A method and device for pre-emptive security risk prediction for multi-tenant data access

Abstract

The embodiment of the application discloses a kind of pre-security risk prediction methods and equipment for multi-tenant data access, it is related to data access control technical field, solve the problem that sensitive data is easily acquired and diffused under the risk situation of environmental anomaly. Including, in response to the data access request of target tenant, determine current access point;Based on context information, determine the tenant-level dynamic barrier region in the direction of the security access reference domain of current access point, and based on tenant-level dynamic barrier region, the candidate access path of target tenant is constructed in access space;Determine the upstream source data set of target data object and determine the sensitivity weight corresponding to the set, and determine the length of data traceability path;Based on the length of data traceability path and sensitivity weight, determine the data leakage diffusion radius corresponding to target tenant;If the path length of candidate access path is greater than data leakage diffusion radius, then generate blocking instruction before access request is executed.

Description

Technical Field

[0001] This application relates to the field of data access control technology, and in particular to a method and device for predicting security risks in advance for multi-tenant data access. Background Technology

[0002] Multi-tenant data access refers to an access model where multiple tenants share the same data infrastructure, but their data is logically isolated from each other. In scenarios such as enterprise cloud platforms, different tenants have their own independent data assets and access policies, but the underlying data storage, computing resources, and network channels are often shared.

[0003] In this architecture, mainstream data access control schemes employ a "permission granted" strategy. After user authentication, the system queries a pre-configured access control list or role-based permission matrix. If the user has access to the target data object, the access request is granted directly. This means that even if the user's terminal device is infected with malware, has known vulnerabilities, or is in an untrusted network environment, as long as the user has been authenticated and granted the corresponding permissions, the system will still allow their access request. Once the user gains access, they can freely obtain data within their authorized scope, leading to the acquisition and dissemination of sensitive data under risky circumstances. Summary of the Invention

[0004] This application provides a method and device for predicting security risks in advance for multi-tenant data access, which is used to solve the following technical problem: users with risks can access data after their identity is authenticated, which may lead to the acquisition and dissemination of sensitive data under risky circumstances in abnormal environments.

[0005] The embodiments of this application adopt the following technical solutions: This application provides a method for pre-emptive security risk prediction for multi-tenant data access. It includes: constructing access context baselines for each tenant based on their historical access logs; mapping these access context baselines to an access behavior space to obtain a security access benchmark domain for each tenant; wherein the access context baseline is a normal access reference benchmark obtained based on the tenant's historical access context statistics, and the access behavior space is a feature space characterizing the tenant's access behavior; responding to a target tenant's data access request, mapping the context information of the current access to the current access point in the access behavior space; wherein the context information includes at least the target data object corresponding to the current access request; and determining the directional obstacle degree from the current access point toward the security access benchmark domain based on the context information and the access context baseline. The system determines tenant-level dynamic obstacle regions based on obstacle degree. Within the access behavior space, starting from the current access point and targeting the secure access baseline domain, it uses these tenant-level dynamic obstacle regions as path constraints to prevent entry, constructing candidate access paths for the target tenant. Based on a pre-defined data topology, it determines the upstream source data set of the target data object, calculates the sensitivity weight corresponding to the upstream source data set, and determines the length of the data tracing path based on the upstream source data set. Based on the length of the data tracing path and the sensitivity weight, it determines the data leakage diffusion radius corresponding to the target tenant. If a candidate access path for the target tenant is constructed, and the path length of the candidate access path is greater than the data leakage diffusion radius, it performs blocking processing on the data access request.

[0006] In one implementation of this application, based on the historical access logs corresponding to each multi-tenant, an access context baseline corresponding to each tenant is constructed, and the access context baseline is mapped to the access behavior space to obtain the security access baseline domain corresponding to each tenant. Specifically, this includes: for the target tenant in the multi-tenant group, obtaining the historical access logs corresponding to the target tenant, and extracting access behavior feature tuples based on the historical access logs; wherein, the access behavior feature tuples include at least the access subject attributes, terminal device information, business scenario, operation type, and the position encoding of the target data object in the preset data topology; and reversing the derivation relationship of the data object. The process involves tracing the location encoding and converting it into a feature signature of the source data object, resulting in extended behavior feature tuples. Using the access subject attribute in the access behavior feature tuples as the aggregation dimension, the extended behavior feature tuples are clustered. The hop count corresponding to the tracing depth of each extended behavior feature tuple in the topological link direction is used as the hop count tolerance constraint for inter-cluster merging, generating multiple behavior clusters. The distribution area of ​​all extended behavior feature tuples in each behavior cluster within the access behavior space is determined as the connected envelope subdomain corresponding to that behavior cluster. The union of the connected envelope subdomains corresponding to all behavior clusters of the target tenant is used as the secure access baseline domain for the target tenant.

[0007] In one implementation of this application, the tenant-level dynamic obstacle region in the direction of the current access point toward the security access reference domain is determined based on context information and the access context baseline. Specifically, this includes: determining the security posture data of the current terminal device and the current business scenario based on context information, and concatenating the security posture data and the current business scenario into a joint environment state vector for the current access; comparing the joint environment state vector with the reference joint environment state vector in the access context baseline to determine the joint environment offset; determining the directional obstacle degree in the direction of the current access point toward the security access reference domain in the access behavior space based on the joint environment offset; and marking the region with a directional obstacle degree greater than a preset obstacle threshold as the tenant-level dynamic obstacle region.

[0008] In one implementation of this application, the directional obstacle degree of the current access point toward the secure access reference domain is determined in the access behavior space based on the joint environment offset. Specifically, this includes: acquiring the geometric contour information of each connected envelope subdomain in the secure access reference domain within the access behavior space; emitting multiple probe rays from the current access point toward the secure access reference domain; wherein each probe ray corresponds to a different candidate direction; for each probe ray, determining the number and type of connected envelope subdomains it traverses from the current access point to the boundary of the secure access reference domain; determining the basic passage cost of the candidate direction corresponding to the probe ray based on the number; determining the environment correction cost of the candidate direction corresponding to the probe ray based on the type and the joint environment offset; and determining the directional obstacle degree of the candidate direction based on the basic passage cost and the environment correction cost, which serves as the directional obstacle degree of the current access point toward the secure access reference domain.

[0009] In one implementation of this application, starting from the current access point and targeting the secure access reference domain, a tenant-level dynamic obstacle region is used as a path constraint to prevent falling into the obstacle. This process constructs candidate access paths for the target tenant, specifically including: determining an initial direction vector in the access behavior space, starting from the current access point and targeting the secure access reference domain; generating multiple candidate direction branches in the access behavior space based on the initial direction vector; wherein each candidate direction branch consists of continuous step lengths, each step length corresponding to a position point in the access behavior space; and starting from the current access point, proceeding along each candidate direction... The branches advance step by step; during each step: if the current step location falls within the tenant-level dynamic obstacle area, the advancement of the candidate direction branch is terminated; if the current step location does not fall within the tenant-level dynamic obstacle area, the projection value of the joint environment offset at the current location on the current advancement direction is obtained, and the advancement cost of the current step is determined based on the projection value; when each candidate direction branch meets the preset stopping condition, the advancement of the branch is stopped; among all the candidate direction branches that have stopped advancing, the branch with the smallest sum of advancement costs for each step is determined as the candidate access path for the target tenant.

[0010] In one implementation of this application, obtaining the projection value of the joint environment offset at the current location point in the current propulsion direction, and using the projection value as the propulsion cost of the current step size, specifically includes: in the access behavior space, obtaining the first coordinate vector corresponding to the current step size location point, and determining the second coordinate vector corresponding to the next location point; determining the first connected envelope subdomain to which the first coordinate vector belongs, and determining the second connected envelope subdomain to which the second coordinate vector belongs; determining the boundary distance between the two subdomains of the first and second connected envelope subdomains, and determining the cross-domain scaling factor of the current step size based on the boundary distance; and determining the current step size location for the coordinate axes of the access behavior space. The joint environment offset at the location point; based on the difference in joint environment offsets at the location point and its neighborhood, the rate of change of the joint environment offset along the access behavior space coordinate axis is determined, and the rate of change corresponding to each access behavior space coordinate axis is combined to form the joint environment offset gradient vector at the location point; based on the joint environment offset gradient vector and the cross-domain scaling factor, the scaled joint environment offset gradient vector is obtained; the cosine value of the angle between the current step's propulsion direction vector and the scaled joint environment offset gradient vector is determined as the directional consistency coefficient; the propulsion cost of the current step is obtained through the projection value, the directional consistency coefficient, and the preset reward coefficient corresponding to the directional consistency coefficient.

[0011] In one implementation of this application, based on a preset data topology, the upstream source data set of the target data object is determined, and the sensitivity weight corresponding to the upstream source data set is calculated. Specifically, this includes: based on the preset data topology, extracting the data tracing path between the upstream source data object and the current target data object, and constructing a tracing subtree corresponding to the upstream source data object through the data tracing path; wherein the root of the tracing subtree is the current target data object, the leaves are upstream source data objects, and the intermediate nodes are data objects shared by the data tracing path; using the number of leaves of the tracing subtree as a first structural quantity, and using the maximum number of times each intermediate node in the tracing subtree is shared by different data tracing paths as a second structural quantity; obtaining the sensitivity weight corresponding to the upstream source data object based on the first structural quantity and the second structural quantity; and determining the sensitivity weight corresponding to the upstream source data set based on the sensitivity weights of all upstream source data objects in the upstream source data set.

[0012] In one implementation of this application, determining the length of the data tracing path based on the upstream source data set specifically includes: determining the data tracing path from each upstream source data object in the upstream source data set to the target data object based on a preset data topology; for each data tracing path, backtracking node by node from the starting point of the path towards the target data object; at each backtracking node, obtaining the sensitivity weight of the data object corresponding to the backtracking node, the remaining tracing depth from the backtracking node to the target data object, and the out-degree of the backtracking node in the preset data topology; wherein, the out-degree represents the number of data tracing edges originating from the backtracking node; determining the node cost corresponding to the backtracking node based on the sensitivity weight, the remaining tracing depth, and the out-degree; and determining the length of the data tracing path based on the node costs of all backtracking nodes on the data tracing path.

[0013] In one implementation of this application, the data leakage diffusion radius corresponding to the target tenant is determined based on the length of the data tracing path and the sensitivity weight. Specifically, this includes: multiplying the length of the data tracing path and the sensitivity weight to obtain the initial diffusion radius; starting from the target data object, expanding step by step along the forward edge in the preset data topology to determine the data objects accessed during the expansion process and constructing a set of downstream reachable data objects; for each downstream data object in the set of downstream reachable data objects, determining its corresponding upstream source data set, and obtaining the secondary diffusion radius of the downstream data object based on the product of the length of the data tracing path and the sensitivity weight corresponding to the upstream source data set; and adding the initial diffusion radius to the maximum value among the secondary diffusion radii of all downstream data objects to obtain the data leakage diffusion radius corresponding to the target tenant.

[0014] This application provides a device for pre-emptive security risk prediction for multi-tenant data access, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to: construct an access context baseline for each tenant based on historical access logs corresponding to each of the multi-tenants, and map the access context baseline to an access behavior space to obtain a security access baseline domain for each tenant; wherein the access context baseline is a normal access reference baseline obtained based on the statistical analysis of the tenant's historical access context, and the access behavior space is a feature space characterizing the access behavior features of the tenant; and in response to a data access request from a target tenant, map the context information of the current access to the current access point in the access behavior space; wherein the context information includes at least the current access request. The corresponding target data object; based on context information and the access context baseline, the directional obstacle degree from the current access point to the secure access baseline domain is determined. Based on the directional obstacle degree, the tenant-level dynamic obstacle region is determined. In the access behavior space, with the current access point as the starting point and the secure access baseline domain as the target region, the tenant-level dynamic obstacle region is used as a path constraint condition to prevent entry, and a candidate access path for the target tenant is constructed. Based on the preset data topology, the upstream source data set of the target data object is determined, the sensitivity weight corresponding to the upstream source data set is calculated, and the length of the data tracing path is determined based on the upstream source data set. Based on the length of the data tracing path and the sensitivity weight, the data leakage diffusion radius corresponding to the target tenant is determined. If a candidate access path for the target tenant is constructed, and the path length of the candidate access path is greater than the data leakage diffusion radius, the data access request is blocked.

[0015] The above-mentioned technical solutions adopted in this application embodiment can achieve the following beneficial effects: Firstly, by constructing access context baselines for each tenant and mapping them to a secure access baseline domain, this application embodiment establishes appropriate normal behavior boundaries for each tenant, avoiding cross-tenant interference. Secondly, by determining tenant-level dynamic obstacle areas, risk barriers between the current access point and the security baseline can be identified, solving the problem that traditional solutions cannot perceive terminal vulnerabilities and scenario mismatches. Furthermore, by constructing candidate access paths in the access behavior space where dynamic obstacle areas exist, risk assessment is transformed into a path planning problem, making the path length intuitively reflect the cost required for an access request to overcome risk barriers. Finally, by determining the sensitivity weight of the upstream source data set and the length of the data tracing path, this application embodiment quantifies the sensitivity and diffusion potential of the target data object, solving the problem that traditional solutions struggle to predict the chain reaction risk that may occur after an access request passes. Moreover, by comparing the path length with the data leakage diffusion radius, a blocking instruction is generated before the access request is executed, achieving pre-emptive blocking of high-risk access and preventing the possibility of data being acquired and leaked even when permissions are compliant but security risks exist. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings: Figure 1 A flowchart illustrating a method for predicting pre-emptive security risks for multi-tenant data access, as provided in this application embodiment; Figure 2 A flowchart illustrating a directional obstacle determination process provided in this application embodiment; Figure 3 This is a schematic diagram of a pre-emptive security risk prediction device for multi-tenant data access, provided as an embodiment of this application.

[0017] Figure label: 300: Pre-emptive security risk prediction device for multi-tenant data access; 301: Processor; 302: Memory. Detailed Implementation

[0018] This application provides a method and device for predicting security risks in advance for multi-tenant data access.

[0019] To enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this application.

[0020] Figure 1 A flowchart illustrating a method for predicting pre-emptive security risks for multi-tenant data access, as provided in this application embodiment, is shown below. Figure 1 As shown, the pre-emptive security risk prediction method for multi-tenant data access includes the following steps: Step 101: Based on the historical access logs corresponding to each tenant, construct the access context baseline corresponding to each tenant, and map the access context baseline to the access behavior space to obtain the security access baseline domain corresponding to each tenant.

[0021] In one implementation of this application, for the target tenant, behavioral feature tuples are extracted from historical access logs, traced back along the derivation relationship of data objects, the location code is converted into the feature signature of the source data object on which it depends, and an extended behavioral feature tuple is obtained. Then, clustering is performed based on the access subject attributes, and the hop count corresponding to the tracing depth is used as the hop count tolerance constraint for inter-cluster merging. Finally, the distribution area of ​​each behavioral cluster in the access behavior space is determined as a connected envelope subdomain, and its union is taken as the secure access reference domain.

[0022] Specifically, in the audit log system of the multi-tenant data platform, all data access records of the target tenant over the past ninety days are retrieved. Each record includes the attributes of the accessing entity, user identifier, terminal device model used, business scenario tag at the time of access, type of operation performed, and the location code of the requested target data object in the pre-defined data topology. These fields are assembled into access behavior feature tuples. It should be noted that the accessing entity attributes in this embodiment are used to characterize the role category or trust level of the entity initiating the data access request, including but not limited to: tenant administrator, ordinary business personnel, third-party application, data operation and maintenance personnel, etc. The location code in this embodiment is used to uniquely identify the node position of the target data object in the pre-defined data topology. The pre-defined data topology is a directed acyclic graph representing the derivation relationship between data objects, where each node corresponds to a data object, and directed edges represent the derivation relationship between data objects. The location code includes but is not limited to one or a combination of the following forms: Node number, which is a unique identifier assigned to each data object in the preset data topology, such as D-1024; Hierarchical path, which is the sequence of nodes traversed from the topological root node to the target data object; A hash signature is a string obtained by hashing the identification information of a target data object, such as a SHA256 hash value.

[0023] Load a pre-defined data topology, which is a directed acyclic graph where nodes are data objects and directed edges point from upstream source data objects to downstream derived data objects. For each target data object node number in the access behavior feature tuple, traverse backwards along all incoming edges from that node, collecting all upstream nodes along the way. Concatenate the identifiers of these upstream nodes and input them into a SHA256 hash function to obtain a 256-bit feature signature. Append this feature signature to the end of the original access behavior feature tuple to form an extended behavior feature tuple.

[0024] The user identifier field is extracted from each extended behavioral feature tuple and used as the clustering key. Extended behavioral feature tuples with the same user identifier are grouped into the same temporary group. Within each temporary group, the tuples are sorted in ascending order using the source depth field as the sorting key. The sorted sequence is traversed, and the source depth difference between two adjacent tuples is calculated. If the difference is less than or equal to a preset hop count tolerance threshold of 2, the two tuples are merged into the same behavioral cluster. If the difference is greater than 2, the latter tuple is assigned to a new behavioral cluster. Here, the hop count tolerance threshold of 2 means that behavioral records separated by a maximum of two source levels are allowed to be classified into the same behavioral pattern.

[0025] Extract all extended behavioral feature tuples from the behavioral cluster. For each extended behavioral feature tuple, use the four numerical fields (terminal device information, business scenario, operation type, and tracing depth) as coordinates to determine a coordinate point in the four-dimensional access behavior space. Perform the Quickhull convex hull algorithm on all coordinate points corresponding to this behavioral cluster to obtain the minimum convex polyhedron enclosing these points. Denote the four-dimensional space region occupied by this minimum convex polyhedron as the connected envelope subdomain of this behavioral cluster. Repeat this step until the connected envelope subdomains of all behavioral clusters have been calculated.

[0026] An empty four-dimensional space region is created as the initial result set. All connected envelope subdomains are then traversed, and each subdomain is merged into the result set. Since the connected envelope subdomains may overlap in four-dimensional space, a Boolean union operation is used during merging, and overlapping areas are counted only once. The resulting four-dimensional space region after merging is the security access baseline region for the target tenant.

[0027] Step 102: In response to the target tenant's data access request, map the context information of this access to the current access point in the access behavior space.

[0028] In one implementation of this application, a data access request is received from the access gateway of the multi-tenant data platform. This request includes access subject attributes, tenant identifier, user identifier initiating the access, hardware fingerprint of the terminal device used, business scenario tag at the time of access, type of operation to be performed, and node number of the requested target data object. The remaining five fields, excluding the tenant identifier, are extracted and used as context information for this access.

[0029] Load the pre-built access behavior space coordinate system definition. Extract the terminal device hardware fingerprint field from the extracted context information and input it into a pre-trained device type encoder, outputting an integer value as the terminal device type coordinate value. Extract the business scenario label field and input it into a pre-trained scenario encoder, outputting an integer value as the business scenario category coordinate value. Extract the operation type field and input it into a pre-trained operation encoder, outputting an integer value as the operation type coordinate value. Extract the node number of the target data object and traverse all its upstream source data objects along the reverse edges of the pre-defined data topology, recording the maximum number of edges traversed during the traversal as the tracing depth coordinate value. Combine these four coordinate values ​​into a four-dimensional coordinate vector.

[0030] In one implementation of this application, the training process for each encoder is as follows: Collect joint occurrence samples of three fields—terminal device hardware fingerprint, business scenario label, and operation type—and their corresponding access behavior feature tuples from the target tenant's historical access logs. Using the original values ​​of each field as input and the discrete numbers of the connected envelope subdomains to which the field belongs after clustering in the access behavior space as supervision labels, train three independent classifiers using a three-layer fully connected neural network. During training, backpropagation using the cross-entropy loss function updates the weights until the classification accuracy on the validation set stabilizes above a preset threshold. After training, freeze the network parameters to obtain a pre-trained device type encoder, scenario encoder, and operation encoder that can map the original fields to integer values ​​on the corresponding coordinate axes of the access behavior space.

[0031] Create a temporary marker in the access behavior space and place it at the position indicated by the four-dimensional coordinate vector. This temporary marker is the current access point, representing the position of this data access request in the access behavior space.

[0032] Step 103: Based on context information and access context baseline, determine the directional obstacle degree of the current access point toward the security access baseline domain, determine the tenant-level dynamic obstacle region based on the directional obstacle degree, and construct the candidate access path for the target tenant in the access behavior space with the current access point as the starting point and the security access baseline domain as the target region, using the tenant-level dynamic obstacle region as the path constraint condition to prohibit falling into the path.

[0033] In one implementation of this application, the joint environment offset is obtained by comparing the joint environment state vector of the current access with the baseline reference vector. Based on this, the directional obstacle degree of the current access point toward each direction of the security reference domain is evaluated, and the area with obstacle degree exceeding the threshold is marked as a dynamic obstacle area, thereby realizing the quantitative identification of terminal risk and scene mismatch.

[0034] Specifically, the hardware fingerprint field of the terminal device is extracted from the received data access request. This hardware fingerprint is sent to the terminal security management platform to query the current security score of the device. This security score is an integer ranging from 0 to 100; a lower score indicates a higher security risk, such as unpatched vulnerabilities, malware infection, or being in an untrusted network environment. The returned security score is used as the current security posture data of the terminal device. Additionally, a business scenario tag field is extracted from the received data access request. This tag is attached by the upper-layer business system when initiating the access request, such as for daily inspections, month-end settlements, or emergency maintenance. This tag is directly used as the value for the current business scenario.

[0035] Create a one-dimensional floating-point array of length 2. Fill the first element of this array with the acquired security posture data. Input the determined current business scenario label into the scenario encoder, output an integer value, and fill the second element of the array with this integer value. This array is the federated environment state vector for the current access. Read the pre-stored reference federated environment state vector from the access context baseline associated with the constructed security access baseline domain. This reference vector is a standard vector obtained by statistically averaging the security posture data and business scenario fields in all historical access logs of the target tenant during the baseline construction phase. It represents the typical environment state of the tenant under normal conditions.

[0036] The obtained joint environment state vector is subtracted element-wise from the loaded reference joint environment state vector to obtain a difference vector. The L2 norm of this difference vector is calculated by taking the square root of the sum of the squares of each element in the difference vector, resulting in a non-negative real number. This non-negative real number is used as the joint environment offset to quantify the degree of deviation between the current access environment and the historical normal environment.

[0037] By emitting a probe ray from the current access point to the security reference domain, the number and type of connected envelope subdomains traversed by the ray are counted, and the directional obstacle degree in each direction is calculated in combination with the joint environment offset.

[0038] The algorithm iterates through all calculated directional obstacle degrees of candidate directions and filters out those with directional obstacle degrees greater than a preset obstacle threshold. Within the access behavior space, these filtered candidate directions are extended outward from the current access point to the entire area covered by the boundary of the secure access baseline domain, and marked as the tenant-level dynamic obstacle region. This region represents the range of directions from which safe passage is impossible from the current access point under the current terminal security posture and business scenario.

[0039] In one implementation of this application, the preset barrier threshold is determined as follows: Normal access samples from the target tenant's historical access logs, confirmed by security operations to be risk-free, are selected. The directional barrier degree set corresponding to the optimal candidate direction for each sample is obtained according to the aforementioned directional barrier degree calculation method. The 95th percentile of this set is taken and rounded to an integer, serving as the preset barrier threshold for the target tenant. When the target tenant's access context baseline is updated, the preset barrier threshold is re-determined in the same manner.

[0040] In one implementation of this application, Figure 2 A flowchart of a directional obstacle determination process is provided for an embodiment of this application, as follows: Figure 2 As shown, the process of determining the directional obstacle degree includes the following steps 201-208: Step 201: Load the geometric contour information of the connected envelope subdomain.

[0041] In the stored in-memory database, the geometric description data of all connected envelope subdomains contained within the target tenant's secure access baseline domain is read. The geometric description data of each connected envelope subdomain is a list of vertex coordinates in four-dimensional space; these vertices constitute the boundary of the subdomain's convex polyhedron. The vertex coordinate list of each subdomain is loaded into computational memory, and a spatial index structure is created for it to quickly determine whether a coordinate point is located inside the subdomain and to calculate the intersection of a ray and the subdomain boundary.

[0042] Step 202: Launch a probe ray starting from the current access point.

[0043] In the four-dimensional access behavior space, starting from the determined four-dimensional coordinate vector of the current access point, and with the geometric center of the secure access reference domain as the target direction, 360 probe rays are uniformly generated at 1-degree intervals within the solid angle range centered on this central direction. The direction of each probe ray is represented by a unit direction vector, and these 360 ​​unit direction vectors are sequentially stored in a queue for processing.

[0044] Step 203: Calculate the connected envelope subdomain information through which a single probe ray passes.

[0045] The first probe ray to be processed is retrieved from the queue. Starting from the current access point, it extends stepwise along the ray's direction vector, with each extension step set to one unit length in the access behavior space. At each extension step, the current coordinate point is obtained, and all loaded connected envelope subdomains are traversed to determine if the coordinate point is located inside the convex polyhedron of a subdomain. If it is inside a subdomain, the subdomain's number and type label are recorded, and the ray continues to extend along its direction. If it leaves the current subdomain, the extension continues, and a check is performed to see if it enters the next subdomain. This process is repeated until the extension point reaches the boundary of the secure access reference domain. The total number of connected envelope subdomains traversed by the ray during the entire extension process, as well as the type label of each traversed subdomain, are counted. The statistical results are stored in association with the ray's direction number.

[0046] Step 204: Calculate the basic passage cost.

[0047] This value is directly used as the base travel cost for the candidate direction corresponding to that ray. The larger the base travel cost, the more historical normal behavior areas that the direction needs to traverse to reach the safe reference domain, and the greater the travel resistance.

[0048] Step 205: Calculate the cost of environmental correction.

[0049] From the statistical results, extract the type label of each connected envelope subdomain traversed by the probe ray. Each type label corresponds to a preset environment correction coefficient, which reflects the sensitivity of that subdomain to the joint environment offset. Multiply the calculated joint environment offset by the environment correction coefficient of each traversed subdomain to obtain the correction value for each subdomain. Summate the correction values ​​of all subdomains to obtain the environment correction cost for the candidate direction corresponding to the probe ray.

[0050] Step 206: Calculate the directional obstacle degree.

[0051] The obtained basic passage cost is added to the obtained environmental correction cost to obtain the directional obstacle degree for the candidate direction. This directional obstacle degree is then associated with the direction number of the ray and stored in the result array.

[0052] Step 207: Determine whether all detection rays have been processed.

[0053] Check if there are any unprocessed probe rays in the queue. If so, proceed to process the next ray. Step 208: Mark the dynamic obstacle area.

[0054] The system iterates through the obstacle degrees of all 360 candidate directions stored in the result array, filtering out those with obstacle degrees greater than a preset obstacle threshold. In the access behavior space, starting from the current access point, each of these filtered candidate directions extends to the boundary of the safe access baseline domain. The union of the four-dimensional spatial regions covered by all these extended paths is marked as the tenant-level dynamic obstacle region. The geometric description data of this dynamic obstacle region is stored in an in-memory database for use in subsequent path planning steps.

[0055] In one implementation of this application, multiple candidate directional branches are generated starting from the current access point and the process is gradually advanced. If a dynamic obstacle is encountered, the process terminates; otherwise, it continues to advance at the cost of joint environment offset projection value. Finally, the branch with the minimum total cost is selected as the candidate access path.

[0056] Specifically, starting from the determined current access point and ending at the geometric center of the constructed secure access baseline domain, a direction vector from the starting point to the ending point is calculated, and this direction vector is used as the initial direction vector.

[0057] In one implementation of this application, a candidate direction branch is generated in the access behavior space within a 30-degree cone angle range on both sides of the determined initial direction vector as the central axis, at 5-degree intervals. Each candidate direction branch consists of a series of continuous step lengths, with each step length corresponding to a position point in the access behavior space. For example, using the initial direction vector as a 0-degree reference, 13 candidate direction branches are generated by taking -30°, -25°, -20°, -15°, -10°, -5°, 0°, +5°, +10°, +15°, +20°, +25°, and +30° respectively. The total number of steps for each branch is preset to 100 steps, and each step length is set to one unit length in the access behavior space.

[0058] Create a progress status record for each candidate direction branch, containing the current step index, current position coordinates, accumulated progress cost, and termination flag. Initialize the current step index to 0, the current position coordinates to the coordinates of the currently visited point, the accumulated progress cost to 0, and the termination flag to false for all branches. Iterate through all candidate direction branches with a false termination flag. For each branch, read its current step index and current position coordinates. Extend the direction vector of that branch forward by one step and calculate the coordinates of the next position point. Increment the current step index by 1.

[0059] The calculated coordinates of the next location point are compared with the stored geometric description data of the tenant-level dynamic obstacle region. It is determined whether the location point is located within the four-dimensional space of the dynamic obstacle region. If yes, the termination flag of the branch is set to true; otherwise, the joint environment offset is obtained, the projection value of the joint environment offset on the current propulsion direction is calculated, and the projection value is used as the propulsion cost for the current step size.

[0060] Write the calculated coordinates of the next position point into the current position coordinates field of this branch, overwriting the original position coordinates. Check the current state of all candidate direction branches. If the termination flag of all branches is true, stop progressing. If there are branches with a false termination flag, and the current step index of these branches has reached the preset maximum step number of 100, stop progressing. If neither of the above two conditions is met, continue progressing.

[0061] Iterate through all 13 candidate directional branches and read the accumulated advancement cost for each branch. Select the branch with the minimum accumulated advancement cost, and use the sequence of coordinates of all points along the path from the current access point to its final stopping point as the candidate access path for the target tenant. Record the path length of this candidate access path as the sum of the Euclidean distances between adjacent points in the sequence.

[0062] In one implementation of this application, the projection value of the joint environment offset at the current location point onto the current propulsion direction is obtained, and the projection value is used as the propulsion cost of the current step size. Specifically, this includes: determining the similarity or difference between the current step size and the next step size to the connected envelope subdomains, using the boundary distance between subdomains as the cross-domain scaling factor, and combining it with the gradient vector of the joint environment offset at the current location to obtain the scaled gradient vector; calculating the cosine of the angle between the propulsion direction and the scaled gradient vector as the direction consistency coefficient; and finally determining the propulsion cost by combining the joint projection value and the reward coefficient, thereby integrating the dual influence of cross-domain behavior and risk gradient direction in path planning.

[0063] More specifically, during the advancement process, the four-dimensional coordinate vector of the current step position is read and denoted as the first coordinate vector. At the same time, the calculated four-dimensional coordinate vector of the next position is read and denoted as the second coordinate vector.

[0064] The obtained first coordinate vector is compared sub-domain by sub-domain with the convex polyhedral boundaries of all loaded connected envelope subdomains to determine whether the coordinate point is located inside a certain subdomain. If it is located inside a certain subdomain, the subdomain number is recorded as the first connected envelope subdomain. The same sub-domain comparison operation is performed on the second coordinate vector, and the subdomain number to which it belongs is recorded as the second connected envelope subdomain.

[0065] The determined first connected envelope subdomain number is compared with the second connected envelope subdomain number. If they are the same, the cross-domain scaling factor for the current step size is set to 1. If they are different, the distance between the boundaries of the first and second connected envelope subdomains in the access behavior space is read from the loaded geometric contour information, and this distance value is used as the cross-domain scaling factor for the current step size. A larger cross-domain scaling factor indicates that the two subdomains are spatially farther apart, and the cost of crossing them is higher.

[0066] Centered on the first obtained coordinate vector, offset by a small amount ε along the positive and negative directions of each coordinate axis in the access behavior space, resulting in 2N sampling points, where N is the total number of coordinate axes in the access behavior space, and the coordinate axes correspond to terminal device type, business scenario category, operation type, and tracing depth, respectively. For each sampling point, the terminal security situation value is extracted from the terminal security situation data in the context information, and the business scenario value is extracted from the business scenario data in the context information. These are concatenated into a joint environment state vector, and the L2 norm distance between this vector and the loaded reference joint environment state vector is calculated. This distance is used as the joint environment offset at the sampling point. The difference between the joint environment offsets of the positive and negative direction sampling points is calculated and divided by twice ε to obtain the offset change rate in that coordinate axis direction. The offset change rates in the N coordinate axis directions are combined into an N-dimensional vector as the joint environment offset gradient vector at the current position.

[0067] The obtained joint environment offset gradient vector is multiplied by the obtained cross-domain scaling factor; that is, each component of the gradient vector is multiplied by the cross-domain scaling factor. The new N-dimensional vector obtained after the multiplication operation is the scaled joint environment offset gradient vector. The larger the cross-domain scaling factor, the longer the scaled gradient vector, indicating that the cross-domain behavior amplifies the sensitivity of the risk gradient.

[0068] Obtain the propulsion direction vector for the current step size. Specifically, starting from the current step size position (first coordinate vector) and ending at the next position point corresponding to the current step size on the candidate direction branch (second coordinate vector), subtract the first coordinate vector from the second coordinate vector to obtain the displacement vector for that step size. Normalize this displacement vector to obtain a unit vector of length 1; this unit vector is the propulsion direction vector for the current step size. Calculate the dot product of the propulsion direction vector and the scaled joint environment offset gradient vector, and divide by the product of the magnitudes of the two vectors to obtain the cosine of the angle between the directions, which serves as the direction consistency coefficient. The direction consistency coefficient ranges from -1 to +1; a positive value indicates that the propulsion direction and the scaled gradient direction are approximately the same, while a negative value indicates that the propulsion direction and the scaled gradient direction are approximately opposite.

[0069] Obtain the projection value of the joint environment offset onto the current propulsion direction. Multiply the projection value by the absolute value of the directional consistency coefficient to obtain an intermediate value. Determine the sign of the directional consistency coefficient. If the directional consistency coefficient is negative, multiply the intermediate value by a preset reward coefficient of 0.5 to obtain the propulsion cost for the current step. If the directional consistency coefficient is non-negative, use the intermediate value directly as the propulsion cost for the current step. Add the calculated propulsion cost to the accumulated propulsion cost of this branch.

[0070] The process for determining the preset reward coefficient is as follows: From the target tenant's historical access logs, select a set of samples marked as normal access and confirmed as risk-free by security operations. For each normal sample, calculate its advancement cost in the reverse risk gradient direction. Statistically analyze the advancement cost distribution of all normal samples in the reverse risk gradient direction, and take the median of this distribution as the baseline cost. Compare the baseline cost with the advancement cost in the forward risk gradient direction under the same conditions, and calculate the proportional relationship between the two. Multiple experiments have verified that when the reward coefficient is 0.5, the advancement cost in the reverse risk gradient direction is approximately half that in the forward risk gradient direction. This encourages normal users to advance along the risk-reducing direction while avoiding excessive rewards that could cause the path to deviate from the security baseline domain. This 0.5 is then fixed as the preset reward coefficient in the system. In actual deployment, the preset reward coefficient can also be used as a configurable parameter, adjusted by security operations personnel according to the actual access behavior characteristics of tenants, with an adjustment range between 0.3 and 0.7.

[0071] Step 104: Based on the preset data topology, determine the upstream source data set of the target data object, calculate the sensitivity weight corresponding to the upstream source data set, and determine the length of the data tracing path based on the upstream source data set.

[0072] In one implementation of this application, the data tracing path from each upstream source data object to the current target data object is extracted and a tracing subtree is constructed. The sensitivity weight of each upstream source data object is determined by amplifying the maximum number of times the intermediate node is shared by different paths using the number of leaves in the subtree as the base, and finally summed to obtain the sensitivity weight of the upstream source data set, thereby quantifying the sensitivity of the data in the tracing structure.

[0073] Specifically, the node number of the current target data object is extracted from the received data access request. Starting from this node number, a reverse breadth-first traversal is performed along all incoming edges in the pre-defined data topology, collecting all upstream nodes encountered during the traversal. All collected upstream nodes are treated as an upstream source data set, with each element in this set corresponding to an upstream source data object. An unprocessed upstream source data object is retrieved from this set. Starting from this upstream source data object and ending with the current target data object, a depth-first search is performed along the outgoing edges in the pre-defined data topology to find a directed path from the start point to the end point. All nodes along this path are arranged in order from upstream to downstream, resulting in a data tracing path. The first node on this path is the upstream source data object, and the last node is the current target data object.

[0074] Based on this data tracing path, a tree-like data structure is created, with all nodes along the path serving as tree nodes. The current target data object is the root node, the upstream source data object is the leaf node, and intermediate nodes along the path are connected as parent and child nodes in the order they appear from upstream to downstream. For the upstream source data object, only nodes on its corresponding data tracing path are retained, excluding nodes from other branch paths. After construction, a chained subtree is obtained with the current target data object as the root and the upstream source data object as its only leaf.

[0075] Repeat the tree-like data structure construction process described above until all objects in the upstream source data set have completed the construction of their source subtrees. Merge all source subtrees according to the identifiers of their root and intermediate nodes. Intermediate nodes with the same identifier are retained as a single instance in the merged tree, but the number of different data source paths sharing that node is recorded. For the merged complete source tree, count the total number of its leaf nodes. Leaf nodes are nodes without children, representing all upstream source data objects. Use this total number of leaf nodes as the first structural quantity. The larger the first structural quantity, the more upstream source data objects the current target data object depends on, and the higher the degree of data aggregation.

[0076] Traverse all intermediate nodes in the merged complete source tree. For each intermediate node, read the number of times it is shared by different data source paths. Among all intermediate nodes, find the maximum number of shared occurrences and use this maximum value as the second structural value. The larger the second structural value, the more frequently an intermediate node is shared by data source paths, and the more central its position is in the data derivation structure.

[0077] An upstream source data object is retrieved from the upstream source dataset. Using a first structural quantity as the base and a second structural quantity as the independent variable, a predefined saturation growth function is input for calculation. The expression for this saturation growth function is f(x) = 1 + log(1 + x), where x is the second structural quantity. Multiplying the first structural quantity by the calculated result of f(x) yields the sensitivity weight corresponding to this upstream source data object. The saturation growth function ensures that the influence of the second structural quantity on the weight gradually weakens as x increases, preventing the weight of core nodes from being excessively amplified.

[0078] Check if there are any objects in the upstream source data set whose sensitivity weights have not yet been calculated. If so, process the next object until all objects have been processed. Sum the calculated sensitivity weights of all upstream source data objects and use the sum as the sensitivity weight of the upstream source data set corresponding to the current target data object.

[0079] In one implementation of this application, the data tracing path from each upstream source data object to the target data object is extracted, and backtracking is performed node by node along the path from the starting point to the target data object. At each backtracking node, its sensitivity weight, remaining tracing depth, and out-degree are obtained. The node cost is calculated by combining the three factors, and finally the sum of the costs of all nodes on the path is taken as the sensitivity attenuation length of the data tracing path, thereby quantifying the degree of risk attenuation of data on the tracing path.

[0080] Specifically, from the established upstream source data set, an upstream source data object is selected. Using this upstream source data object as the starting point and the current target data object as the ending point, a depth-first search is performed along the outgoing edges in the predefined data topology to find a directed path from the starting point to the ending point. All nodes along this path are arranged in order from upstream to downstream to obtain a data tracing path. This step is repeated until data tracing paths have been extracted for all objects in the upstream source data set.

[0081] From the obtained data tracing path, the first node on the path is taken as the current backtracking node, which is the upstream source data object corresponding to this data tracing path. The cumulative node cost of this path is initialized to 0. Among the sensitivity weights of each upstream source data object, the sensitivity weight value corresponding to the current backtracking node is searched. If the current backtracking node is an upstream source data object, the calculated result is used directly. If the current backtracking node is an intermediate node, starting from this intermediate node, all upstream source data objects are traversed along the reverse edges of the preset data topology. These upstream source data objects are collected to form a temporary upstream source data set. The number of objects in this temporary set is counted as the first structural quantity. The maximum number of times the data tracing path corresponding to these upstream source data objects is shared at this intermediate node is counted as the second structural quantity. The first structural quantity is multiplied by 1 and the logarithm of the second structural quantity is added to obtain the sensitivity weight corresponding to the intermediate node. The found or calculated sensitivity weight is used as the sensitivity weight of the current backtracking node.

[0082] Calculate the number of remaining nodes between the current backtracking node and the endpoint of the data tracing path. The number of remaining nodes does not include the current backtracking node itself, but it does include the endpoint node. Use this number of remaining nodes as the remaining tracing depth of the current backtracking node. The larger the remaining tracing depth, the farther the current node is from the target data object, and the more intermediate links the data has experienced during transmission.

[0083] In the predefined data topology, find the number of all directed outgoing edges originating from the current backtracking node, and use this number as the out-degree of the current backtracking node. The larger the out-degree, the more downstream data objects the node's data has been distributed to, and the wider the data diffusion range.

[0084] Divide the obtained sensitivity weight by the remaining depth of the backtracking to obtain an intermediate ratio. Multiply this intermediate ratio by the out-degree to obtain the node cost of the current backtracking node. The formula for calculating the node cost is: Node cost = (sensitivity weight / remaining depth of tracing) × out-degree; The meaning of this formula is: the higher the sensitivity of a node, the closer it is to the target, and the larger its out-degree, the higher its node cost, indicating that the node contributes more risk to the data tracing path.

[0085] The calculated node cost is added to the total node cost accumulation value of the data tracing path. It is then determined whether the current backtracking node is the endpoint node of the data tracing path, i.e., the current target data object. If not, the next node on the path is taken as the new current backtracking node, and the operations of obtaining sensitivity weight, obtaining the remaining tracing depth, obtaining the out-degree, and calculating node cost are re-executed until the endpoint node is reached.

[0086] The accumulated node costs are used as the sensitive attenuation length of the data tracing path. The sensitive attenuation length reflects the cumulative attenuation of data sensitivity as it passes through intermediate nodes from the upstream source data object to the target data object. The larger the sensitive attenuation length, the stronger the data risk transmission capability on the tracing path.

[0087] Step 105: Determine the data leakage spread radius corresponding to the target tenant based on the length of the data tracing path and the sensitivity weight.

[0088] In one implementation of this application, the initial diffusion radius is obtained by multiplying the source path length by the sensitivity weight. Then, downstream data objects are obtained by expanding along the forward edge level by level. The product of the source path length and sensitivity weight corresponding to each downstream object is calculated as the secondary diffusion radius. The data leakage diffusion radius is obtained by adding the maximum value of the initial diffusion radius and the secondary diffusion radius.

[0089] Specifically, the sensitivity attenuation length of each data tracing path is obtained, and the maximum value is selected as the length of the data tracing path. The sensitivity weight corresponding to the upstream source data set is obtained. The initial diffusion radius is obtained by multiplying the length of the data tracing path by the sensitivity weight.

[0090] Starting with the current target data object, perform a forward breadth-first traversal along all outgoing edges in the pre-defined data topology. Expand level by level from the starting point, collecting downstream data objects directly connected to the previous level at each level, until the number of expansion levels reaches the preset hop tolerance in the target tenant's access context baseline. Add all data objects accessed during the expansion process to the downstream reachable data object set.

[0091] Take an unprocessed downstream data object from the set of downstream reachable data objects. Starting from this downstream data object, perform a reverse breadth-first traversal along all incoming edges in the predefined data topology, collecting all upstream nodes encountered during the traversal, which are then used as the upstream source data set corresponding to this downstream data object. Determine the number of each upstream source data object in this upstream source data set as the first structural quantity, and determine the maximum number of times the data tracing path corresponding to each upstream source data object is shared in this set as the second structural quantity. Multiply the first structural quantity by the logarithm of the second structural quantity to obtain the sensitivity weight corresponding to this upstream source data set. Extract the data tracing paths from each upstream source data object in the upstream source dataset to the downstream data object. Backtrack each path node by node from the starting point to the ending point. At each backtracked node, obtain the node's sensitivity weight, remaining tracing depth, and out-degree. Divide the sensitivity weight by the remaining tracing depth and multiply by the out-degree to obtain the node cost. Use the sum of the node costs of all nodes on the path as the sensitivity decay length of the data tracing path. Take the maximum value among all sensitivity decay lengths as the length of the data tracing path corresponding to the upstream source dataset. Multiply the length of the data tracing path by the sensitivity weight to obtain the secondary diffusion radius of the downstream data object. Repeat this process until the secondary diffusion radius of all objects in the downstream reachable data object set has been calculated.

[0092] Find the maximum value among the secondary diffusion radii of all downstream data objects. Add the initial diffusion radius to this maximum value to obtain the data leak diffusion radius corresponding to the target tenant.

[0093] Step 106: If a candidate access path for the target tenant is constructed and the path length of the candidate access path is greater than the data leakage spread radius, the data access request is blocked.

[0094] In one implementation of this application, the path length of the candidate access path is compared with the data leakage diffusion radius. If the path length of the candidate access path is less than or equal to the data leakage diffusion radius, it indicates that the current access request is within an acceptable diffusion range, and the access request is allowed to continue.

[0095] If the path length of the candidate access path exceeds the data leakage propagation radius, it indicates that once the current access request is executed, the potential data propagation range exceeds the acceptable security boundary, posing a data leakage risk. In this case, blocking processing is performed on the data access request before it is executed. This blocking processing includes methods such as issuing commands and directly denying access. Taking issuing commands as an example, the blocking command includes the identifier of the target tenant, the identifier of the user initiating the access, the identifier of the requested target data object, and a description of the blocking reason. The blocking command is sent to the access gateway of the multi-tenant data platform. After receiving the blocking command, the access gateway refuses to execute the data access request and returns an access denied response message to the initiator. At the same time, this blocking event is written to the audit log, recording the time of the blocking, the tenants and users involved, the target data object, and the calculated path length and propagation radius values ​​for subsequent security auditing and analysis.

[0096] In one implementation of this application, when no candidate access path can be constructed, for example: the current access point itself falls into a tenant-level dynamic obstacle area, all candidate directional branches trigger the prohibition of falling into the obstacle area in the first step and terminate completely, with no branch reaching the safe access reference domain; the current access point and the safe access reference domain are completely separated by an obstacle area, and all candidate directional branches fall into the obstacle area before reaching the target area and terminate completely; all candidate directional branches trigger the preset stop condition before reaching the safe access reference domain, the step size advance count reaches the upper limit or the advance distance exceeds the preset threshold, but they are still outside the safe access reference domain, etc. In this case: Based on the joint environmental offset distribution corresponding to the tenant-level dynamic obstacle region, the environmental repulsion potential field in the access behavior space is inverted. In the access behavior space, starting from the current access point, along the negative gradient direction of the environmental repulsion potential field, the minimum potential energy increment required for the current access point to break through the environmental repulsion potential field and reach the secure access reference domain is determined, serving as the equivalent barrier potential value of the current access point. Based on cross-domain calibration coefficients, the equivalent barrier potential value is mapped to the equivalent barrier path length; where the cross-domain calibration coefficients are determined according to the boundary curvature of the connected envelope subdomains of the secure access reference domain and the sensitivity weight of the upstream source data set. If the equivalent barrier path length is greater than the data leakage propagation radius, data access requests are blocked.

[0097] Specifically, in the absence of candidate access paths, the joint environmental offset of each location point within the tenant-level dynamic obstacle area is used as the potential source value, and the boundary of the tenant-level dynamic obstacle area is used as the zero potential surface. A continuous repulsive potential field is generated into the obstacle area according to a preset attenuation function. The preset attenuation function includes, but is not limited to, a Gaussian attenuation function or a power attenuation function. Taking the Gaussian attenuation function as an example: in the access behavior space, the environmental repulsive potential value at any location point is obtained by Gaussian weighted summation of the joint environmental offsets of all sampled location points within the obstacle area. The closer a location is to a sampled location point, the greater its contribution to the potential field of that location point; the farther away, the smaller the contribution. Locations with larger joint environmental offsets within the obstacle area have higher corresponding environmental repulsive potential values; the environmental repulsive potential value at the boundary of the obstacle area approaches zero; and the environmental repulsive potential value outside the obstacle area is zero.

[0098] After obtaining the environmental repulsion potential field, starting from the current access point, the minimum potential energy increment required for the current access point to overcome the environmental repulsion potential field and reach the safe access reference domain is determined along the negative gradient direction of the environmental repulsion potential field. Specifically, starting from the current access point, an integral path search is performed along the negative gradient direction of the environmental repulsion potential field until the boundary of the safe access reference domain is reached or the environmental repulsion potential value first falls below the average potential value of the safe access reference domain. Along this integral path, the environmental repulsion potential values ​​at each location point are accumulated to obtain the equivalent barrier potential value of the current access point. If the current access point itself is located within a tenant-level dynamic barrier region, the difference between the environmental repulsion potential value at the current access point and the average potential value of the safe access reference domain is directly used as the minimum potential energy increment.

[0099] After obtaining the equivalent barrier potential, the equivalent barrier potential is mapped to the equivalent barrier path length based on the cross-domain calibration coefficient. In this embodiment, the cross-domain calibration coefficient is determined based on the boundary curvature of the connected envelope subdomains of the secure access reference domain and the sensitivity weight of the upstream source data set. Specifically, the cross-domain calibration coefficient is determined as follows: The average boundary curvature of each connected envelope subdomain in the secure access reference domain is obtained; the maximum number of times each intermediate node in the tracing subtree corresponding to the upstream source data set is shared by different data tracing paths is obtained; and the normalized value of the sensitivity weight of the upstream source data set is obtained. The ratio of the average boundary curvature to the maximum number of sharing is multiplied by a first preset weight coefficient to obtain a first component; the normalized sensitivity weight is multiplied by a second preset weight coefficient to obtain a second component; and the first component and the second component are added to obtain the cross-domain calibration coefficient. The sum of the first preset weight coefficient and the second preset weight coefficient is 1.

[0100] In one embodiment, the first preset weighting coefficient and the second preset weighting coefficient can be obtained by: acquiring historical access records corresponding to multiple data access requests within a historical time period, wherein the historical access records include the historical equivalent blocking path length, the historical data leakage diffusion radius, and the actual access result corresponding to each data access request; using the comparison result of the historical equivalent blocking path length and the historical data leakage diffusion radius as the fitting target, performing regression fitting on the first preset weighting coefficient and the second preset weighting coefficient to obtain the values ​​of the first preset weighting coefficient and the second preset weighting coefficient.

[0101] Based on the cross-domain calibration coefficient and the equivalent barrier potential, the equivalent barrier path length is obtained by multiplying the two. After obtaining the equivalent barrier path length, it is compared with the data leakage propagation radius. If the equivalent barrier path length is greater than the data leakage propagation radius, the current access behavior is determined to have a high risk, and the data access request is blocked. If the equivalent barrier path length is less than or equal to the data leakage propagation radius, the current access behavior is determined to be controllable, and the data access request is allowed to continue performing subsequent data reading operations.

[0102] Figure 3 This is a schematic diagram of a pre-emptive security risk prediction device for multi-tenant data access, provided as an embodiment of this application. Figure 3As shown, a pre-emptive security risk prediction device 300 for multi-tenant data access includes: at least one processor 301; and a memory 302 communicatively connected to the at least one processor 301. The memory 302 stores instructions executable by the at least one processor 301. These instructions, when executed by the at least one processor 301, enable the at least one processor 301 to: construct access context baselines for each tenant based on historical access logs corresponding to each tenant, and map the access context baselines to an access behavior space to obtain a security access baseline domain for each tenant. The access context baseline is a normal access reference baseline obtained based on statistics of the tenant's historical access context, and the access behavior space is a feature space characterizing the tenant's access behavior. In response to a data access request from a target tenant, the context information of the current access is mapped to the current access point in the access behavior space. The context information includes at least... This includes the target data object corresponding to this access request; determining the directional obstacle degree from the current access point to the secure access baseline based on context information and access context baseline; determining the tenant-level dynamic obstacle region based on the directional obstacle degree; constructing candidate access paths for the target tenant in the access behavior space, with the current access point as the starting point and the secure access baseline region as the target region, using the tenant-level dynamic obstacle region as a path constraint condition to prevent entry; determining the upstream source data set of the target data object based on the preset data topology; calculating the sensitivity weight corresponding to the upstream source data set; determining the length of the data tracing path based on the upstream source data set; determining the data leakage diffusion radius corresponding to the target tenant based on the length of the data tracing path and the sensitivity weight; and blocking the data access request if a candidate access path for the target tenant is constructed and the path length of the candidate access path is greater than the data leakage diffusion radius.

[0103] The various embodiments in this application are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments for devices and non-volatile computer storage media are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0104] The above descriptions are merely embodiments of this application and are not intended to limit the scope of this application. For those skilled in the art, various modifications and variations can be made to the embodiments of this application. These modifications or substitutions do not cause the essence of the corresponding technical solutions to depart from the spirit and scope of the technical solutions in the embodiments of this application.

Claims

1. A method for predicting security risks in multi-tenant data access, characterized in that, The method includes: Based on the historical access logs corresponding to each tenant, an access context baseline is constructed for each tenant, and the access context baseline is mapped to the access behavior space to obtain the security access benchmark domain corresponding to each tenant. The access context baseline is a normal access reference benchmark obtained based on the historical access context statistics of the tenant, and the access behavior space is a feature space that characterizes the access behavior features of the tenant. In response to a data access request from a target tenant, the context information of this access is mapped to the current access point in the access behavior space; wherein, the context information includes at least the target data object corresponding to this access request; Based on the context information and the access context baseline, the directional obstacle degree of the current access point toward the security access reference domain is determined. Based on the directional obstacle degree, the tenant-level dynamic obstacle region is determined. In the access behavior space, with the current access point as the starting point and the security access reference domain as the target region, the tenant-level dynamic obstacle region is used as a path constraint condition to prevent falling into the target tenant, and a candidate access path for the target tenant is constructed. Based on a pre-defined data topology, the upstream source data set of the target data object is determined, the sensitivity weight corresponding to the upstream source data set is calculated, and the length of the data tracing path is determined based on the upstream source data set. Based on the length of the data tracing path and the sensitivity weight, the data leakage diffusion radius corresponding to the target tenant is determined; If a candidate access path for the target tenant is constructed, and the path length of the candidate access path is greater than the data leakage diffusion radius, the data access request is blocked.

2. The method for predicting security risks in multi-tenant data access according to claim 1, characterized in that, The process of constructing an access context baseline for each tenant based on the historical access logs corresponding to each tenant, and mapping the access context baseline to the access behavior space to obtain the security access baseline domain for each tenant, specifically includes: For the target tenant in the multi-tenant system, obtain the historical access logs corresponding to the target tenant, and extract access behavior feature tuples based on the historical access logs; wherein, the access behavior feature tuples include at least the access subject attribute, terminal device information, business scenario, operation type, and the location code of the target data object in the preset data topology; Tracing back along the derivation relationship of the data object, the location encoding is converted into the feature signature of the source data object on which it depends, resulting in an extended behavioral feature tuple; Using the access subject attribute in the access behavior feature tuple as the clustering dimension, the extended behavior feature tuple is clustered, and the hop count corresponding to the source tracing depth of each extended behavior feature tuple in the topology link direction is used as the hop count tolerance constraint for inter-cluster merging, to generate multiple behavior clusters. The distribution region of all extended behavior feature tuples in each behavior cluster in the access behavior space is determined as the connected envelope subdomain corresponding to the behavior cluster. The union of the connected envelope subdomains corresponding to all behavior clusters of the target tenant is taken as the security access base domain of the target tenant.

3. The method for pre-emptive security risk prediction for multi-tenant data access according to claim 1, characterized in that, The step of determining the directional obstacle degree of the current access point toward the secure access baseline domain based on the context information and the access context baseline, and determining the tenant-level dynamic obstacle region based on the directional obstacle degree, specifically includes: Based on the context information, the security status data of the current terminal device and the current business scenario are determined, and the security status data and the current business scenario are concatenated to form the joint environment state vector of the current access. The joint environment state vector is compared with the reference joint environment state vector in the access context baseline to determine the joint environment offset; Based on the joint environment offset, the directional obstacle degree of the current access point toward the secure access reference domain is determined in the access behavior space; The area where the directional obstacle degree is greater than the preset obstacle threshold is marked as the tenant-level dynamic obstacle area.

4. The method for predicting security risks in multi-tenant data access according to claim 3, characterized in that, The step of determining the directional obstacle degree of the current access point toward the secure access reference domain in the access behavior space based on the joint environment offset specifically includes: Obtain the geometric contour information of each connected envelope subdomain in the access behavior space within the secure access reference domain; Starting from the current access point, multiple detection rays are emitted towards the secure access reference domain; each detection ray corresponds to a different candidate direction. For each of the aforementioned detection rays, determine the number and type of connected envelope subdomains that the detection ray traverses from the current access point to the boundary of the secure access reference domain; Based on the quantity, determine the basic passage cost of the candidate direction corresponding to the detection ray; Based on the type and the joint environmental offset, determine the environmental correction cost for the candidate direction corresponding to the probe ray; Based on the basic passage cost and the environmental correction cost, the directional obstacle degree of the candidate direction is determined as the directional obstacle degree of the current access point toward the secure access reference domain.

5. The method for predicting security risks in multi-tenant data access according to claim 1, characterized in that, The process of constructing candidate access paths for the target tenant, starting from the current access point, targeting the secure access baseline domain, and using the tenant-level dynamic obstacle region as a path constraint condition to prevent entry, specifically includes: Starting from the current access point and targeting the secure access reference domain, an initial direction vector is determined in the access behavior space. Based on the initial direction vector, multiple candidate direction branches are generated in the access behavior space; wherein each candidate direction branch is composed of a continuous step size, and each step size corresponds to a position point in the access behavior space. Starting from the current access point, advance step by step along each of the candidate direction branches; wherein, during each step advancement: if the current step position falls into the tenant-level dynamic obstacle area, then the advancement of the candidate direction branch is terminated; if the current step position does not fall into the tenant-level dynamic obstacle area, then the projection value of the joint environment offset at the position point on the current advancement direction is obtained, and the advancement cost of the current step is determined based on the projection value. When each of the candidate directional branches meets the preset stopping condition, the advancement of the branch is stopped; Among all candidate directional branches that have stopped advancing, the branch with the minimum sum of advancement costs for each step size is determined as the candidate access path for the target tenant.

6. The method for predicting security risks in advance for multi-tenant data access according to claim 5, characterized in that, The step of obtaining the projection value of the joint environment offset at the location point in the current propulsion direction and using the projection value as the propulsion cost for the current step size specifically includes: In the access behavior space, the first coordinate vector corresponding to the current step size position is obtained, and the second coordinate vector corresponding to the next position is determined; Determine the first connected envelope subdomain to which the first coordinate vector belongs, and determine the second connected envelope subdomain to which the second coordinate vector belongs; The boundary distance between the first connected envelope subdomain and the second connected envelope subdomain is determined, and the cross-domain scaling factor of the current step size is determined based on the boundary distance; For the coordinate axes of the access behavior space, determine the joint environment offset at the current step size location; Based on the difference in joint environment offset at the location point and its neighborhood, the rate of change of the joint environment offset along the direction of the access behavior space coordinate axis is determined, and the rate of change corresponding to each access behavior space coordinate axis is combined to form the joint environment offset gradient vector at the location point. Based on the joint environment offset gradient vector and the cross-domain scaling factor, the scaled joint environment offset gradient vector is obtained; The cosine of the angle between the current step's propulsion direction vector and the scaled joint environment offset gradient vector is determined and used as the direction consistency coefficient. The propulsion cost for the current step size is obtained by using the projection value, the directional consistency coefficient, and the preset reward coefficient corresponding to the directional consistency coefficient.

7. The method for predicting security risks in advance for multi-tenant data access according to claim 1, characterized in that, The process of determining the upstream source data set of the target data object based on a preset data topology and calculating the sensitivity weight corresponding to the upstream source data set specifically includes: Based on the preset data topology, the data tracing path between the upstream source data object and the current target data object is extracted, and the tracing subtree corresponding to the upstream source data object is constructed through the data tracing path; wherein, the root of the tracing subtree is the current target data object, the leaf is the upstream source data object, and the intermediate node is the data object common to the data tracing path; The number of leaves in the source tracing subtree is taken as the first structural quantity, and the maximum number of times that each intermediate node in the source tracing subtree is shared by different data source tracing paths is taken as the second structural quantity. Based on the first structural quantity and the second structural quantity, the sensitivity weight corresponding to the upstream source data object is obtained; Based on the sensitivity weights of all upstream source data objects in the upstream source data set, the sensitivity weights corresponding to the upstream source data set are determined.

8. The method for predicting security risks in multi-tenant data access according to claim 1, characterized in that, The determination of the length of the data tracing path based on the upstream source data set specifically includes: Based on the preset data topology, the data tracing path between each upstream source data object in the upstream source data set and the target data object is determined; For each of the data tracing paths, starting from the beginning of the path, backtrack node by node along the path toward the target data object; At each backtracking node, obtain the sensitivity weight of the data object corresponding to the backtracking node, the remaining tracing depth from the backtracking node to the target data object, and the out-degree of the backtracking node in the preset data topology; wherein, the out-degree represents the number of data tracing out edges starting from the backtracking node; Based on the sensitivity weight, the remaining depth of the tracing, and the out-degree, the node cost corresponding to the backtracking node is determined; The length of the data tracing path is determined based on the node cost of all backtracking nodes on the data tracing path.

9. The method for predicting security risks in multi-tenant data access according to claim 1, characterized in that, Determining the data leakage spread radius corresponding to the target tenant based on the length of the data tracing path and the sensitivity weight specifically includes: The initial diffusion radius is obtained by multiplying the length of the data tracing path with the sensitivity weight. Starting from the target data object, the data is expanded step by step along the forward edge in the preset data topology to determine the data objects accessed during the expansion process and to construct a set of downstream reachable data objects. For each downstream data object in the set of downstream reachable data objects, determine its corresponding upstream source data set, and obtain the secondary diffusion radius of the downstream data object based on the product of the length of the data tracing path corresponding to the upstream source data set and the sensitivity weight. The data leakage diffusion radius corresponding to the target tenant is obtained by adding the initial diffusion radius to the maximum value among the secondary diffusion radii of all downstream data objects.

10. A device for predicting pre-emptive security risks for multi-tenant data access, characterized in that, The device includes a memory for storing computer program instructions and a processor for executing the program instructions, wherein when the computer program instructions are executed by the processor, the device is triggered to perform the method according to any one of claims 1-9.

Images