455 results about "Data access control" patented technology

Apparatuses, systems, and methods for managing access to metadata stored at a memory. To manage access to metadata, a mode register is configured to receive a metadata enable setting and to provide a metadata enable signal based on the metadata enable setting. A metadata access control circuit configured to receive a column address identifying a particular column to be accessed within a memory array. The metadata access control circuit blocks access to a column corresponding to the column address when the column address matches one of a plurality of particular column addresses designated for storage of metadata and the metadata enable signal has a first value, and permits access to a column corresponding to the column address when the column address is different than every one of the a plurality of particular column addresses designated for storage of metadata or the metadata enable signal has a second value.

The invention discloses an access control method and system for data security protection, and relates to the field related to data security, and the method comprises the steps: obtaining user access request information, carrying out sensitivity evaluation, obtaining access data sensitivity information, matching with a security verification mode library, and obtaining a target security verification mode; performing multi-dimensional identity verification on the target user to obtain a security verification result, and when the security verification result is passed, performing dynamic access permission adjustment to obtain accessible permission data information; access monitoring is carried out, user access behavior information is obtained, abnormity analysis is carried out, and abnormal access behavior feature information is obtained; and performing access control analysis to obtain a data security access strategy, and performing access restriction protection. The technical problems that existing data access control is low in security protection effect and has data leakage risks are solved, and the technical effects of improving the data security protection effect and effectively reducing data leakage and illegal access risks are achieved.

The invention discloses a privatized AI question and answer method, system and device and a medium, and relates to the technical field of artificial intelligence, and the method comprises the steps: collecting a file archive data set, and constructing a local digital knowledge base; selecting an AI semantic large model architecture; performing annotation enhancement on a local digital knowledge base by using an AI semantic large model architecture, and constructing a knowledge base AI question and answer model; performing permission marking on the local digital knowledge base based on a user access control rule, and establishing a knowledge base retrieval mechanism; and integrating and fusing the knowledge base retrieval mechanism and the knowledge base AI question-answering model to generate a retrieval enhanced AI question-answering model, performing semantic question-answering retrieval on the request question information, and outputting a user request question-answering result. The technical problem that in the prior art, data security, intelligent question answering and information retrieval efficiency are insufficient is solved, and the technical effect of improving intelligence and data access control of the question answering system is achieved.

The invention provides a Linux access control system based on attributes, and relates to the technical field of data access control. The system comprises a system monitor module, a data interaction module and a decision unit. The system monitor module collects attributes from a kernel and a user space and writes the attributes into the data interaction module; the access decision unit compiles the access control strategy into an eBPF program and mounts the eBPF program to a corresponding hook; executing the kernel to the hook, and triggering an eBPF program; an eBPF program queries a Flow rule; matching the attribute with the Flow rule, and if the matching is successful, executing a corresponding action; if all the Flow rules fail to match, executing a default action; the system can be expanded during operation, and can be loaded or unloaded based on dynamic loading characteristics and strategies of the eBPF program and the eBPF program during operation of the system, so that the problem that a kernel needs to be compiled in a traditional LSM scheme is solved; the method does not intrude the kernel, is completely based on an eBPF program, does not modify a kernel source code, and can guarantee the stability and compatibility.

The invention provides a data access control method and system based on attribute encryption and a zero-trust architecture, and relates to the technical field of information security. User identity registration is carried out, an SM2 signature key pair is generated, and an SM2 public key, identity information and attributes are sent to a server; the server generates a user private key based on the identity information and the attribute, encrypts the user private key and sends a CP-ABE private key of the user; the method comprises the following steps: acquiring user access login information and an identity label, verifying the user identity, encrypting a challenge message by using a preset access strategy and sending the challenge message to a user side, and the user side decrypting by using the attribute of a ciphertext strategy and a CP-ABE private key to acquire a challenge message plaintext and sending the challenge message plaintext to a server side to realize signature verification; and when the user logs in next time, the state and the context information of the user side are obtained in real time, the access strategy is dynamically adjusted based on the real-time state and the context information of the user side, the adjusted access strategy is applied to the user identity verification and signature process, and continuous monitoring and evaluation are carried out.

The invention discloses a road-oriented full-process digital collaborative management system and method, particularly relates to the technical field of road data management, and is used for solving the problem of abnormal multi-role collaborative conflict recognition. According to the method, dynamic linkage management of task states and role behaviors in the whole highway design process is achieved by building the task-driven atlas and the multi-role scheduling model, and the dynamic linkage management of the task states and the role behaviors in the whole highway design process is achieved by extracting access behaviors, task records and data version states, calculating role collaborative offset and recognizing and controlling the write-in permission of task conflict nodes. A priority factor is constructed based on a stage index, data dependence and a time urgency degree, a nonlinear model is adopted to generate scores, automatic reconstruction of a scheduling sequence and data ownership is driven, role permission and a collaborative view are synchronously updated, a data access control closed loop based on task state evolution is formed, and a three-dimensional responsibility chain is constructed by whole-process behavior traces. The traceable management of collaborative operation is realized, and the intelligence of collaborative scheduling and the accuracy of data management are improved.

The invention provides a multi-level dynamic data access control method and device based on a credential environment, and the method comprises the steps: obtaining a data access request initiated by a user and associated environment state information, carrying out the multi-factor authentication processing of a user identity, and combining the pre-stored user role attribute information and responsibility division data, thereby achieving the multi-level dynamic data access control. Generating an initial permission set of the user for the data resource identifier; extracting historical access behavior records of the user in the credential environment to generate historical access behavior characteristics, extracting real-time state characteristics in combination with the environment state information, performing association analysis on the historical access behavior characteristics and the real-time state characteristics, and generating a risk assessment result of the user access behavior; and adjusting access permission configuration of the user to the data resource identifier, generating a permission control instruction, and executing permission control operation of accessing the data resource identifier by the user. According to the method, the accuracy, the dynamic adaptability, the safety and the reliability of data access control in the credential environment are improved.

The invention provides a data access control method and device based on a block chain and improved CP-ABE, and belongs to the technical field of block chains. The method comprises the following steps: an authority generates key parameters including a system public key and a master key, and uploads the master key to a block chain; the user sends an attribute set and an identity label of the user to an authority, the identity label of the user is hidden, an attribute private key, a search private key, a conversion key and a recovery key are generated for the user, the conversion key is sent to the cloud server, and the attribute private key, the search private key and the recovery key are sent to the user, and the user comprises a data owner and a data visitor; the data owner carries out offline encryption, online encryption and index encryption on the file in sequence, and index information is linked; the data accessor performs data access; and the data accessor decrypts the data. According to the method, the problems in data storage and access control are effectively solved, the integrity of user data is protected, and the calculation burden of a data access user is reduced.

The invention relates to the technical field of geological data management, in particular to a geological data sharing platform and method based on a block chain technology. The system comprises a data acquisition module, a data classification and preprocessing module, a block chain network, an intelligent contract management module, a data access control module and a decentralized data exchange module. The invention provides a geological data sharing platform and method based on a block chain technology so as to realize security and transparency in a data sharing process. Data sharing rules and processes are managed by using an intelligent contract, the legality and compliance of data sharing are ensured, a decentralized data exchange mechanism is designed, single-point faults are prevented, and the reliability and safety of the system are enhanced.

Disclosed in the embodiments of the present application are a data access control method and an apparatus, which are used for improving security for data access control. The method in the embodiments of the present application comprises: configuring authentication information for data access control, the authentication information comprising one or more of the following: an identity security classification level, a resource security classification level and an environment security classification level, the identity security classification level being used for indicating the access authority of a user, the resource security classification level being used for indicating the confidentiality level of a cloud resource, and the environment security classification level being used for indicating the confidentiality level of a cloud environment; receiving a data access request from the user, the data access request being used for requesting access to data in the cloud resource or cloud environment; and processing the data access request according to authentication logic, the authentication logic comprising control logic between the authentication information, the authentication logic being used for controlling the access authority of the user to the data in the cloud resource or cloud environment, or being used for controlling the flow direction of the data between the cloud resource or the cloud environment, and the flow direction being a direction from a low security classification level to a high security classification level.

The invention discloses a unified storage management method for station data in expressway data, which comprises the following steps of: S1, constructing a multi-source heterogeneous data acquisition channel, and processing various data sources by using edge computing nodes to generate a standardized metadata packet; s2, establishing a dynamic fragment storage matrix, and performing three-dimensional slicing on the data from time, space and business dimensions; s3, designing an event-driven data association engine, establishing a space-time mapping relation, and realizing automatic association storage through event ID chain type binding; s4, deploying a multi-modal storage cluster, storing different data by using different storage units, and tracking data consanguinity through a distributed index service; s5, implementing dynamic vectorization authority management, calculating an access authority level according to cosine similarity, and establishing a fine-grained data access control model; and step S6, constructing a service data interface gateway. The method has remarkable advantages in the aspects of highway data acquisition, storage, association, management, sharing and the like.

The disclosure generally describes methods, software, and systems for to data access control for applications using large language models (LLM). A request to access attributes of an application object is received from a user. A LLM object access layer defining an access level of the user to each attribute of the application object is determined. The LLM object access layer is queried to determine accessible attributes of the attributes of the application object. A response is provided based on the accessible attributes of the application object to the user.

The invention provides a motion data security management method and system in meta-universe smart motion, and relates to the technical field of meta-universe, and the method comprises the steps: obtaining user motion data and identity information, building an identity authentication model based on a zero-knowledge proof mechanism, generating Merkle tree zero-knowledge proof, and verifying the authenticity of the user identity. Carrying out distributed storage on the motion data by adopting a fragmentation storage technology; and providing corresponding data according to the access permission level of the third-party application. According to the invention, privacy protection and efficient storage of user data are realized, multi-level data access control is supported, and data security and utilization efficiency are improved.

The invention is applied to the technical field of data storage, and particularly discloses a multilevel data encryption storage and access control method based on cloud computing, which comprises the following steps of: 1, data classification and multilevel encryption; step 2, constructing a layered secret key; step 3, data access control; and 4, constructing and dynamically updating the data access authority. According to the multi-level data encryption storage and access control method based on cloud computing, encryption grade division is performed on data according to the data confidentiality degree, and algorithm encryption with different intensities is performed on the data according to different encryption grades, so that encryption can be performed for different types of data, and compared with traditional single algorithm encryption, the encryption efficiency is improved. According to the technical scheme, the adaptability of data encryption can be improved, meanwhile, three levels of key structures are arranged to be matched with one another, the main key protects the middle key, the middle key isolates direct association of the main key, the working key and the data, and the exposure risk of the main key is reduced.

The invention discloses a dynamic NFT-based attribute-based encrypted medical data sharing method, which comprises the following steps that: firstly, a user submits identity authentication information to a trusted digital identity platform, and applies for an attribute certificate from an institution to which the user belongs; secondly, the key management system completes system initialization and generates a master key and a public key, the medical data owner generates an attribute-based encrypted ciphertext according to the access strategy and casts a dynamic NFT according to the smart contract, and when the medical data demander conforms to the access strategy, the medical data owner issues a sub-NFT of the dynamic NFT to the medical data demander through the smart contract; and then the medical data demander applies for a master key from the key management system and decrypts the ciphertext. And finally, the medical data owner changes the access strategy and re-judges whether the medical data demander conforms to the access strategy. According to the invention, the data access control does not depend on a fixed strategy any more, and the controllability and security of the data access control are enhanced.

The invention discloses a zero-trust data access control method and system and a storage medium, and the method comprises the steps: carrying out the identity authentication of a user logging in a client, and obtaining the current terminal equipment information of the client, the current network information and the historical access information of the user after the authentication succeeds, the trust level of the authorization request and the current access permission matched with the trust level are obtained; acquiring a real-time access action of a user and real-time terminal equipment information and real-time network information of a client to perform threat detection on the authorization request, and adjusting the current access permission so as to generate a real-time access strategy corresponding to the client according to the adjusted real-time access permission; and acquiring a data access request uploaded by the client according to the real-time access strategy, acquiring access data required by the client according to the access request, and sending the encrypted access data to the client, thereby improving the security of data access.

The invention relates to the technical field of data cross-domain access control, in particular to a block chain-based trusted data space cross-domain access control method, system and device and a medium, comprising: receiving a data access request, and analyzing a target data identifier, a target heterogeneous system identifier and access scene information; obtaining the data attribute of the target data according to the target data identifier, generating a dynamic access strategy in combination with the access scene information, and deploying the dynamic access strategy into the block chain; mapping the dynamic access strategy into an equivalent access control rule, and converting the data access request into target compatible request data; verifying zero-knowledge proof provided by the user based on an equivalent access control rule and a user public key; after the verification is passed, routing the target compatible request data to the target heterogeneous system; and the target heterogeneous system generates original response data, converts the original response data into user-side compatible response data and returns the user-side compatible response data to the user. According to the invention, cross-system efficient cooperation is realized, and the real-time adaptability and privacy enhancement security of access control can be improved.

A data access control system is provided together with methods, computer systems and computer programs for processing transactions to be recorded in a distributed ledger that is shared amongst a plurality of computing nodes and for controlling access to data recorded in the distributed ledger. The system comprises a policy store comprising one or more policies for controlling access to at least some of the data recorded in a distributed ledger that is shared amongst a plurality of computing nodes, each policy comprising one or more constraints on accessing the data. The system further comprises a key store for storing cryptographic keys. The system further comprises a transaction processor configured to: receive a transaction from one of the computing nodes: encrypt a payload of the transaction using a secret key to generate an encrypted transaction for recording in the distributed ledger; and store the secret key in the key store in association with an indication of the encrypted transaction. The system further comprises a data access module configured to: receive a request for access to the pay load of the encrypted transaction from one of the computing nodes: determine whether the constraints specified by the one or more policies on accessing data contained in the payload are satisfied; and in response to determining that the constraints are satisfied: retrieve the secret key from the key store; and use the secret key to provide access to the data for the computing node.

The embodiment of the invention relates to the field of information encryption communication, in particular to an information encryption communication method for Internet of Things security and computer equipment. A specific embodiment of the method comprises the following steps: a target mobile terminal generates transmission key request information, and sends information operation request information and the transmission key request information to a target server; the target server generates to-be-stored information and sends the to-be-stored information to the data access control terminal; the data access control terminal responds to the received to-be-stored information, encrypts and stores the to-be-stored information to obtain encrypted storage result information, and sends the encrypted storage result information to the target server; the target server responds to the received encrypted storage result information and sends the encrypted storage result information to the target mobile terminal; and the target mobile terminal sends the encrypted storage result information to the target user terminal. According to the embodiment, the communication security of the Internet of Things is improved.

The invention relates to the related technical field of zero-trust networks, in particular to a network data security protection method and system based on multi-protection right control, and the method comprises the steps: connecting a terminal and a protection center, setting a primary authorization mechanism, starting hierarchical authorization of a right group, evaluating the risk in real time, interrupting the access if the risk does not accord with the threshold, and carrying out the threat sharing. The technical problems that the authority is allocated only according to a fixed role, the enterprise business scene change and the user actual demand change cannot be adapted, the access of the user to the isolated data area resource is lack of fine-grained control, the situation of excessive authority granting or insufficient authority granting is easy to occur, and the data leakage risk is increased are solved; according to the invention, dynamic hierarchical management of the authority is realized by constructing a primary authorization authentication mechanism and a hierarchical authorization authentication mechanism, the authority is minimized to a single service instance, and fine-grained partitioning is carried out on resources, so that data access control is more accurate, illegal data access and attack diffusion are effectively blocked, and data access efficiency is improved. And the safety of the isolated data area is ensured.

The invention discloses an emergency rescue data privacy protection and collaborative analysis system based on federated learning, and belongs to the technical field of emergency rescue data privacy protection and collaborative analysis. A dynamic trust evaluation module; the federated learning privacy protection engine module is used for realizing cross-domain data collaborative training by adopting a secure multi-party computing model; and the block chain intelligent contract module is used for deploying a data access control strategy and a credible auditing rule. According to the method, a global trusted environment is established through an end-side cloud three-level trust chain, the reliability of equipment is quantified through dynamic trust evaluation, data collaboration of privacy protection is realized through federated learning, an auditing strategy is automatically executed through an intelligent contract, an efficient encryption technology for guaranteeing safety and effectively reducing resource consumption is adopted, and the urban emergency data safety problem is solved.

The invention discloses a dynamic hierarchical data access control method based on recoverable puncture encryption. A user key is composed of an attribute key and a puncture key; the hierarchical users revoke access authority of subordinate part data according to requirements; the hierarchical user recovers the previously revoked data access authority of the subordinate part of the hierarchical user when necessary; the edge node updates the attribute conversion key stored in the edge node by using the key updating material; the data owner encrypts the data by using puncturable attribute-based encryption according to the defined access structure and the data label set; after the malicious user is revoked, the third-party cloud server is responsible for public ciphertext updating; the edge node of the Internet of Things uses the conversion key part to decrypt the ciphertext; the user only can access the ciphertext of which the attribute meets the ciphertext access structure and does not contain the key punctured tag; in the user revocation stage, the malicious user is revoked, and the key of the user which is not revoked is updated; according to the method, fine-grained hierarchical dynamic access control can be realized, and a feasible method is provided for dynamic authority control among hierarchical organizations.

The invention relates to the technical field of medical data security, in particular to a medical data abnormal access identification method and system. Firstly, a user ID and an access log are collected to provide a behavior analysis basis, then a new user is endowed with initial credibility based on historical credibility of a group to which the new user belongs and jumps to permission setting, and an old user carries out vectorization on current and historical access data and calculates a fitting degree; constructing a three-dimensional evaluation vector in combination with data importance, access duration and fitness, calculating initial credibility by using a density function, finally matching a dynamic update model according to a fitness range, mapping the credibility into an intelligent contract control interval, automatically intercepting a hyper-permission request, and realizing fine-grained real-time permission control and abnormal access accurate interception. The technical problems that a traditional medical data access control technology lacks a fine-grained trust evaluation mechanism, is difficult to dynamically adapt to the complexity of an access behavior, and is easy to cause abnormal access recognition lag are solved.

The invention relates to the technical field of information security and encryption technologies, in particular to a geological data access control method and system based on information encryption, and the system comprises a data collection module, a data classification module, a data encryption module, an identity verification and authority management module, a data access control module and an access recording and auditing module. The data acquisition module is used for acquiring geological data; the data classification module is used for classifying the geological data according to different attributes of the data; the data encryption module is used for performing encryption processing on the classified data by using AES and HSM; the identity authentication and authority management module is used for performing multi-factor identity authentication when a user logs in, distributing different data access authorities according to user roles, and retrieving and providing a corresponding encryption key according to the user authorities after the user passes the authentication; the data access control module is used for checking user authority when a user requests to access geological data, determining whether the user has the authority to access the requested data, and distributing a corresponding encryption key for the user according to the authority; after the user uses the distributed encryption key to decrypt the data, the decrypted plaintext data is provided for the user; and the access recording and auditing module is used for recording the access behavior of the user.

The invention discloses a data access control method and device, and relates to the technical field of cloud computing. The method comprises the steps that an access control strategy for a target data resource is acquired, the access control strategy of the target data resource indicates a target data table, and then in response to an operation request for the target data resource triggered by a user, a resource identifier of the target data resource and a user identifier of the user in the operation request are extracted. Querying a target data table based on the operation request to obtain target permission data having a mapping relationship with the user identifier in the target data table, and if the target permission data comprises the resource identifier, passing the authentication; and if the target permission data does not comprise the resource identifier, the authentication is not passed. According to the method, access control with data as granularity is realized, whether the access authority exists or not is determined by inquiring whether the target authority data comprises the resource identifier or not, and the maintainability of an authentication system and the access control efficiency are improved.

The embodiment of the invention discloses a data access control method and device which are used for improving the security of data access control. The method comprises the steps that authentication information of data access control is configured, the authentication information comprises one or more of the following items: an identity security level, a resource security level and an environment security level, the identity security level is used for indicating the access authority of a user, the resource security level is used for indicating the security level of cloud resources, and the environment security level is used for indicating the security level of a cloud environment; receiving a data access request from a user, wherein the data access request is used for requesting to access data in a cloud resource or a cloud environment; the data access request is processed according to authentication logic, the authentication logic comprises control logic between authentication information, the authentication logic is used for controlling the access authority of a user to data in the cloud resources or the cloud environment or used for controlling the flowing direction of the data between the cloud resources or the cloud environment, and the flowing direction is from a low security level to a high security level.

The invention provides a data access control method and system based on zero-knowledge proof, and relates to the technical field of data access control. According to the method, a root key of a unique hardware identity is generated through a physical unclonable function of a data request equipment chip, and meanwhile, real-time running state data of equipment is collected; the two are subjected to cryptographic binding to form an equipment credible state voucher; secondly, detecting capacitance field disturbance when data holding equipment approaches through a capacitive proximity sensor array, and generating an interactive response mode; then, the equipment credible state certificate and the interactive response mode serve as private input to generate a composite zero-knowledge proof, and identity authenticity and physical proximity are proved to data holding equipment at the same time on the premise that sensitive information is not leaked; and after the data holding device passes verification, the data access permission is authorized immediately, and a temporary encryption communication channel is established, so that the reliability and instantaneity of security authentication between IoT devices can be improved.

The invention discloses a distributed access control method, system and equipment based on multi-factor authentication, and relates to the related field of data access control, and the method comprises the steps: responding to a real-time access request, determining a first access user, and judging whether the access is the first access; if not, the first decentralized identity system is connected to determine the bound multi-factor authentication mode and the lowest permission principle under the zero-trust architecture; connecting the access log database to collect a historical access record of the first access user, performing trust risk assessment, and generating a trust risk index; judging whether the trust risk index meets the trust requirement under the zero-trust architecture or not, executing screening of the lowest permission principle and the multi-factor authentication mode, and generating a target authentication scheme; and performing access authority authentication on the first access user. The technical problems that existing access control is insufficient in safety and unauthorized access is difficult to effectively prevent are solved, and the technical effects of improving the safety of access control and effectively preventing unauthorized access are achieved.

The invention discloses an ontology-based data space dynamic access control method and device, and a medium. The method comprises the following steps: constructing a data dictionary connector and a basic connector; establishing a semantic mapping relationship between the global ontology and the local ontology to obtain first access mapping; establishing data field mapping between the data source and the local ontology to obtain second access mapping; performing policy relationship construction on the second access mapping to establish a policy relationship between the data source and the local ontology; obtaining a data request, and determining an accessible field corresponding to the identity of the requester through data access control based on the data request and the first access mapping; carrying out strategy relation analysis on the accessible field to obtain an access query statement; and according to the access query statement, obtaining fine-grained access data through virtual mapping knowledge domain mapping. According to the method, the technical problem that a centralized access control strategy is difficult to respond to the authority change demand in multi-organization cooperation in time is solved.

The invention discloses a block chain transaction dynamic monitoring management method and system, a storage medium and a device, and the method comprises the steps: enabling a business service system to achieve the self-management and control of transactions through employing an annotation type transaction under default configuration, and setting an expansible system layering architecture; based on an extensible system hierarchical architecture, the method comprises the steps of setting a data access control smart contract, a block transaction data statistics smart contract, a dynamic monitoring smart contract and a network node monitoring smart contract; receiving a consumption payment transaction request initiated by an acquiring system according to the inquired network node information; receiving a consumption return transaction request initiated by an acquisition system; if the order receiving system does not receive the order response given by the business service system within the specified time, making a consumption reversal transaction request, sending a request again, and correcting the original order; and the acquiring system is linked with the wallet to obtain payment fees, and redeeming transaction is carried out according to an assignable strategy. According to the invention, a supervisor can dynamically supervise transaction ecology.