CN115883140A - Data security model architecture and data security system - Google Patents
Data security model architecture and data security system Download PDFInfo
- Publication number
- CN115883140A CN115883140A CN202211412591.4A CN202211412591A CN115883140A CN 115883140 A CN115883140 A CN 115883140A CN 202211412591 A CN202211412591 A CN 202211412591A CN 115883140 A CN115883140 A CN 115883140A
- Authority
- CN
- China
- Prior art keywords
- data
- user
- security
- access
- information
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Abstract
The application discloses a data security model architecture and a data security system, and relates to the field of network security. The control platform at least comprises a policy engine component, and the policy engine component is used for determining the preliminary authority of the user for accessing the data according to the reference data; the data platform consists of a decision execution component; the decision execution component is used for respectively carrying out security evaluation on user access information, user request information and information when the user accesses data according to the reference data under the condition that the user accesses the data, and obtaining an evaluation result; and determining the final authority of the user for accessing the data according to the evaluation result and the preliminary authority. The request information of the user represents the information of the user when the user accesses the data, and the information of the user when the user accesses the data are subjected to security evaluation, so that continuous dynamic evaluation and data security control are realized, the authority is dynamically changed, and the security of the data is improved.
Description
Technical Field
The present application relates to the field of network security, and in particular, to a data security model architecture and a data security system.
Background
With the increase of network data requests of users, internet Technology (IT) architecture becomes more and more complex, and various forms of remote office, multi-branch office, private cloud, hybrid cloud and the like are continuously evolved, so that enterprise change is accelerated, and meanwhile, new security risks are brought. The traditional network security architecture is based on boundary access control, namely, all authorized persons and devices are considered to have unlimited access to the right, but once an attacker breaks the boundary, the transverse attack of the intranet is no longer hindered, thereby causing the intranet to be totally lost.
Therefore, how to improve the security of data is a technical problem that needs to be solved urgently by those skilled in the art.
Disclosure of Invention
The application aims to provide a data security model architecture and a data security system, which are used for improving the security of data.
To solve the above technical problem, the present application provides a data security model architecture, including: the system comprises a control platform, a data platform and a safety evaluation system;
the control platform is respectively connected with the data platform and the security policy system;
the data platform is connected with the security policy system;
the security policy system is used for providing reference data for security evaluation of user access information, user request information and information when the user accesses the data, and transmitting the reference data to the control platform and the data platform;
the control platform comprises at least a policy engine component for determining a preliminary right of the user to access the data from the reference data;
the data platform consists of a decision execution component; the decision execution component is used for respectively carrying out security evaluation on the user access information, the user request information and the information when the user accesses the data according to the reference data under the condition that the user accesses the data, and obtaining an evaluation result; and determining the final authority of the user for accessing the data according to the evaluation result and the preliminary authority.
Preferably, the policy engine component for determining a preliminary right of the user to access the data from the reference data comprises:
the policy engine component is used for acquiring target data; wherein the target data at least comprises the user access information, the request information of the user, asset state, resource access requirements and risk threats;
taking the target data and the reference data as input of a trust algorithm;
outputting, by the trust algorithm, a composite trust score for evaluating the user;
determining the preliminary right of the user to access the data as authorized if the composite trust score is greater than or equal to a first threshold.
Preferably, the control platform is configured to, after determining that the preliminary right of the user to access the data is authorized, allocate an enterprise resource corresponding to the request information to the user determined that the preliminary right is authorized according to the request information of the user.
Preferably, the user access information at least includes information of the user, information of a device used by the user, information of an application used by the user and containing the data, and information of an environment in which the user uses the application.
Preferably, the security policy system includes at least a continuous diagnosis system, an industry compliance system, a threat intelligence system, a key behavior log, a data access system, a public key infrastructure, an identity management system, and a security information management system.
Preferably, the control platform comprises: a policy manager;
the policy manager is respectively connected with the policy engine component and the policy execution component, and is configured to control the policy execution component to establish a data transmission link between an application when the user accesses the data and a database where the data is located within a first preset time when the preliminary right determined by the policy engine component is authorized;
and controlling the policy execution component to disconnect the data transmission link between the application when the user accesses the data and the database where the data is located within a second preset time under the condition that the preliminary authority determined by the policy engine component is refused.
Preferably, the decision execution component is configured to, after determining a final right of the user to access the data according to the evaluation result and the preliminary right, obtain a state of the data transmission link between an application when the user accesses the data and the database where the data is located;
and under the condition that the data transmission link is in a disconnected state, establishing the data transmission link within a third preset time from the moment that the final authority is determined to be authorized, so that the user can access the data through the data transmission link.
Preferably, the control platform is configured to obtain the final right determined by the decision execution component; and outputting prompt information for representing failure in accessing the data under the condition that the final authority is refused.
Preferably, the control platform is configured to obtain the user who fails to access the data, and record the number of times that the user fails to access the data; in the case that the number of times is greater than or equal to a second threshold value, marking the information of the user and updating the security policy system.
In order to solve the above technical problem, the present application further provides a data security system, which includes the above data security model architecture.
The data security model architecture provided by the application comprises: the system comprises a control platform, a data platform and a safety evaluation system; the control platform is respectively connected with the data platform and the security policy system; the data platform is connected with the security policy system; the security policy system is used for providing reference data for security evaluation of user access information, user request information and information when the user accesses data, and transmitting the reference data to the control platform and the data platform; the control platform at least comprises a policy engine component, and the policy engine component is used for determining the preliminary authority of the user for accessing the data according to the reference data; the data platform consists of a decision execution component; the decision execution component is used for respectively carrying out security evaluation on user access information, user request information and information when the user accesses data according to the reference data under the condition that the user accesses the data, and obtaining an evaluation result; and determining the final authority of the user for accessing the data according to the evaluation result and the preliminary authority. Compared with the prior authority that all authorized persons and devices can access data without limit, in the security model architecture provided by the application, the policy execution component in the data platform carries out security evaluation on the information of the user, the request information of the user and the information of the user when accessing the data. The request information of the user represents the information of the user when the user accesses the data, and the information of the user when the user accesses the data are subjected to security evaluation, so that continuous dynamic evaluation and data security control are realized, and the authority is dynamically changed; in addition, the strategy engine component in the control platform preliminarily determines the authority of the user for accessing the data, and then the strategy execution component in the data platform finally determines the authority of the user for accessing the data, so that the access authority of the user is finally determined by multiple times of judgment, and the safety of the data is ensured as much as possible.
In addition, the application also provides a data security system, which has the same or corresponding technical characteristics with the data security model architecture, and the effects are the same as the above.
Drawings
In order to more clearly illustrate the embodiments of the present application, the drawings needed for the embodiments will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present application, and that other drawings can be obtained by those skilled in the art without inventive effort.
Fig. 1 is a schematic diagram of a data security model architecture according to an embodiment of the present application;
fig. 2 is a schematic diagram of a zero trust data security access dynamic management component according to an embodiment of the present application;
fig. 3 is a schematic diagram of a user accessing a service application data resource through a data security model architecture according to an embodiment of the present application.
Detailed Description
The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only some embodiments of the present application, and not all embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments in the present application without any creative effort belong to the protection scope of the present application.
The core of the application is to provide a data security model architecture and a data security system, which are used for improving the security of data. Currently, a typical IT architecture becomes more and more complex, and the evolution of various forms such as teleworking, multi-branch office, private cloud, hybrid cloud and the like is continuous, so that the enterprise revolution is accelerated, and meanwhile, a new security risk is brought, a traditional network security architecture is based on boundary access control, that is, all authorized persons and devices are considered to be authorities to which unlimited access belongs, but once an attacker breaks through a boundary, the transverse attack of an intranet is not hindered, so that the intranet is totally lost; in addition, the traditional control model based on the static policy granting of access authority is difficult to adapt to the problems of current sensitive data leakage and various network attacks, the system cannot prevent the security threat of a new principal access request to resources, and in the traditional access control mode, the multi-source attribute and the security problem possibly caused by the authorized attribute change are not considered, so that the principal attribute access control with finer granularity needs to be realized. According to the method and the device, the information of the user when the user wants to access the data and the information of the user when the user accesses the data are evaluated in safety by using the policy engine component in the control platform and the policy execution component in the data platform, continuous dynamic evaluation and data safety control are achieved, authority is dynamically changed, and the safety of the data is improved.
In order that those skilled in the art will better understand the disclosure, the following detailed description will be given with reference to the accompanying drawings. Fig. 1 is a schematic diagram of a data security model architecture provided in an embodiment of the present application, as shown in fig. 1, the model architecture includes: a control platform 10, a data platform 11 and a safety evaluation system 12;
the control platform 10 is respectively connected with the data platform 11 and the security policy system 12;
the data platform 11 is connected with the security policy system 12;
the security policy system 12 is configured to provide reference data for performing security evaluation on user access information, user request information, and information when the user accesses data, and transmit the reference data to the control platform 10 and the data platform 11;
the control platform 10 comprises at least a policy engine component for determining a preliminary right of a user to access data from reference data;
the data platform 11 is composed of a decision execution component; the decision execution component is used for respectively carrying out security evaluation on user access information, user request information and information when the user accesses data according to the reference data under the condition that the user accesses the data, and obtaining an evaluation result; and determining the final authority of the user for accessing the data according to the evaluation result and the preliminary authority.
In order to improve the security of data, a security policy system is arranged in the model architecture. The security policy system provides reference data for security evaluation of information when a user accesses the data. The information when the user accesses the data includes user access information, request information of the user and information when the user accesses the data, specifically, the user access information may include identity information of the user, network information used when the user accesses the data, an application used when the user accesses the data, and the like; the user's request may include a request for data, a request for a key-sensitive database, etc.; the information when the user accesses the data may include the encryption of the data, the frequency of access, and the like. If the identity management system is established in the security policy system, some abnormal identity information is recorded in the identity management system, and when the user wants to access data, the user identity can be determined whether the user identity is abnormal or not by referring to the identity information recorded in the identity management system.
The control platform is respectively connected with the data platform and the security policy system, and a policy engine component in the control platform can determine the primary authority of a user for accessing data according to parameters provided by the security policy system. If the user identity is determined to be abnormal according to the identity management system in the security policy system, the control platform can refuse the user to access the data; otherwise, the user may be authorized to access the data.
After the control platform determines the preliminary authority of the user to access the data, the decision execution component respectively carries out security evaluation on user access information, user request information and information generated when the user accesses the data according to the reference data, the three information can respectively correspond to information generated in a user access stage, an application access stage and an access control stage, namely the three stages are respectively carried out with security evaluation, evaluation results are obtained, and the final authority of the user to access the data is determined according to the evaluation results and the preliminary authority. The policy execution component is responsible for establishing a security channel between the access subject and the accessed object, executing a final authorization policy according to a judgment result of the policy decision point, and simultaneously, activating, monitoring and terminating the connection between the subject and the object.
The determination of the ultimate right of a user to access data is determined by both the policy decision component and the policy enforcement component. If the policy decision component determines that the initial authority of the user for accessing the data is refused, but the evaluation result of the policy decision component is that the user is credible, determining that the final authority of the user for accessing the data is authorized; the strategy decision-making component determines that the initial authority of the user for accessing the data is authorization, but the evaluation result of the strategy decision-making component is that the user is not credible, and then determines that the final authority of the user for accessing the data is refusal; or the strategy decision-making component determines that the initial authority of the user for accessing the data is authorization, but the evaluation result of the strategy decision-making component is that the user is not credible, the strategy decision-making component performs recognition analysis on the user information again, and if the user is determined to be credible, the final authority of the user for accessing the data is authorization.
The data security model architecture provided by the embodiment includes: the system comprises a control platform, a data platform and a safety evaluation system; the control platform is respectively connected with the data platform and the security policy system; the data platform is connected with the security policy system; the security policy system is used for providing reference data for security evaluation of user access information, user request information and information when the user accesses data, and transmitting the reference data to the control platform and the data platform; the control platform at least comprises a policy engine component, and the policy engine component is used for determining the preliminary authority of the user for accessing the data according to the reference data; the data platform consists of a decision execution component; the decision execution component is used for respectively carrying out security evaluation on user access information, user request information and information when the user accesses data according to the reference data under the condition that the user accesses the data, and obtaining an evaluation result; and determining the final authority of the user for accessing the data according to the evaluation result and the preliminary authority. Compared with the previous permission that all authorized persons and devices can access data without limitation, the security model architecture provided by the embodiment performs security evaluation on the information of the user, the request information of the user and the information of the user when the user accesses the data by the policy execution component in the data platform. The request information of the user represents the information of the user when the user accesses the data, and the information of the user when the user accesses the data are subjected to security evaluation, so that continuous dynamic evaluation and data security control are realized, and the authority is dynamically changed; in addition, the strategy engine component in the control platform preliminarily determines the authority of the user for accessing the data, and then the strategy execution component in the data platform finally determines the authority of the user for accessing the data, so that the access authority of the user is finally determined by multiple times of judgment, and the safety of the data is ensured as much as possible.
In order to make the preliminary right determined by the policy engine component more accurate, in a preferred embodiment, the determining, by the policy engine component, the preliminary right of the user to access the data according to the reference data includes:
the strategy engine component is used for acquiring target data; the target data at least comprises user access information, user request information, asset states, resource access requirements and risk threats;
taking the target data and the reference data as the input of a trust algorithm;
outputting a comprehensive trust score for evaluating the user through a trust algorithm;
in the event that the composite trust score is greater than or equal to the first threshold, determining a preliminary right of the user to access the data as authorized.
The policy engine component determines whether to grant the principal access rights to the object. The component uses a security tool to collect and analyze multi-source information such as participation objects, access behaviors and the like, and calculates a comprehensive trust score representing the comprehensive credibility of a main body by combining a security strategy as the input of a trust algorithm. The right to access the data is granted to users for which the composite trust score is greater than or equal to a first threshold.
The policy engine accepts data input from multiple internal or external data sources, mainly the following 5 aspects of data.
1) Main body information: indicating who is requesting access to the resource. The method comprises basic information, activity information, authority, historical user behaviors and the like of the user, and device use information such as a common position, login failure times and the like.
2) And (3) access request: the actual request initiated by the subject is accessed. Containing information about the body of the request and information to be requested.
3) Asset status: the record compares the location and status of the existing asset (location of request, patch level, etc.) to the asset status of the database to determine whether access to the resource is passed or denied.
4) Resource access requirements: defining the minimum requirements of the policy, including resource sensitivity level, visitor level, black and white list of Internet Protocol (IP) interconnection between networks and the like, and quickly excluding visitors which completely do not meet the requirements.
5) Risk threat: refers to threats and malware information that may exist in the current system, such as malicious information sources or malware commands.
The policy engine component provided by the embodiment can comprehensively analyze the credibility of the user by accepting a plurality of data inputs from internal or external data sources, so as to determine whether to grant the user the authority to access the data, thereby improving the data security.
On the basis of the above embodiment, in order to ensure the security of the data as much as possible after determining that the preliminary right is authorized, a preferred embodiment is that the control platform is configured to, after determining that the preliminary right of the user for accessing the data is authorized, allocate an enterprise resource corresponding to the request information to the user who determines that the preliminary right is authorized according to the request information of the user.
In implementation, the identity authentication and authorization result of any subject by the policy engine component may be continuously changed according to the minimum authority principle, so that in order to improve the security of data, only the subject is granted a reasonable minimum resource authority in this embodiment. If the target data is requested to be accessed currently, only the right to access the target data is allocated to the user, but the right to access the whole database is not allocated to the user.
The control platform provided by the embodiment only allocates the access right for accessing the resource with the preset size to the user with the primary right of authorization, thereby improving the data security.
In order to be able to determine the security of the identity of the user accessing the data more accurately, the preferred embodiment is that the user access information at least includes information of the user, information of a device used by the user, information of an application used by the user and containing the data, and information of an environment in which the user uses the application.
The user access information is information of the access stage of the user represented. The access subject includes the user, the device, the application, and the environment in which it is located. The user layer comprises a user identity identification code, a post, a job, an account state, historical access behaviors and the like; the equipment level comprises an operating system, address service and the like; the application layer comprises application software and the like; the environment level comprises a geographical position, a network environment, a computing environment and the like, and in the access stage, illegal users and illegal terminals can be intercepted outside the user access stage, and the access of the malicious users and the illegal terminals can be directly blocked.
The method for determining the security of the user access information provided by the embodiment comprehensively analyzes the user access information from a plurality of layers, and accurately identifies the security of the user access, thereby improving the security of data.
Likewise, to improve the security of the data, a preferred embodiment is that the security policy system comprises at least a continuous diagnostic system, an industry compliance system, a threat intelligence system, a critical behavior log, a data access system, a public key infrastructure, an identity management system, a security information management system.
The security policy system provided by the embodiment includes reference data in multiple aspects, so that the security of the user when accessing data can be determined more accurately according to the security policy system.
In order to transmit the result of the preliminary permission determined by the policy engine component to the policy decision component in a timely manner, a preferred embodiment is that the control platform comprises: a policy manager;
the policy manager is respectively connected with the policy engine component and the policy execution component and is used for controlling the policy execution component to establish a data transmission link between an application and a database where data is located when a user accesses the data within first preset time under the condition that the primary authority determined by the policy engine component is authorization;
and controlling the policy execution component to disconnect a data transmission link between the application and the database where the data is located when the user accesses the data within a second preset time under the condition that the preliminary authority determined by the policy engine component is refused.
The policy manager component continuously determines whether the authorization policy of the access principal is allowed or denied based on the trust evaluation result of the policy engine. The access request is granted and the request is authenticated, the component will configure the policy enforcement point to initiate the session; if the access request is denied, the policy enforcement point is notified to disconnect the data transfer links of the subject and object. The first preset time and the second preset time are not limited according to actual conditions.
The policy management component is arranged in the control platform, and the policy management component notifies the policy execution component to establish or disconnect a data transmission link between the main body and the object. Since a plurality of services are generally required to be executed in the control platform, the policy execution component can be notified in time through the control management function of the policy manager in the control platform in this embodiment.
After the final rights are determined, data transfer between the subject and the object is required. In order to transmit data as soon as possible, the decision execution component is preferably configured to, after determining a final right of the user to access the data according to the evaluation result and the preliminary right, obtain a state of a data transmission link between the application when the user accesses the data and a database in which the data is located;
and under the condition that the data transmission link is in a disconnected state, starting from the fact that the final authority is determined to be authorized, establishing the data transmission link within the third preset time so that a user can conveniently access data through the data transmission link.
In the embodiments described above, when the policy engine component determines that the preliminary right is an authorization, it may allocate a smaller resource to the user, and therefore, the data transmission link between the subject and the object is connected at this time; otherwise, the data transmission link between the subject and the object is disconnected. Therefore, after the final authority is determined, the connection state of the output transmission link can be judged first. When the data transmission link is in a connection state, data transmission can be directly carried out; and when the data transmission link is in a disconnected state, establishing the data transmission link within a third preset time so as to perform data transmission between the main body and the object. The third preset time is not limited, and preferably, in order to enable data transmission to be performed in time, a data transmission link is established immediately after the final authority is determined to be authorized.
In the method provided by this embodiment, the condition of the data transmission link can be known in time by judging the data transmission link, so that the disconnected data transmission link is established in time, and further data transmission is performed.
In order to facilitate the user to know the authority for accessing the data in time, the preferred embodiment is that the control platform is used for acquiring the final authority determined by the decision execution component; and in the case that the final authority is refused, outputting prompt information for representing the failure of accessing the data.
In the method provided by the embodiment, the user can know whether the data can be accessed in time through the prompt message.
In order to improve the security of the data, the reference data in the security policy system needs to be updated, so that the abnormal behavior of the user is more accurately identified according to the reference data. The control platform is used for acquiring users who fail to access data and recording the times of the users who fail to access the data; and in the case that the times are larger than or equal to a second threshold value, marking the information of the user and updating the security policy system.
The second threshold is not limited and is determined according to actual conditions. Because the security policy system comprises a plurality of aspects, the security policy system can be updated regularly, so that abnormal conditions when a user accesses data can be identified more accurately according to the security policy system.
The above describes a data security model architecture, and the present embodiment also provides a data security system including the data security model architecture.
The data security system provided by the embodiment has corresponding technical features to the aforementioned data security model architecture, and the above-mentioned embodiments of the data security model architecture are described in detail, and the embodiments of the data security system are not described again here, and have the same beneficial effects as the aforementioned data security model architecture.
In order to make the technical field of the present invention better understand, the present invention is further described in detail with reference to fig. 2 and 3 and the detailed description. Fig. 2 is a schematic diagram of a zero-trust data security access dynamic management component according to an embodiment of the present application. As shown in fig. 2, the security management system includes a continuous diagnosis system, an industry compliance system, a threat intelligence system, a key behavior log, a data access system, a public key infrastructure, an identity management system, and a security information management system; the control platform comprises a strategy decision component, and the strategy decision component specifically comprises a strategy engine component and a strategy manager; the data platform comprises a strategy execution component, in the data platform, under the condition that the subject is not trusted, the credibility of the subject is confirmed again through the strategy execution component, and under the condition that the subject is trusted, the subject is allowed to access enterprise resources; in the case of trusted subjects, direct access to enterprise resources is possible.
Fig. 3 is a schematic diagram of a user accessing a service application data resource through a data security model architecture according to an embodiment of the present application. The whole process is mainly divided into three parts, namely a user access stage, an application access stage and an access control stage. When the subject initiates access, each access behavior of the subject area needs to be subjected to dynamic trust evaluation, and corresponding object resources such as business applications, data resources and the like are accessed after the authorization of data security trust evaluation.
1. User access phase
The access subject includes the user, the device, the application, and the environment in which it is located. The user layer comprises a user identity identification code, a post, a job, an account state, historical access behaviors and the like; the equipment level comprises an operating system, address service and the like; the application layer comprises application software and the like; the environment level comprises a geographical position, a network environment, a computing environment and the like, and in the access stage, illegal users and illegal terminals can be intercepted outside the user access stage, and the access of malicious users and illegal terminals can be directly blocked.
2. Application access phase
And in the application access stage, the request of a legal subject is mainly distinguished, the request comprises a request for data, a request for a key sensitive database, a request for a server and the like, and abnormal behaviors and man-in-the-middle attack behaviors are identified.
3. Access control phase
And in the access phase, the access control comprises functions of dynamic access control, trust evaluation, network stealth, access proxy, transmission encryption and the like. The application access delay trend display can help a manager to intuitively know whether security threats exist in access behaviors occurring in the whole monitoring period, and the data resources, the application resources, the service resources and the like contained in the access object are divided into fine granularities according to resource attributes by utilizing the dynamic access control capability to evaluate the trust capability.
In the access control stage, the design of a security access model architecture for dynamic permissions is central, monitoring behaviors are realized by accessing the dynamic management component safely through zero trust data shown in fig. 2, and the access permissions of the main body are determined by the policy decision component and the corresponding policy execution component together.
Therefore, the enterprise data security model architecture based on zero trust is provided, and the full life cycle of enterprise data security access is divided into three stages, namely: the method comprises a user access request stage, an application access request stage and an access control judgment stage, wherein the aim of safe access is fulfilled through continuous dynamic evaluation and data safety control; a dynamic trust evaluation and security management and control framework is adopted, and in an access control judgment stage, the 'global data trust' of a data access strategy, a public key infrastructure, an identity management system, security information and a data management system is realized through a strategy engine component and a strategy manager of a control platform and a strategy execution point of a data platform, so that the data security is improved.
A data security model architecture and a data security system provided by the present application are described in detail above. The embodiments are described in a progressive manner in the specification, each embodiment focuses on differences from other embodiments, and the same and similar parts among the embodiments are referred to each other. The device disclosed by the embodiment corresponds to the method disclosed by the embodiment, so that the description is simple, and the relevant points can be referred to the method part for description. It should be noted that, for those skilled in the art, without departing from the principle of the present application, the present application can also make several improvements and modifications, and those improvements and modifications also fall into the protection scope of the claims of the present application.
It is further noted that, in the present specification, relational terms such as first and second, and the like are used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrases "comprising a," "8230," "8230," or "comprising" does not exclude the presence of additional like elements in a process, method, article, or apparatus that comprises the element.
Claims (10)
1. A data security model architecture, comprising: the system comprises a control platform, a data platform and a safety evaluation system;
the control platform is respectively connected with the data platform and the security policy system;
the data platform is connected with the security policy system;
the security policy system is used for providing reference data for security evaluation of user access information, user request information and information when the user accesses the data, and transmitting the reference data to the control platform and the data platform;
the control platform comprises at least a policy engine component for determining a preliminary right of the user to access the data from the reference data;
the data platform consists of a decision execution component; the decision execution component is used for respectively carrying out security evaluation on the user access information, the user request information and the information when the user accesses the data according to the reference data under the condition that the user accesses the data, and acquiring an evaluation result; and determining the final authority of the user for accessing the data according to the evaluation result and the preliminary authority.
2. The data security model architecture of claim 1, wherein the policy engine component to determine preliminary rights of the user to access the data from the reference data comprises:
the policy engine component is used for acquiring target data; wherein the target data at least comprises the user access information, the request information of the user, asset state, resource access requirements and risk threats;
taking the target data and the reference data as input of a trust algorithm;
outputting, by the trust algorithm, a composite trust score for evaluating the user;
determining the preliminary right of the user to access the data as authorized if the composite trust score is greater than or equal to a first threshold.
3. The data security model architecture of claim 2, wherein the control platform is configured to, after determining that the preliminary right of the user to access the data is authorized, allocate an enterprise resource corresponding to the request information to the user determined that the preliminary right is authorized according to the request information of the user.
4. The data security model architecture of claim 3, wherein the user access information comprises at least information of the user, information of a device used by the user, information of an application used by the user that contains the data, and information of an environment in which the user uses the application.
5. The data security model architecture of any one of claims 1 to 4, wherein the security policy system comprises at least a continuity diagnosis system, an industry compliance system, a threat intelligence system, a critical behavior log, a data access system, a public key infrastructure, an identity management system, a security information management system.
6. The data security model architecture of claim 5, wherein the control platform comprises: a policy manager;
the policy manager is respectively connected with the policy engine component and the policy execution component, and is configured to control the policy execution component to establish a data transmission link between an application when the user accesses the data and a database where the data is located within a first preset time when the preliminary right determined by the policy engine component is authorized;
and controlling the policy execution component to disconnect the data transmission link between the application when the user accesses the data and the database where the data is located within a second preset time under the condition that the preliminary authority determined by the policy engine component is refused.
7. The data security model architecture of claim 6, wherein the decision execution component is configured to, after the final right of the user to access the data is determined according to the evaluation result and the preliminary right, obtain a state of the data transmission link between an application when the user accesses the data and the database where the data is located;
and under the condition that the data transmission link is in a disconnected state, establishing the data transmission link within a third preset time from the moment that the final authority is determined to be authorized, so that the user can access the data through the data transmission link.
8. The data security model architecture of claim 7, wherein the control platform is configured to obtain the final permission determined by the decision execution component; and outputting prompt information for representing the failure of accessing the data under the condition that the final authority is refused.
9. The data security model architecture of claim 8, wherein the control platform is configured to obtain the user who has failed to access the data and record the number of times the user has failed to access the data; in the case that the number of times is greater than or equal to a second threshold, marking the user's information and updating the security policy system.
10. A data security system comprising the data security model architecture of any one of claims 1 to 9.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211412591.4A CN115883140A (en) | 2022-11-11 | 2022-11-11 | Data security model architecture and data security system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211412591.4A CN115883140A (en) | 2022-11-11 | 2022-11-11 | Data security model architecture and data security system |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN115883140A true CN115883140A (en) | 2023-03-31 |
Family
ID=85759729
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211412591.4A Pending CN115883140A (en) | 2022-11-11 | 2022-11-11 | Data security model architecture and data security system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115883140A (en) |
-
2022
- 2022-11-11 CN CN202211412591.4A patent/CN115883140A/en active Pending
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| He et al. | A survey on zero trust architecture: Challenges and future trends | |
| CN111935165B (en) | Access control method, device, electronic device and medium | |
| US9635029B2 (en) | Role-based access control permissions | |
| CN112118102A (en) | Dedicated zero trust network system of electric power | |
| CN111917714B (en) | Zero trust architecture system and use method thereof | |
| CN111953679A (en) | Intranet user behavior measurement method and network access control method based on zero trust | |
| CN111131176B (en) | Resource access control method, device, equipment and storage medium | |
| CN112765639A (en) | Security micro-service architecture based on zero trust access strategy and implementation method | |
| CN116545731A (en) | Zero-trust network access control method and system based on time window dynamic switching | |
| US11768699B2 (en) | Enforce changes in session behavior based on updated machine learning model with detected risk behavior during session | |
| Krautsevich et al. | Risk-aware usage decision making in highly dynamic systems | |
| CN106685955B (en) | Radius-based video monitoring platform security authentication method | |
| Salman et al. | Multi-level security for the 5G/IoT ubiquitous network | |
| CN116418568A (en) | Data security access control method, system and storage medium based on dynamic trust evaluation | |
| CN116455668A (en) | User trust measurement method and system in zero trust network environment | |
| CN115987644A (en) | Intelligent power distribution internet of things safety authentication system | |
| CN114338105B (en) | Zero trust based system for creating fort | |
| KR20210026710A (en) | Trust-Aware Role-based System in Public Internet-of-Things | |
| CN116208401A (en) | Cloud master station access control method and device based on zero trust | |
| CN116996249A (en) | Domain control fusion authorization control system and method based on zero trust | |
| CN115118465B (en) | Cloud edge end cooperative zero trust access control method and system based on trusted label | |
| CN116089970A (en) | Power distribution operation and maintenance user dynamic access control system and method based on identity management | |
| CN115883140A (en) | Data security model architecture and data security system | |
| CN115296916A (en) | Zero-trust safety system based on decision tree model | |
| CN113407947A (en) | Trusted connection verification method for mobile terminal user in cloud environment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |