Unified authentication and data authority management and control method and system for big data component

Abstract

The invention provides a unified authentication and data authority management and control method and system for a big data component. The method comprises the steps of performing validity verification on an identity certificate and generating a unified identity token; obtaining an identity token bound with the data access request through the unified identity token; based on the identity token bound with the data access request, performing permission decision through a preset strategy rule to obtain a permission decision result; obtaining an adjusted permission decision result based on the user attribute, the current operation environment and the access mode; embedding the access traceability representation into the adjusted permission decision result to obtain processed structured data; and obtaining an audit record and a compliance report based on a data access request of the user, the adjusted permission decision result and the processed structured data. Based on the user attributes and the real-time operation environment, the authority decision result is dynamically adjusted by using the gradient boosting decision tree and the attention mechanism, so that cross-component unified management is realized, and the problem of authority strategy stiffness is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data security management, in particular to a unified authentication and data permission control method and system for big data components. BACKGROUND

[0002] With the wide application of big data technology, the big data ecology is booming. Data platforms generally integrate Hadoop, Kafka, Flink, Hive, StarRocks open source big data components, etc. Each component has an independent authentication and permission management mechanism, and there is an urgent need for a unified authentication and permission control scheme for big data components to be compatible with multi-component authentication, combined with RBAC and ABAC models, to realize fine-grained access control, data security classification and corresponding strategies.

[0003] Currently, the mainstream big data permission management scheme still has many deficiencies, such as: only applicable to Hadoop ecology, difficult to extend to non-Kerberos components; only applicable to specific components, unable to uniformly manage the permissions of Spark, Flink and other computing engines; only solves the authentication problem, not deeply integrated with the underlying data permissions; mainly for cloud-native services, with limited support for localized big data components. SUMMARY

[0004] In view of the above situation, the main purpose of the present application is to provide a unified authentication and data permission control method and system for big data components to solve the above technical problems.

[0005] The present application provides a unified authentication and data permission control method for big data components, which comprises the following steps: Step 1, receiving the authentication request of the user and the data access request of the user, verifying the identity certificate in the authentication request of the user through the authentication protocol adaptation layer; if the verification is valid, generating a unified identity token; if the verification is invalid, returning an authentication failure response; Step 2, binding the user information in the unified identity token with the data access request of the user to obtain the identity token of the bound data access request; Step 3, obtaining user attributes based on the identity token of the bound data access request, and making permission decisions based on the user attributes through the preset policy rules to obtain permission decision results; Step 4, based on the user attributes, combining the current operation environment and access mode of the user, and performing risk level evaluation on the permission decision results through a learning model to obtain risk level evaluation results, and dynamically adjusting the permission decision results based on the risk level evaluation results to obtain adjusted permission decision results; Step 5, obtaining an access trace representation through the data access request of the user, K-anonymity processing the adjusted permission decision result based on the user attribute, and embedding the access trace representation to obtain the processed structured data; Step 6, obtaining an audit record and a compliance report based on the data access request of the user, the adjusted permission decision result, and the processed structured data.

[0006] The application further provides a unified authentication and data permission management and control system of a big data component, the system comprising: An identity authentication module, configured to: receive an authentication request of a user and a data access request of the user, and perform validity verification on an identity credential in the authentication request of the user through an authentication protocol adaptation layer; if the verification is valid, generate a unified identity token; if the verification is invalid, return an authentication failure response; A permission decision module, configured to: bind user information in the unified identity token with the data access request of the user to obtain an identity token of the bound data access request; obtain user attributes based on the identity token of the bound data access request, and perform permission decision based on the user attributes through a preset strategy rule to obtain a permission decision result; based on the user attributes, combine a current operation environment and an access mode of the user, and perform risk level evaluation on the permission decision result through a learning model to obtain a risk level evaluation result, and perform dynamic adjustment on the permission decision result based on the risk level evaluation result to obtain an adjusted permission decision result A data desensitization module, configured to: obtain an access trace representation through the data access request of the user, K-anonymity process the adjusted permission decision result based on the user attribute, and embed the access trace representation to obtain the processed structured data; An audit tracking module, configured to: obtain an audit record and a compliance report based on the data access request of the user, the adjusted permission decision result, and the processed structured data.

[0007] Compared with the prior art, the application has the following beneficial effects: 1. The application dynamically adjusts the permission decision result based on the user attributes and the real-time operation environment, and uses gradient boosting decision trees and attention mechanisms to realize unified management across components and solve the problem of rigid permission policies; 2. The application embeds access trace information into low-frequency components through Fourier transform and discrete cosine transform to form irreversible characteristic fingerprints, ensuring that leaked data can be accurately traced; 3、The application generates an audit record with an elliptic curve signature based on an event-driven architecture, generates a risk heat map in combination with Elasticsearch log clustering, and stores a hash chain verification information through a blockchain, realizes tamper-proofing and tracing of the whole life cycle of an operation link, and meets the audit demand of a strong compliance scene. BRIEF DESCRIPTION OF DRAWINGS

[0008] Figure 1 A flowchart of a unified authentication and data authority control method of a big data component is provided for the application. Figure 2 A general framework schematic diagram of a unified authentication and data authority control system of a big data component is provided for the application. DETAILED DESCRIPTION

[0009] Embodiments of the application are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference signs represent the same or similar elements or elements with the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the application and cannot be understood as a limitation of the application.

[0010] These and other aspects of embodiments of the application will be apparent from the following description and drawings. In these descriptions and drawings, some specific implementations of embodiments of the application are specifically disclosed to represent some ways in which the principles of embodiments of the application can be implemented, but it should be understood that the scope of embodiments of the application is not limited thereto.

[0011] Please refer to Figure 1 The application embodiment provides a unified authentication and data authority control method of a big data component, which comprises the following steps: Step 1, receiving the authentication request of the user and the data access request of the user, verifying the identity certificate in the authentication request of the user through the authentication protocol adaptation layer; if the verification is valid, generating a unified identity token; if the verification is invalid, returning an authentication failure response; Specifically, in step 1, the authentication protocol adaptation layer contains different authentication protocol modules, such as Kerberos, OAuth, etc.

[0012] Specifically, in step 1, in the process of judging the identity and authority legality of the user when accessing the target component through the authentication gateway, the following expressions exist: ; Among them, The authentication result is True, indicating that the verification is passed, and the authentication result is False, indicating that the verification is invalid; The token validity is The user identity legality is indicates the permission matching result.

[0013] Step 2, binding the user information in the unified identity token with the data access request of the user to obtain a bound data access request identity token.

[0014] Step 3, obtaining user attributes based on the bound data access request identity token, and making a permission decision based on the user attributes through a preset policy rule to obtain a permission decision result. Specifically, in step 3, the user attributes include department, job level, and data sensitivity level.

[0015] Further, in step 3, the preset policy rule is constructed based on the access permission level, wherein the calculation formula of the access permission level is: ; wherein, indicates the access permission level; indicates the decision function of the dynamic policy engine, such as the conditional matching decision function; indicates the decision set to which the user belongs, indicates the user attribute set, indicates the data attribute set; indicates the access environment attribute, such as access time and terminal type.

[0016] Specifically, in step 3, the preset policy rule integrates multi-dimensional factors of user attributes, data attributes, and environment attributes, and is constructed based on role-based access control and attribute-based access control to ensure fine-grained and dynamic access control in a complex and variable big data environment. The policy rule performs initial permission allocation according to user attributes, including department, job level, and data sensitivity level. The rule engine maps the user job level and data sensitivity, determines the accessible data range and operation type according to the access permission level, and the data attributes include data security level and data type. The policy rule imposes corresponding access constraints according to the data security level, and high-security level data needs to meet more stringent access conditions. The policy rule also introduces environment attributes as dynamic decision variables, including terminal device state, real-time geographic location, access time, and network transmission reliability. Through the device trustworthiness level, transmission channel risk value, and spatio-temporal access anomaly degree output by the terminal security baseline management module, the policy rule evaluates the risk level of the access environment in real time. When the environmental risk indicators exceed the preset threshold, the rule triggers access restrictions or enhances the authentication process. The permission decision result is transmitted as input to the learning model for risk level evaluation, and the generated abnormal probability value and threat correlation score are fed back to the policy engine. The policy rule has a built-in risk-permission mapping mechanism, which dynamically adjusts the permission decision result according to the comprehensive risk level, realizes the dynamic upgrade and downgrade of permissions, and in high-risk scenarios, the rule can execute access blocking or data desensitization instructions. The rule engine in the policy rule records the policy version, matching rule and decision result of each permission decision, generates structured logs, and these logs are associated with access requests, user attributes and environmental context to provide basic data for building an audit event graph. The implementation of the policy rule depends on the unified identity token issued by the authentication protocol adaptation layer, which binds user information and access requests. The policy engine parses the token to obtain user attributes and then performs rule matching. The rule matching process uses a conditional reasoning mechanism to evaluate whether user attributes, data attributes and environmental attributes meet rule conditions layer by layer, and finally outputs a permission decision result.

[0017] Step 4, based on user attributes, combined with the user's current operating environment and access mode, the risk level of the permission decision result is evaluated by the learning model to obtain a risk level evaluation result, and the permission decision result is dynamically adjusted based on the risk level evaluation result to obtain an adjusted permission decision result; In step 4, based on user attributes, combined with the user's current operating environment and access mode, the risk level of the permission decision result is evaluated by the learning model to obtain a risk level evaluation result, and the permission decision result is dynamically adjusted based on the risk level evaluation result to obtain an adjusted permission decision result, the specific steps are as follows: The user terminal device state, real-time geographic location, access time and historical operation record are obtained through the user's current operating environment and access mode; Based on the user terminal device state, real-time geographic location, access time, historical operation record and permission decision result, the device security baseline, network transmission reliability and spatio-temporal compliance are analyzed and processed in three dimensions through terminal security baseline management to generate a structured environment vector; The historical access log and current data operation type are obtained from the historical operation record, a baseline model is constructed based on the historical access log, an abnormal probability value is generated based on the current data operation type and target data level using the baseline model, and an operation rule identifier is obtained based on the abnormal probability value and the current data operation type and user attributes; Obtain a real-time risk intelligence library from a network security information sharing platform, based on the real-time risk intelligence library and an enterprise security event feature library, perform threat correlation analysis through the Talos threat intelligence center to obtain a threat correlation analysis result, and based on the threat correlation analysis result, perform pattern matching in combination with request parameter features in a user's authentication request to output a threat correlation degree score; Use gradient boosting decision trees to fuse the structured environment vector, anomaly probability value, operation rule identifier and threat correlation degree score according to weight distribution to obtain a weight fusion result, and based on the weight fusion result, perform processing through an attention mechanism network to obtain a comprehensive risk level; Based on the weight decision result and the comprehensive risk level, construct a risk-privilege mapping rule library, and use the risk-privilege mapping rule library to output an adjusted privilege decision result.

[0018] Specifically, in step 4, the terminal security baseline management is used to perform three-dimensional correlation analysis and processing on the device security baseline, network transmission reliability and space-time compliance, and a structured environment vector is generated; the structured environment vector includes device trust level, transmission channel risk value and space-time access anomaly degree.

[0019] Step 5, obtain an access trace representation through a user's data access request, perform K-anonymization processing on the adjusted privilege decision result based on user attributes and embed the access trace representation to obtain processed structured data; In step 5, an access trace representation is obtained through an access request, K-anonymization processing is performed on the adjusted privilege decision result based on user attributes and the access trace representation is embedded to obtain processed structured data, and the specific steps are as follows: Based on user attributes, obtain user job level privilege parameters and data sensitivity levels, cross-validate the user job level privilege parameters and data sensitivity levels to obtain cross-validation results, based on the cross-validation results, construct a two-dimensional evaluation model through field semantic analysis technology, and output a field mapping table through the two-dimensional evaluation model; the two-dimensional evaluation model performs evaluation processing on input data from two dimensions of data correlation characteristics and business awareness range; Based on the current access environment risk indicators, detect the cross-field association risk of the field mapping table and the current access environment risk indicators in real time through dynamic data desensitization to obtain real-time detection results, and based on the real-time detection results, dynamically adjust the desensitization strength to generate a desensitization strategy instruction set; Based on the identity token bound to the data access request, obtain a data access result, and based on the desensitization strategy instruction set, perform clustering and generalization joint processing on the data access result to obtain an anonymized data set; The user session feature vector and the timestamp sequence are obtained by accessing the traceability representation, the user session feature vector and the timestamp sequence after Fourier frequency domain transformation are convoluted to generate irreversible feature fingerprint spectrum features, the feature dimension of the anonymized data set is aligned to obtain an aligned anonymized data set, the irreversible feature fingerprint spectrum features are embedded into the low-frequency components of the aligned anonymized data set through discrete cosine transformation, and structured data is generated; The structured data is extracted to obtain a hash digest and a permission decision audit log, the hash digest and the permission decision audit log are blinded through homomorphic encryption technology to generate hash chain structure verification information, and the hash chain structure verification information is layered into the adjusted permission decision result through a zero-knowledge proof mechanism to obtain processed structured data.

[0020] Specifically, in step 5, based on the cross-validation result, a two-dimensional evaluation model is constructed through field semantic analysis technology, wherein the field semantic analysis technology specifically includes the following sub-steps: The field name and content in the cross-validation result are word vector modeled to construct a semantic feature space; Based on the semantic feature space, a graph neural network is used to obtain context association features between fields to identify potential combinations forming a user portrait, wherein the context association features include co-occurrence patterns, transition probabilities, etc. After aligning the context association features with the neighborhood knowledge base, the knowledge graph embedding technology is used for semantic disambiguation processing of professional terms, private association strength calculation, and risk transmission path verification processing to obtain a two-dimensional evaluation model, wherein the two-dimensional evaluation model can be evaluated from the semantic dimension and the statistical dimension.

[0021] Specifically, in step 5, the data access result is clustered and generalized jointly based on the desensitization strategy instruction set to obtain an anonymized data set, wherein the specific steps of the clustering and generalization joint processing are as follows: Based on the desensitization strategy instruction set, the data access result is attribute weight clustered to obtain an attribute weight clustering result; the attribute weight clustering result is used to dynamically adjust the attribute generalization threshold and output the attribute clustering rule based on the current access environment risk index, so as to ensure that the core field meets the basic requirement of K-anonymity; Based on the data access result, a data distribution feature is obtained, and a virtual node consistent with the data distribution feature is generated through the field semantic constraint rule embedded in the desensitization strategy instruction set; Based on the attribute clustering rule and the virtual node, a grouping structure with cross-field association protection capability is constructed, which blocks attribute reasoning chains while maintaining data usability, and forms a dynamic protection system adapted to the current access environment risk index.

[0022] Specifically, in step 5, the irreversible feature fingerprint spectrum feature is embedded into the low-frequency component of the aligned anonymized dataset by discrete cosine transform to generate structured data, wherein the specific steps of the discrete cosine transform are as follows: The aligned anonymized dataset is subjected to frequency band energy analysis processing, and then dynamically segmented according to the high-frequency band and the low-frequency band to obtain a segmented sub-band; Based on the energy distribution parameters in the user session feature vector, an adaptive quantization matrix is established, and based on the adaptive quantization matrix, the irreversible feature fingerprint spectrum feature is embedded into the low-frequency sub-band of the segmented sub-band to obtain a frequency domain watermark template; The timestamp sequence hash digest and access path marker in the frequency domain watermark template are subjected to frequency domain interleaving processing using orthogonal coding technology to generate structured data.

[0023] Further, in step 5, the calculation formula of the desensitization strength is: ; Among them, represents the desensitization strength, the larger the value, the more complete the desensitization; and both represent weight coefficients, and the sum of the two is 1; represents the data security level, when the data security level is 1, the value is 1, when the data security level is 2, the value is 2, when the data security level is 3, the value is 3, and when the data security level is 4, the value is 4; represents the data sensitivity coefficient.

[0024] Specifically, in step 5, the core idea of homomorphic encryption is to perform a specific form of algebraic operation on ciphertext, and the operation result decrypted is consistent with the result obtained by performing the same operation on plaintext; In this step, the hash digest and the permission decision audit log are blinded by homomorphic encryption technology to generate hash chain structure verification information, so as to realize verifiability while ensuring data privacy.

[0025] Step 6, based on the user's data access request, the adjusted permission decision result and the processed structured data, to obtain an audit record and a compliance report; In step 6, based on the user's data access request, the adjusted permission decision result and the processed structured data, to obtain an audit record and a compliance report, the specific steps are as follows: Through the knowledge graph, the operation type in the user's data access request is associated with the policy change node in the adjusted permission decision result to construct a triple relationship audit event graph; Based on the GDPR compliance template, the compliance template is converted into executable logical assertions by Drools, the executable logical assertions are loaded into the audit event graph of the ternary relationship based on the data sensitivity level in the user attribute, and the audit rule set is generated; The nodes in the audit event graph are logically bound with the audit rule set by using the event-driven architecture to obtain the compliance verification logic chain, and the compliance of the compliance verification logic chain is verified based on the access trace representation, and the audit record is obtained by using the elliptic curve digital signature method after the verification is passed; Based on the user attribute, the risk heat map is generated by Elasticsearch log clustering based on the permission change event in the audit record; based on the risk heat map, the complete operation link is obtained through the Neo4j graph query interface; based on the complete operation link, the compliance report is generated by using the digital watermark technology combined with the verification record in the audit record.

[0026] Specifically, in step 6, the operation type in the user's data access request is associated with the policy change node in the adjusted permission decision result by using the knowledge graph to construct the audit event graph of the ternary relationship; wherein the audit event graph of the ternary relationship contains the ternary relationship of operation, strategy and risk.

[0027] Further, in step 6, when constructing the "compliance verification logic chain", the nodes (user operation, permission change, policy change) in the audit event graph and the generated audit rule set are bound to the blockchain for storage. Due to the tamper-proof nature of the blockchain, it can ensure that the data trace in the entire audit process is reliable and not affected by malicious attacks or human tampering; Each operation node (user authentication request, adjusted permission decision result) is embedded in the logic chain by the event-driven architecture to form a complete event track, and the logic chain formed can automatically verify the legality of the operation; When generating the audit record, the audit record is signed by using the elliptic curve digital signature method, and the signature hash value is stored on the blockchain to ensure the authenticity of the content and the reliability of the source.

[0028] Further, in step 6, the event-driven architecture realizes asynchronous communication and loosely coupled system interaction through event capture, transmission and processing, specifically: When the operation behavior such as user access request, permission adjustment or policy change occurs in the system, an event is generated, and then the event is published to the event stream; The event publisher is decoupled from the event consumer, the event publisher is responsible for generating and sending events, and the event consumer is responsible for processing the events, the event publisher and the event consumer interact through an event bus or a message queue, and the consumer module independently performs logical processing after receiving the events; The consumer module triggers corresponding logical operations according to the received events, such as updating an audit event graph, generating an audit rule set, and binding a compliance verification logic chain, and through a streaming processing technology, the events can be analyzed and processed in real time; The event publisher specifically includes: publishing user access events when a user submits an access; publishing permission decision update events when a permission decision result is updated; and publishing rule set update events when logical assertions are generated based on a GDPR template; The event consumer specifically includes: dynamically associating operation types, policy change nodes, and an audit event graph of updating a three-element relationship; loading executable logical assertions into the audit event graph and generating an audit rule set; verifying in combination with user request trace information; and generating audit records using elliptic curve digital signatures.

[0029] Please refer to Figure 2 The application embodiment further provides a unified authentication and data permission management and control system of a big data component, the system comprises: An identity authentication module, configured to: receive an authentication request of a user and a data access request of the user, and perform validity verification on identity credentials in the authentication request of the user through an authentication protocol adaptation layer; if the verification is valid, generate a unified identity token; if the verification is invalid, return an authentication failure response; A permission decision module, configured to: bind user information in the unified identity token with the data access request of the user to obtain an identity token of the bound data access request; obtain user attributes based on the identity token of the bound data access request, and perform permission decision based on the user attributes through preset policy rules to obtain a permission decision result; based on the user attributes, combine a current operation environment and an access mode of the user, and perform risk level evaluation on the permission decision result through a learning model to obtain a risk level evaluation result, and dynamically adjust the permission decision result based on the risk level evaluation result to obtain an adjusted permission decision result A data desensitization module, configured to: obtain an access trace representation through the data access request of the user, perform K-anonymity processing on the adjusted permission decision result based on the user attributes and embed the access trace representation to obtain processed structured data; An audit tracking module, configured to: Based on the user's data access request, the adjusted permission decision result, and the processed structured data, to obtain an audit record and a compliance report.

[0030] It should be understood that various parts of the present application can be realized in hardware, software, firmware or a combination thereof. In the above-described embodiments, a plurality of steps or methods can be realized by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if realized in hardware, and as in another embodiment, any one or a combination of the following technologies known in the art can be used: discrete logic circuit with logic gate circuit for implementing logic functions on data signals, application specific integrated circuit with suitable combination logic gate circuit, programmable gate array (PGA), field programmable gate array (FPGA), etc.

[0031] In the description of the present specification, the description of the terms "one embodiment", "some embodiments", "an example", "a specific example", or "some examples" and the like means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In the present specification, the illustrative description of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0032] The above-described embodiments only express several implementation manners of the present application, which are described in a more specific and detailed manner, but cannot be understood as a limitation on the scope of the patent of the present application. It should be noted that, for those skilled in the art, several modifications and improvements can be made without departing from the concept of the present application, which are all within the protection scope of the present application. Therefore, the protection scope of the patent of the present application should be subject to the appended claims.

Claims

1. A method for unified authentication and data authority management of big data components, characterized in that: The method comprises the following steps: Step 1: Receive the user's authentication request and the user's data access request, and verify the validity of the identity credentials in the user's authentication request through the authentication protocol adaptation layer; If the verification is valid, a unified identity token is generated; If the verification is invalid, an authentication failure response is returned; Step 2: Bind the user information in the unified identity token with the user's data access request to obtain an identity token bound to the data access request; Step 3: Obtain user attributes based on the identity token bound to the data access request, make permission decisions based on the user attributes and obtain permission decision results according to preset policy rules; Step 4: Based on the user attributes, combined with the user's current operating environment and access mode, the permission decision result is evaluated for risk level through the learning model to obtain a risk level evaluation result. The permission decision result is dynamically adjusted based on the risk level evaluation result to obtain an adjusted permission decision result. Step 5: Obtain access traceability representation through the user's data access request. Perform K-anonymization on the adjusted permission decision results based on user attributes and embed the access traceability representation to obtain processed structured data. Step 6: Based on the user's data access request, the adjusted permission decision results, and the processed structured data, audit records and compliance reports are obtained.

2. A method for unified authentication and data authority management of big data components according to claim 1, characterized in that: In step 4, based on the user attributes, combined with the user's current operating environment and access mode, the permission decision result is evaluated for risk level through the learning model to obtain a risk level evaluation result. Based on the risk level evaluation result, the permission decision result is dynamically adjusted to obtain an adjusted permission decision result. The specific steps are as follows: Obtain user terminal device status, real-time geographic location, access time, and historical operation records based on the user's current operating environment and access mode; Based on the user's terminal device status, real-time geographic location, access time, historical operation records, and permission decision results, terminal security baseline management performs correlation analysis on three dimensions: device security baseline, network transmission reliability, and spatiotemporal compliance to generate a structured environment vector. Obtain historical access logs and current data operation types from historical operation records, and build a baseline model based on the historical access logs; use the baseline model to generate anomaly probability values ​​based on the current data operation type and target data level; Based on the abnormal probability value, the operation rule identification is obtained according to the current data operation type and user attributes; Obtain a real-time risk intelligence database from the cybersecurity information sharing platform. Based on the real-time risk intelligence database and the enterprise security event signature database, conduct threat correlation analysis through the Talos Threat Intelligence Center to obtain threat correlation analysis results. Based on the threat correlation analysis results, pattern matching is performed in combination with the request parameter features in the user's authentication request to output a threat correlation score; Using the gradient boosting decision tree, the structured environment vector, anomaly probability value, operation rule identifier and threat correlation score are fused according to weight distribution to obtain the weighted fusion result; Based on the weight fusion results, it is processed through the attention mechanism network to obtain the comprehensive risk level; Based on the weighted decision results and comprehensive risk levels, a risk-authority mapping rule base is constructed, and the risk-authority mapping rule base is used to output the adjusted authority decision results.

3. A method for unified authentication and data authority management of big data components according to claim 2, characterized in that: Terminal security baseline management performs correlation analysis on three dimensions: device security baseline, network transmission reliability, and spatiotemporal compliance, and generates a structured environment vector. The structured environment vector includes the device credibility level, transmission channel risk value, and spatiotemporal access anomaly.

4. A method for unified authentication and data authority management of big data components according to claim 3, characterized in that: In step 5, the access traceability representation is obtained through the user's data access request. The adjusted permission decision result is K-anonymized based on the user's attributes and embedded in the access traceability representation to obtain processed structured data. The specific steps are as follows: Based on user attributes, user rank and permission parameters and data sensitivity levels are obtained, and cross-validated to obtain cross-validation results. Based on the cross-validation results, a two-dimensional evaluation model is constructed using field semantic analysis technology, and a field mapping table is output through the two-dimensional evaluation model. The two-dimensional evaluation model evaluates input data based on two dimensions: data association characteristics and business awareness scope. Based on the user's current operating environment, the current access environment risk indicators are extracted. Through dynamic data desensitization, the cross-field correlation risk between the field mapping table and the current access environment risk indicators is detected in real time to obtain real-time detection results. Based on the real-time detection results, the desensitization intensity is dynamically adjusted to generate a desensitization policy instruction set. The data access results are obtained based on the identity token bound to the data access request, and the data access results are clustered, generalized and jointly processed based on the desensitization policy instruction set to obtain an anonymized data set; The user session feature vector and timestamp sequence are obtained by accessing the traceability representation. The user session feature vector after Fourier frequency domain transformation is convolved with the timestamp sequence to generate irreversible feature fingerprint spectrum features. The feature dimensions of the anonymized dataset are aligned to obtain an aligned anonymized dataset. The irreversible feature fingerprint spectrum features are embedded into the low-frequency components of the aligned anonymized dataset through discrete cosine transform to generate structured data. The structured data is extracted to obtain hash summaries and permission decision audit logs, which are then blinded using homomorphic encryption technology to generate hash chain structure verification information. The hash chain structure verification information is layered and injected into the adjusted permission decision results through a zero-knowledge proof mechanism to obtain processed structured data.

5. A method for unified authentication and data authority management of big data components according to claim 4, characterized in that: Based on the cross-validation results, a two-dimensional evaluation model is constructed using field semantic analysis technology. The field semantic analysis technology specifically includes the following sub-steps: Perform word vector modeling on the field names and contents in the cross-validation results to construct a semantic feature space; Based on the semantic feature space, graph neural network is used to obtain contextual association features between fields; After aligning the context-related features with the neighborhood knowledge base, knowledge graph embedding technology is used to perform semantic disambiguation of professional terms, calculate privacy association strength, and verify risk transmission paths to obtain a two-dimensional evaluation model.

6. A method for unified authentication and data authority management of big data components according to claim 5, characterized in that: Based on the desensitization strategy instruction set, the data access results are clustered and generalized to obtain an anonymized data set. The specific steps of clustering and generalization joint processing are as follows: Based on the desensitization policy instruction set, the data access results are clustered by attribute weights to obtain attribute weight clustering results. Based on the attribute weight clustering results and the current access environment risk index, the attribute generalization threshold is dynamically adjusted and attribute clustering rules are output to ensure that the core fields meet the basic requirements of K-anonymity. Based on the data access results, the data distribution characteristics are obtained, and virtual nodes that match the data distribution characteristics are generated through the field semantic constraint rules embedded in the desensitization policy instruction set; Based on attribute clustering rules and virtual nodes, a grouping structure with cross-field association protection capabilities is constructed. While maintaining the general blocking attribute reasoning chain of data availability, a dynamic protection system adapted to the current access environment risk indicators is formed.

7. A method for unified authentication and data authority management of big data components according to claim 6, characterized in that: Through discrete cosine transform, the irreversible feature fingerprint spectrum features are embedded in the low-frequency components of the aligned anonymized dataset to generate structured data. The specific steps of discrete cosine transform are as follows: Perform frequency band energy analysis on the aligned anonymized dataset, and then dynamically segment the aligned anonymized dataset according to high-frequency bands and low-frequency bands to obtain segmented subbands. Based on the energy distribution parameters in the user session feature vector, an adaptive quantization matrix is ​​established. Based on the adaptive quantization matrix, the irreversible characteristic fingerprint spectrum features are embedded in the low-frequency sub-band of the segmented sub-band to obtain a frequency domain watermark template; Orthogonal coding technology is used to perform frequency domain interleaving on the timestamp sequence hash summary and access path mark in the frequency domain watermark template to generate structured data.

8. A method for unified authentication and data authority management of big data components according to claim 7, characterized in that: In step 6, based on the user's data access request, the adjusted permission decision result, and the processed structured data, an audit record and a compliance report are obtained. The specific steps are as follows: Through the knowledge graph, the operation type in the user's data access request is associated with the policy change node in the adjusted permission decision result to construct an audit event graph of ternary relationships; Obtain compliance templates based on GDPR and use Drools to convert compliance templates into executable logical assertions. Based on the data sensitivity level in user attributes, these executable logical assertions are loaded into the audit event graph of ternary relationships to generate an audit rule set. Using an event-driven architecture, nodes in the audit event graph are logically bound to the audit rule set to obtain a compliance verification logic chain; Based on the access traceability representation, the compliance of the compliance verification logic chain is verified. After the verification is passed, the audit record is obtained using the elliptic curve digital signature method; Based on user attributes, we use permission change events in audit records to generate risk heat maps through Elasticsearch log clustering. Based on the risk heat map, the complete operation chain is obtained through the Neo4j graph query interface; Based on the complete operation chain and combined with the verification records in the audit records, a compliance report is generated using digital watermark technology.

9. A method for unified authentication and data authority management of big data components according to claim 8, characterized in that: Through the knowledge graph, the operation type in the user's data access request is associated with the policy change node in the adjusted permission decision result to construct an audit event graph of a ternary relationship; among them, the audit event graph of a ternary relationship contains a ternary relationship of operation, policy and risk.

10. A unified authentication and data authority management system for big data components, characterized in that: The system applies a unified authentication and data authority management method for a big data component according to any one of claims 1 to 9, and the system includes: Identity authentication module, used to: Receive the user's authentication request and the user's data access request, and verify the validity of the identity credentials in the user's authentication request through the authentication protocol adaptation layer; if the verification is valid, generate a unified identity token; if the verification is invalid, return an authentication failure response; Permission decision module, used to: Bind the user information in the unified identity token with the user's data access request to obtain an identity token bound to the data access request; Obtain user attributes based on the identity token bound to the data access request, make permission decisions based on the user attributes and obtain the permission decision results through preset policy rules; Based on user attributes, combined with the user's current operating environment and access mode, the permission decision result is evaluated for risk level through the learning model to obtain the risk level evaluation result. Based on the risk level evaluation result, the permission decision result is dynamically adjusted to obtain the adjusted permission decision result. Data desensitization module, used for: Obtain access traceability representation through the user's data access request. Perform K-anonymization on the adjusted permission decision results based on user attributes and embed the access traceability representation to obtain processed structured data. Audit trail module for: Based on the user's data access request, the adjusted permission decision results and the processed structured data, audit records and compliance reports are obtained.

Images