number and types of verification factors required for secondary authentication to increase dynamically as the risk of the operation request increases. At the same time, it differentiates the authentication requirements based on the trustworthiness of the terminal environment, avoiding the problem of fixed-complexity authentication methods excessively consuming the operational efficiency of maintenance personnel in low-risk scenarios and insufficient authentication strength in high-risk scenarios.

[0085] Among the above-mentioned optional methods, by further introducing an adaptive authentication complexity coefficient calculation formula, the complexity of secondary identity authentication can be dynamically adjusted according to the relative position of the risk prediction value between the first threshold and the second threshold, and show an accelerating upward trend. At the same time, a trust correction factor is introduced so that the authentication requirements can be scaled differently according to the trustworthiness of the terminal environment. This realizes the transformation of secondary identity authentication from fixed complexity to risk-adaptive complexity, avoiding the impact of excessive authentication on operation and maintenance efficiency in low-risk scenarios and the security risks of insufficient authentication strength in high-risk scenarios.

[0086] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A hierarchical access control system for information system operation and maintenance risks, characterized in that, include: The operation and maintenance resource management module is used to assign globally unique resource identifiers and security classification labels to the operation and maintenance resources involved in the integration and implementation services of the transportation information system; The operation and maintenance context acquisition module is used to obtain the identity of operation and maintenance personnel, their current job responsibilities, authorized operation records, and terminal environment parameters, and generate an operation and maintenance context vector. The operation scenario identification module is used to determine the operation scenario category to which the operation request belongs based on the target resource identifier, operation type and operation parameters extracted from the operation request initiated by the operation and maintenance personnel, combined with the current job responsibilities in the operation and maintenance context vector. The dynamic permission adjudication module is used to retrieve the corresponding baseline permission set based on the identity identifier and current job responsibilities in the operation and maintenance context vector, filter the scenario permission subset from the baseline permission set according to the operation and maintenance scenario category, evaluate the environment security level according to the terminal environment parameters, and modify the permissions of the scenario permission subset according to the security level label corresponding to the target resource identifier and the environment security level, thereby generating a dynamically effective permission set for the current operation session. The operation risk prediction module is used to obtain the execution frequency of the operation sequence corresponding to the operation request within a preset historical time window, the concurrency conflict index of the same type of operation on the same resource, and the behavioral deviation degree between the operation sequence and the authorized operation record after determining that the operation request belongs to the set of dynamically effective permissions, and to calculate the risk prediction value based on the execution frequency, the concurrency conflict index and the behavioral deviation degree. The dynamic intervention execution module is used to allow the operation request when the risk prediction value is less than a first threshold, trigger secondary authentication and allow the operation after successful authentication when the risk prediction value is between the first threshold and a second threshold, and intercept the operation request and generate an alarm when the risk prediction value is not less than the second threshold.

2. The hierarchical access control system for information system operation and maintenance risks according to claim 1, characterized in that, The operation and maintenance resources include traffic signal controllers, traffic flow detectors, variable message signs, and communication gateway equipment.

3. The hierarchical access control system for information system operation and maintenance risks, as described in claim 2, is characterized in that... The security classification labels correspond to individual markings for each operation and maintenance resource. The resource confidentiality level of the traffic signal controller and the communication gateway device is higher than that of the traffic flow detector and the variable message sign.

4. The hierarchical access control system for information system operation and maintenance risks according to claim 1, characterized in that, The terminal environment parameters include the IP address location, geographical coordinates, and fingerprint information of the terminal device used by the maintenance personnel when initiating the operation request.

5. The hierarchical access control system for information system operation and maintenance risks according to claim 1, characterized in that, The operation and maintenance scenarios include traffic signal timing parameter adjustment scenarios, traffic flow detector calibration scenarios, variable message sign content update scenarios, and communication gateway device configuration change scenarios.

6. The hierarchical access control system for information system operation and maintenance risks, as described in claim 5, is characterized in that... The dynamic set of permissions for the current operation session includes the target resource identifier corresponding to the operation request, the set of allowed operation types, and the parameter value range for each operation type in the operation type set. The parameter value range includes the signal cycle duration range and the green ratio range when the target resource identifier corresponds to the traffic signal controller, and includes the upper limit of the number of characters in the published content and the display duration range when the target resource identifier corresponds to the variable message sign.

7. The information system operation and maintenance risk management system with hierarchical access control as described in claim 1, characterized in that, The operational risk prediction module is specifically used for: The operation type and operation parameters corresponding to the operation request are compared with the operation type and operation parameters of each record in the authorized operation records. The number of records with inconsistent operation types and operation parameter differences exceeding a preset difference threshold is counted. The number of records is divided by the total number of authorized operation records, and the resulting ratio is used as the behavior deviation.

8. The hierarchical access control system for information system operation and maintenance risks, as described in claim 7, is characterized in that... The duration of the preset historical time window and the preset difference threshold are dynamically determined based on the security classification label corresponding to the target resource identifier. When the target resource identifier corresponds to the traffic signal controller or the communication gateway device, the duration of the preset historical time window is less than the duration of the preset historical time window when the target resource identifier corresponds to the traffic flow detector or the variable message sign. The preset difference threshold when the target resource identifier corresponds to the traffic signal controller or the communication gateway device is less than the preset difference threshold when the target resource identifier corresponds to the traffic flow detector or the variable message sign.

9. The information system operation and maintenance risk management system with hierarchical access control as described in claim 1, characterized in that, The formula for calculating the risk prediction value is as follows: in, This represents the predicted risk value. This indicates the execution frequency of the operation sequence within a preset historical time window. This represents the index of concurrency conflicts among similar operations on the same resources. This indicates the degree of behavioral deviation between the operation sequence and the authorized operation record. To normalize the execution frequency, To normalize the concurrent conflict index, This indicates the maximum allowed execution frequency of the same type of operation within a preset historical time window. This represents the preset maximum concurrent conflict index. This represents the cross-influence term between the execution frequency and the deviation of the behavior. This represents the cross-influence term between the concurrent conflict index and the behavioral deviation. , , , , These are the preset weight coefficients for the normalized execution frequency term, the normalized concurrency conflict index term, the behavior deviation term, the first cross term, and the second cross term, respectively. .

10. The hierarchical access control system for information system operation and maintenance risks according to claim 5, characterized in that, The dynamically effective permission set includes permission values ​​corresponding to each permission item. The dynamic permission adjudication module is specifically used to calculate the corrected permission values ​​according to the following formula, where the corrected permission values ​​are the permission values ​​corresponding to each permission item in the dynamically effective permission set: in, Indicates maintenance personnel In the category of operation and maintenance scenarios Download the revised permission values. This indicates the operation and maintenance personnel in the scenario permission subset. In the category of operation and maintenance scenarios The original permission values ​​below, This represents the basic weight value of the resource determined by the security classification label corresponding to the target resource identifier. This represents the environmental adjustment coefficient determined by the environmental safety level obtained from the assessment of the terminal environmental parameters. Indicates the category of the operation and maintenance scenario. The corresponding scene weight coefficients, Indicates the time decay coefficient. Indicates maintenance personnel In the category of operation and maintenance scenarios The time interval between the last time the operation request was executed and the current time.

Images