Self-adaptive transformation and migration method and system for internal website

Abstract

The invention provides a self-adaptive transformation and migration method and system for an internal website, and relates to the technical field of website migration. Comprising the following steps: constructing a hierarchical credential adaptation architecture, establishing a dynamic authority-data mapping mechanism, realizing knowledge base-data migration linkage and deploying an adaptive security protection chain. The method is used for realizing collaborative improvement of compatibility, security and knowledge service efficiency of an internal website in a credential environment through hierarchical credential adaptation, dynamic permission and data association, knowledge base linkage and self-adaptive security protection; besides, through cooperative work of the hardware driving adaptation module and the software interface conversion module, automatic identification of hardware features and interface features, precise analysis of adaptation requirements and dynamic generation of configuration files are realized. The compatibility of an internal website to different models of servers, autonomous controllable components and software interfaces in a credential environment is remarkably improved, the adaptation period is shortened, and stable operation of the system is guaranteed.

Description

Technical Field

[0001] This invention relates to the field of website migration technology, and in particular to a method and system for adaptive transformation and migration of internal websites. Background Technology

[0002] With the deepening of the national strategy for innovation in information technology applications, the need for various organizations to upgrade and migrate their internal websites using domestically developed IT solutions is becoming increasingly urgent. However, in current technological practices, the upgrade and migration of internal websites faces several core challenges, including heterogeneous environment compatibility, permission and data security mapping, knowledge service collaboration, and end-to-end security protection.

[0003] While existing technologies have received some research, the following shortcomings remain: 1. Static limitations in adapting to the domestic IT innovation environment: Over-reliance on manual configuration of adaptation rules for hardware driver differences among different models of domestically produced servers and the heterogeneity of software interfaces for independently controllable components leads to high costs and lengthy deployment cycles for heterogeneous device compatibility, making it difficult to efficiently address the diverse hardware and software adaptation needs in the domestic IT innovation environment. 2. Risks of lagging permission and data mapping: During historical data migration, there is a disconnect between user role permissions and data association management. Permission configuration cannot be mapped to data during migration in real time, resulting in insufficient security and flexibility in data access. This can easily lead to risks such as improper permission allocation, leakage of sensitive data, or restricted access for legitimate users, failing to meet the stringent requirements for data security control in the domestic IT innovation environment. 3. Lack of collaboration between knowledge base and data migration: Data migration and knowledge service construction processes are separated, lacking an effective linkage mechanism. The extraction, classification, and semantic annotation of structured business information and unstructured documents rely excessively on manual operations or offline tools, resulting in a lag in knowledge unit generation. Furthermore, the independent knowledge base is not integrated with the website's access control system, and there is a lack of differentiated control over knowledge access for different roles, which not only reduces the accuracy of knowledge services but also poses a potential risk of sensitive knowledge leakage. Fourth, the security protection chain suffers from breakpoints: security protection modules operate independently, failing to form a collaborative protection system, making it difficult to guarantee the end-to-end security of the internal website under the new information technology environment.

[0004] Therefore, in view of the shortcomings of the existing technologies, there is an urgent need for an adaptive transformation and migration method that can achieve synergistic improvement in compatibility, security and knowledge service efficiency of internal websites in the context of information technology innovation. Summary of the Invention

[0005] The main objective of this invention is to provide a method and system for adaptive transformation and migration of internal websites, solving the technical problems in the prior art, such as static adaptation to the information technology innovation environment, lagging permission-data mapping, lack of knowledge base and migration collaboration, and breakpoints in the security protection chain.

[0006] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is: a method for adaptive transformation and migration of internal websites, comprising the following steps: S1. Construct a layered domestic IT innovation adaptation architecture: Build the underlying domestic IT innovation environment based on server operating system, database and middleware. Through the environment adaptation layer, dynamically load hardware driver adaptation module and software interface conversion module to realize automatic identification and compatibility configuration of different models of servers and independently controllable components. S2. Establish a dynamic permission-data mapping mechanism: During the historical data migration process, the original website user role permission data is extracted through the permission parsing module, and a permission-data association graph is generated by combining the preset multi-level permission rules. The migration tool performs hierarchical marking of historical data according to the permission-data association graph, and synchronously completes data encryption storage and access permission binding. S3. Implement knowledge base-data migration linkage: During data migration, start the intelligent indexing engine to automatically extract, classify and semantically annotate the structured business information and unstructured document content in the migrated data, generate knowledge units and write them into the independent knowledge base of intelligent customer service in real time. The independent knowledge base is linked with the website user permission system and only opens the matching knowledge units to the corresponding permission roles. S4. Deploy an adaptive security protection chain: Integrate a unified identity authentication interface and a dynamic encryption module. When a user logs in, multi-factor authentication and dynamic generation of session keys are triggered. During data transmission, a differentiated encryption strategy based on access roles is adopted. Sensitive operation logs are synchronized to the security audit center in real time, forming an adaptive protection throughout the entire process from identity verification to data transmission and operation auditing.

[0007] In the preferred scheme, automatic identification and compatibility configuration of different server models and independently controllable components are achieved, including: capturing hardware features in real time based on the hardware driver adaptation module, generating a hardware adaptation requirement list after comparing with the fingerprint database, and automatically matching and loading the adapted hardware adaptation configuration file from the dynamic module pool. Based on the interface call logs of the software interface conversion module, parameter features are extracted to generate software interface conversion rules. Adaptive components in the interface conversion plugin library are called to perform protocol conversion and format mapping on the software interface and generate an interface adaptation configuration file. Based on the aforementioned hardware adaptation configuration file and interface adaptation configuration file, automatic identification and compatibility configuration are achieved.

[0008] In the preferred embodiment, the generation of the permission-data association graph includes: The time decay rules and spatial constraints of user role permissions are preset. The original website role permission data and historical operation audit logs are mined through the permission parsing module to extract static permission items and dynamic permission association features, and the initial node and edge structure of the permission-data association graph is constructed. By labeling data resources with sensitivity levels and operation behavior types, and combining user role levels, a three-dimensional association dimension system is constructed for the permission-data association graph, and a permission strength coefficient is assigned to each association edge. During the historical data migration process, the graph incremental update engine is launched simultaneously: when new data is added, the associated permissions are automatically deduced based on the permission inheritance rules of similar data, new associated edges are generated and marked as pending verification status; when the data structure changes, the permission adaptation analysis process is triggered to update the permission mapping relationship of associated nodes. After the data migration is completed, a simulation test is conducted using virtual characters to verify the validity of the graph associations and remove invalid association edges.

[0009] In a preferred embodiment, the data structure includes field addition, deletion, and / or type adjustment.

[0010] In the preferred scheme, structured business information and unstructured document content in the migration data are automatically extracted, classified, and semantically annotated to generate knowledge units, including: Synchronously access structured business information and unstructured document content from the migration data, and, in conjunction with the source system identifier of the migration data, start the classification adaptation learner: The system automatically categorizes data based on the matching degree between the field features of structured data and the classification tree nodes, generating initial classification labels. It also dynamically adjusts the classification level based on the semantic similarity between the cross-modal feature set of unstructured data and the classification tree nodes. The categorized structured fields and unstructured feature sets are mapped to a predefined domain knowledge graph, where structured data is labeled at the field level and unstructured data is labeled at the fragment level. For new entities that do not match, the entity discovery module is activated to generate temporary entity nodes. After manual confirmation, these nodes are updated to the knowledge graph, and the classification tags and semantic annotation results are integrated to generate knowledge units containing core information blocks, related graph fragments, and access permission identifiers.

[0011] In the preferred scheme, multi-factor authentication and dynamic generation of session keys are triggered when a user logs in, including: When the multi-factor authentication process is initiated, a user routine matrix is ​​generated based on the user terminal type, login network environment, and historical login behavior characteristics to determine the authentication factor combination. The validity verification results of the authentication factors are then synchronized in real time through the unified identity authentication interface. The matrix expression is as follows: ; in, This indicates the number of pre-defined, defensible attack types within the current timeframe of the logged-in network environment; This indicates the number of attack defense types configured for the login network environment; This indicates the number of attacks that do not fall under the pre-defined defendable attack types during the current time period when logging into the network environment; This represents the security gain coefficient based on historical login behavior characteristics; This represents the attack probability based on the terminal type; N represents a random number, and is a positive integer greater than 1. Symbol for random function; A unique session key is generated based on the authentication factor combination, and the unique session key is bound to the authenticated user session in real time, with the key lifecycle dynamically related to the duration of the user session. Based on the user's access permission level and the sensitivity of the object being operated on, the dynamic encryption module automatically adjusts the encryption algorithm strength of the session key and updates the encryption strategy in real time through permission change information fed back by the unified identity authentication interface.

[0012] In a preferred embodiment, a unique session key is generated based on the authentication factor combination, including the generation of a first encryption factor; Obtain the behavior feature map of the historical login behavior characteristics, and perform interference processing on the random single local unit blocks of the behavior feature map. At the same time, scramble the single local unit blocks that have not been interfered with to obtain the first fake map. The first fake graph is divided into double local unit blocks, and the current fake combination of each double local unit block is constructed to predict the corresponding historical fake coefficient. All spurious coefficients are randomly sorted and linearly fitted to obtain the first fitted coefficients and the fitting constant. At the same time, the average rate of change based on all spurious coefficients is obtained. The final spurious coefficient of the first spurious graph is obtained by multiplying the average rate of change by the first fitting coefficient and adding it to the fitting constant. Common login types and uncommon login types are extracted from the historical login behavior characteristics, and one login type is randomly extracted from each of the common login types and uncommon login types to obtain a combined login type; Based on the mapping relationship coefficient between each double local unit block and the combined login type, and combined with the coefficient difference between the corresponding historical false coefficient and the final false coefficient, two rational numbers of the double local unit block are generated, and a behavior feature matrix based on the first false graph is randomly assigned. A second encryption factor is generated based on the eigenvectors of the behavioral feature matrix; A unique session key is generated based on the first encryption factor and the second encryption factor.

[0013] In the preferred embodiment, generating a unique session key based on the authentication factor combination specifically involves: The authentication process of the authentication factor combination is broken down into authentication steps, the mathematical combination of each segment is identified, and the global participation ratio of each mathematical variable in the mathematical combination is determined. Combined with the maximum ratio of the individual participation ratio of each mathematical variable, the global participation ratio and the maximum ratio of the same mathematical variable are calculated according to a random calculation method in a predefined dynamic calculation set. A false value is set for the corresponding mathematical variable, and the first encryption factor is generated.

[0014] In the preferred scheme, differentiated encryption based on access roles during data transmission includes: A multi-dimensional role permission matrix is ​​preset, including role level and corresponding sensitive data access scope, and a data sensitivity level mapping table is established. The role permission parsing module dynamically associates the user's access role with the data sensitivity level. When a user initiates a data transmission request, the encryption strategy engine extracts the user's role information and the sensitivity level of the plaintext to be transmitted in real time, and automatically matches the first encryption scheme according to the preset association model. The system pre-defines the association rules between user access roles and data sensitivity, and generates dynamic encrypted tuples in real time, including an initial scrambling sequence and multiple rounds of iterative offsets. The entropy of the initial scrambling sequence increases non-linearly with the product of role permissions and data sensitivity. Construct a curve function for multi-round iterative offsets, and perform periodic decomposition on the curve function to obtain the offset state in each period; The first n1 offset states are transformed to obtain the first integrated state, and the plaintext parameters of each remaining state are set according to the first integrated state to construct a new plaintext. The plaintext to be transmitted is phase-interleaved with the initial scrambling sequence in the dynamic encryption tuple to generate the first round of intermediate data. The first round of intermediate data is superimposed with dynamic round scrambling code and plaintext code randomly extracted from the new plaintext. The self-updating replacement matrix is ​​input to perform position inverse recombination to obtain encrypted ciphertext, and the transmission channel is encrypted in combination with the first encryption scheme. During data transmission, if the role and permission resolution module detects a temporary change in the user's role, the encryption policy engine immediately interrupts the current transmission, re-matches the encryption scheme according to the new role and permissions, generates a new key, and synchronizes it to the receiving end through the encryption channel. Then, it resumes transmission and marks the boundary between the data packets before and after the permission change.

[0015] Secondly, the present invention provides a system for adaptive modification and migration of internal websites, comprising: A layered information technology innovation adaptation architecture module is constructed to build the underlying information technology innovation environment based on server operating system, database and middleware. The hardware driver adaptation module and software interface conversion module are dynamically loaded through the environment adaptation layer to realize automatic identification and compatibility configuration of different models of servers and independently controllable components. A dynamic permission-data mapping mechanism module is established to extract user role permission data from the original website through the permission parsing module during the historical data migration process. Combined with preset multi-level permission rules, a permission-data association graph is generated. The migration tool uses the permission-data association graph to hierarchically mark the historical data and simultaneously completes data encryption storage and access permission binding. The knowledge base-data migration linkage module is implemented to start the intelligent indexing engine during data migration, automatically extract, classify and semantically annotate the structured business information and unstructured document content in the migrated data, generate knowledge units and write them into the independent knowledge base of the intelligent customer service in real time. The independent knowledge base is linked with the website user permission system and only opens the matching knowledge units to the corresponding permission roles. Deploy an adaptive security protection chain module to integrate a unified identity authentication interface and a dynamic encryption module. When a user logs in, multi-factor authentication and dynamic generation of session keys are triggered. During data transmission, a differentiated encryption strategy based on access roles is adopted, and sensitive operation logs are synchronized to the security audit center in real time, forming a full-process adaptive protection from identity verification to data transmission and operation auditing.

[0016] This invention provides a method and system for adaptive transformation and migration of internal websites, including: constructing a layered domestic IT innovation adaptation architecture, establishing a dynamic permission-data mapping mechanism, realizing knowledge base-data migration linkage, and deploying an adaptive security protection chain. This invention aims to achieve a synergistic improvement in the compatibility, security, and knowledge service efficiency of internal websites in the domestic IT innovation environment through layered domestic IT innovation adaptation, dynamic permission and data association, knowledge base linkage, and adaptive security protection. Furthermore, through the collaborative work of the hardware driver adaptation module and the software interface conversion module, it achieves automatic identification of hardware and interface features, accurate analysis of adaptation requirements, and dynamic generation of configuration files, significantly improving the compatibility of internal websites with different server models, independently controllable components, and software interfaces in the domestic IT innovation environment, shortening the adaptation cycle, and ensuring stable system operation. Attached Figure Description

[0017] The present invention will be further described below with reference to the accompanying drawings and embodiments: Figure 1 This is a flowchart of the adaptive modification and migration method of the present invention. Detailed Implementation

[0018] Example 1 like Figure 1 As shown, a method for adaptive transformation and migration of internal websites includes the following steps: S1: Construct a layered domestic IT innovation adaptation architecture: Build the underlying domestic IT innovation environment based on server operating system, database and middleware, and dynamically load hardware driver adaptation module and software interface conversion module through environment adaptation layer to realize automatic identification and compatible configuration of different models of servers and independently controllable components.

[0019] S2: Establish a dynamic permission-data mapping mechanism: During the historical data migration process, the permission parsing module extracts the user role permission data of the original website, and generates a permission-data association graph by combining it with the preset multi-level permission rules. The migration tool classifies and marks the historical data according to the permission-data association graph, and simultaneously completes the data encryption storage and access permission binding.

[0020] S3: Implement knowledge base-data migration linkage: During data migration, the intelligent indexing engine is activated to automatically extract, classify and semantically annotate the structured business information and unstructured document content in the migrated data, generate knowledge units and write them into the independent knowledge base of the intelligent customer service in real time. The independent knowledge base is linked with the website user permission system and only opens the matching knowledge units to the corresponding permission roles.

[0021] S4: Deploy an adaptive security protection chain: Integrate a unified identity authentication interface and a dynamic encryption module. When a user logs in, multi-factor authentication and dynamic generation of session keys are triggered. During data transmission, a differentiated encryption strategy based on access roles is adopted. Sensitive operation logs are synchronized to the security audit center in real time, forming an adaptive protection throughout the entire process from identity verification to data transmission and operation auditing.

[0022] In this embodiment, the layered domestic IT innovation adaptation architecture refers to dividing the domestic IT innovation environment into a layered structure of a bottom-level foundation layer, an environment adaptation layer, and an application layer, thereby decoupling hardware, software, and adaptation logic. The bottom-level foundation layer includes domestic server hardware and operating systems, the environment adaptation layer is responsible for hardware drivers and software interface adaptation, and the application layer deploys internal website business systems.

[0023] In this embodiment, the server operating system refers to a domestically developed operating system running on a server, used to manage hardware resources and software programs, such as the Galaxy Kylin server operating system (optimized for domestic CPU architecture and supporting independent controllability requirements).

[0024] The database refers to a domestically developed database management system that stores website data. It is compatible with the SQL standard and supports large-scale data storage and high-concurrency access. The middleware refers to domestically developed middleware that connects the operating system, database, and application, providing basic services such as communication and transaction management. The underlying IT innovation environment refers to the basic operating environment composed of domestically developed server operating systems, databases, middleware, and hardware. The environment adaptation layer refers to the middle layer located between the underlying IT innovation environment and the application layer, responsible for the adaptation and coordination of hardware and software.

[0025] In this embodiment, different model servers refer to domestically produced servers using different hardware architectures (such as x86, ARM) or brands, and independently controllable components refer to software and hardware components (such as CPU, database, security chip, etc.) that use domestic technology and have independent intellectual property rights.

[0026] Automatic identification refers to the process by which the system automatically detects the hardware model, software version, and component type; compatibility configuration refers to the process by which the system automatically adjusts system parameters to adapt to different components.

[0027] Dynamic permission-data mapping mechanism refers to the real-time association mechanism between user role permissions and data access permissions. It supports automatic adjustment of permissions as roles change. For example, when a "regular user" is upgraded to a "department administrator", the range of data that can be accessed is automatically expanded to include confidential department data.

[0028] Historical data migration refers to the process of transferring data from the original website (such as an old system based on SQL Server) to the new information technology innovation environment. For example, migrating news articles and production data from the old website from 2019 to 2024 to the database of the new website.

[0029] The permission parsing module refers to the program module that extracts and parses the user roles and permission relationships of the original website. For example, it can extract permission rules from the old website database, such as system administrators being able to delete all data and publicity staff being able to only upload manuscripts. Specifically, it extracts permission table data through SQL query statements, parses unstructured permission descriptions using regular expressions, and outputs a standardized permission feature dataset.

[0030] User role and permission data refers to a dataset that records user roles and their corresponding operation permissions. For example, the system administrator role is associated with the permissions to modify users and delete data, while the ordinary user role is associated with the permission to view public information. Specifically, it is stored as a structured data table (containing role ID, permission ID, and operation type fields) and supports permission inheritance (such as department administrators inheriting ordinary user permissions).

[0031] Predefined multi-level permission rules refer to predefined permission control rules divided into levels, such as level 1 permission (system administrator, full permissions), level 2 permission (department administrator, full permissions within the department), and level 3 permission (ordinary users, only view permissions).

[0032] Permission-data association graph refers to a visual graph that shows the relationship between role permissions and data. For example, in the graph, the department administrator node is connected to the department production data node, and the ordinary user node is only connected to the public news node. Specifically, the graph is stored using a graph database (such as Neo4j), and graph analysis algorithms are used to identify permission redundancy or missing permissions to help optimize permission design.

[0033] Migration tools refer to software tools that perform data migration.

[0034] Tiered labeling refers to the process of adding tags to migrated data according to its sensitivity level. For example, the annual power generation plan is labeled as confidential, and internal news is labeled as public. Specifically, the tags are automatically matched based on the permission-data association graph, and the labeling results of highly sensitive data are manually reviewed to ensure accuracy.

[0035] Encrypted storage refers to the process of storing data marked as sensitive after encryption. For example, confidential data is encrypted using the SM4 national cryptographic algorithm, while public data is not encrypted.

[0036] Access permission binding refers to the process of binding data access permissions to user roles, ensuring that only authorized roles can access the data.

[0037] The knowledge base-data migration linkage refers to a mechanism in which data migration and knowledge base construction are carried out simultaneously, and the migrated data is transformed into knowledge resources in real time.

[0038] Intelligent indexing engines refer to engines that automatically extract data features and generate knowledge tags.

[0039] The independent knowledge base of intelligent customer service refers to a dedicated knowledge base that supports intelligent customer service responses, storing knowledge units related to the website's business. The linkage of the website user permission system refers to the mechanism that synchronizes the access permissions of the knowledge base with the permissions of website users' roles.

[0040] An adaptive security protection chain refers to a dynamic security protection system formed by the linkage of identity authentication, data encryption, operation auditing and other links, which can automatically adjust the protection strategy according to the scenario.

[0041] The unified identity authentication interface refers to the interface that connects a website to the unified identity authentication system, enabling centralized verification of user identities.

[0042] Multi-factor authentication refers to a mechanism that verifies a user's identity through multiple different types of authentication factors. Dynamic session key generation refers to a mechanism that generates a unique key for each user session, and the key becomes invalid immediately after the session ends.

[0043] Sensitive operation logs refer to logs that record sensitive user operations (such as deleting data or modifying permissions).

[0044] A security audit center is a system that centrally stores and analyzes sensitive operation logs for security incident tracing and early warning.

[0045] End-to-end adaptive protection refers to dynamic protection covering all aspects of user login (identity verification), data transmission (encryption), and operational behavior (auditing).

[0046] The beneficial effects of the above technical solution are: through layered adaptation to domestic IT innovation, dynamic permissions and data association, knowledge base linkage and adaptive security protection, the compatibility, security and knowledge service efficiency of internal websites in the domestic IT innovation environment are synergistically improved.

[0047] In the preferred scheme, automatic identification and compatibility configuration of different server models and independently controllable components are achieved, including: capturing hardware features in real time based on the hardware driver adaptation module, generating a hardware adaptation requirement list after comparing with the fingerprint database, and automatically matching and loading the adapted hardware adaptation configuration file from the dynamic module pool. Based on the interface call logs of the software interface conversion module, parameter features are extracted to generate software interface conversion rules. Adaptive components in the interface conversion plugin library are called to perform protocol conversion and format mapping on the software interface and generate an interface adaptation configuration file. Automatic identification and compatibility configuration are achieved based on hardware adaptation configuration files and interface adaptation configuration files.

[0048] In this embodiment, the hardware driver adaptation module refers to a program module used to collect hardware device feature information in real time. It is compatible with driver interfaces of different types of hardware and provides basic data for hardware identification and adaptation. For example, a hardware feature collector deployed on a server can collect information such as CPU model (e.g., Kunpeng 920), network card model (e.g., Huawei ENI adapter), and storage controller protocol (e.g., SAS / SATA).

[0049] Hardware characteristics refer to the inherent attributes or operating parameters of hardware devices, used to uniquely identify hardware models and functions, and are the core basis for hardware identification. For example, the CPU architecture (ARM / x86), memory capacity (128GB), number of peripheral interfaces (4 USB 3.0), and firmware version (V2.5.1) of a server; and the MAC address and supported transmission rate (10Gbps) of a network device.

[0050] A fingerprint database is a database that stores standard characteristic information of known hardware devices. It is used to compare and identify unknown hardware and support hardware adaptation requirement analysis. For example, it may contain characteristic fingerprints of servers (model Taishan2280) (CPU: Kunpeng 920, memory support up to 512GB, interface: 2×10GE optical ports) and characteristic fingerprints of Inspur NF5280M6 servers (CPU: Phytium 2000+, storage support RAID0 / 1 / 5).

[0051] The hardware adaptation requirements list refers to a list generated after comparing hardware characteristics with the fingerprint database. It contains the hardware components that need to be adapted and the specific requirements, clarifying the goals and content of hardware adaptation. For example, if an unknown server model is detected (CPU: Phytium 2000+, no matching fingerprint), the list will list requirements such as loading a dedicated storage driver, adapting to the PCIe 4.0 interface protocol, and adjusting the memory allocation strategy.

[0052] The dynamic module pool refers to a collection of various hardware adaptation micro-modules that support dynamic loading and unloading of modules to meet the adaptation needs of different hardware. For example, it includes CPU driver modules, CPU memory optimization modules, and domestic network card adaptation modules. Modules are stored according to hardware type.

[0053] Hardware adaptation configuration files are configuration files that describe hardware adaptation parameters and rules, used to guide the system to complete hardware compatibility configuration. For example, a configuration file for a server may contain parameters such as "number of memory channels: 8, storage controller driver path: / driver / storage / hisilicon / , PCIe bus speed: 8GT / s".

[0054] The software interface conversion module refers to the module used to parse the calling rules of software interfaces and convert interface protocols to achieve communication compatibility between different software components (such as databases and middleware). For example, it can convert the original website's ODBC-based database interface into a JDBC interface adapted to the database, or convert the SOAP-based middleware interface into a RESTful interface. Specifically, it adopts an interface abstraction design, obtains interactive data by intercepting interface call requests, has built-in protocol conversion logic, and supports dynamically loading conversion rules.

[0055] Interface call logs refer to log data recording the process of software interface calls, including call time, interface name, input and output parameters, return status, etc., used to analyze interface characteristics. For example, 2024-06-01 10:30:00, interface: / db / query, parameter: {table:news,limit:10}, return: success; 2024-06-01 10:35:00, interface: / middleware / send, parameter: {msg:test}, return: timeout. Specifically, logging code is embedded at the interface call point, the logs are stored in JSON format on the log server, the retention period is set to 90 days, and it is possible to query by interface name and time range.

[0056] Parameter characteristics refer to parameter attributes extracted from API call logs that reflect the interaction patterns of the API, such as parameter type, value range, and frequency of occurrence. These characteristics serve as the basis for generating conversion rules. For example, the values ​​of the parameter 'table' extracted from database query API logs are often 'news' or 'user', the value range of the parameter 'limit' is 1-100, and the return value format is JSON.

[0057] Software interface conversion rules refer to the rules that define the interface protocol and format conversion logic, which are used to guide the compatibility processing of software interfaces. For example, converting the ODBC interface parameter {dbname:old_db} to the JDBC interface parameter {database:new_db,schema:public}, and converting the date format 'yyyy-mm-dd' to 'yyyymmdd'.

[0058] An interface conversion plugin library refers to a library that stores various interface conversion plugins. Each plugin encapsulates the conversion logic for a specific type of interface and supports flexible invocation. For example, it includes ODBC-JDBC conversion plugins, SOAP-REST conversion plugins, XML-JSON conversion plugins, etc. Each plugin corresponds to a specific interface conversion scenario.

[0059] Adaptation components refer to the functional components in the interface conversion plugin library used to perform specific conversion operations. They are the concrete implementation carriers of conversion rules. For example, date format conversion components (responsible for mutual conversion between different date formats) and parameter mapping components (responsible for mapping the fields of interface parameters).

[0060] Software interfaces refer to the interaction interfaces between software components (such as databases, middleware, and applications) for data transfer and function calls. Examples include database query interfaces (such as executing SQL statements), middleware message sending interfaces, and user authentication interfaces (such as login verification).

[0061] Protocol conversion refers to the process of converting the communication protocol of an interface from one type to another, ensuring that software components with different protocols can communicate. For example, converting a custom TCP-based protocol to the HTTP protocol, or converting an MQTT-based IoT interface to the AMQP protocol.

[0062] Format mapping refers to the process of converting the format of interface data (such as data structure, field name, and data type) from one to another to ensure data semantic consistency. For example, converting the original website user information JSON format {name:Zhang San,age:30} to the new system's {username:Zhang San,user_age:30} (field name and type conversion).

[0063] An interface adaptation configuration file is a configuration file that describes the adaptation parameters and rules of a software interface. It is used to guide the system to complete the compatibility configuration of the software interface. For example, a configuration file for a database interface may contain the driver class name: dm.jdbc.driver.DmDriver, the connection URL: jdbc:dm: / / 192.168.1.1:5236, the parameter mapping rule: {oldParam:newParam}, etc.

[0064] Compatibility configuration refers to the process by which the system automatically adjusts hardware resource allocation and software interface parameters based on hardware adaptation configuration files and interface adaptation configuration files to ensure that hardware and software components work together. For example, according to the hardware adaptation configuration file, the number of CPU cores allocated to the Inspur server is 16 and the memory is 64GB. According to the interface adaptation configuration file, the database connection pool size is set to 20.

[0065] The beneficial effects of the above technical solution are as follows: through the collaborative work of the hardware driver adaptation module and the software interface conversion module, the automatic identification of hardware features and interface features, the accurate analysis of adaptation requirements, and the dynamic generation of configuration files are realized. This significantly improves the compatibility of the internal website with different models of servers, independently controllable components, and software interfaces in the context of information technology innovation, shortens the adaptation cycle, and ensures the stable operation of the system.

[0066] In the preferred scheme, the generation of the permission-data association graph includes: The time decay rules and spatial constraints of user role permissions are preset. The original website role permission data and historical operation audit logs are mined through the permission parsing module to extract static permission items and dynamic permission association features, and the initial node and edge structure of the permission-data association graph is constructed. By labeling data resources with sensitivity levels and operation behavior types, and combining user role levels, a three-dimensional association dimension system is constructed for the permission-data association graph, and a permission strength coefficient is assigned to each association edge. During the historical data migration process, the graph incremental update engine is launched simultaneously: when new data is added, the associated permissions are automatically deduced based on the permission inheritance rules of similar data, new associated edges are generated and marked as pending verification status; when the data structure changes, the permission adaptation analysis process is triggered to update the permission mapping relationship of associated nodes. After the data migration is completed, a simulation test is conducted using virtual characters to verify the validity of the graph associations and remove invalid association edges.

[0067] In the preferred embodiment, the data structure includes field addition, deletion, and / or type adjustment.

[0068] In this embodiment, the time decay rule for user role permissions refers to the preset rule that automatically adjusts or invalidates permissions over time. This rule is used to control the timeliness of permissions and avoid the security risks caused by permissions being valid for a long time.

[0069] Spatial constraints refer to the spatial scope (such as network environment, terminal device) that restricts the effectiveness of permissions, ensuring that permissions are only valid within the specified scenario.

[0070] The original website role and permission data refers to the original data that records user roles and corresponding permissions in the old system, which is the basis for permission migration and mapping.

[0071] Historical operation audit logs refer to log data that records user operations on the original website, including information such as operator, operation type, operation object, and time, which are used to analyze the actual use of user permissions.

[0072] Static permissions refer to fixed permissions that do not change with user actions. They are predefined by the system and are stable. For example, basic permissions such as the ability for a promoter to upload manuscripts and the ability for an auditor to approve manuscripts are always in effect, regardless of whether the user actually performs any action.

[0073] Dynamic permission association features refer to permission associations derived from users' historical operation behaviors that change with the scenario, reflecting actual permission usage needs. For example, if user D (maintenance engineer) frequently views "#1 unit fault data", the system automatically discovers the association feature "maintenance engineer - frequent access - #1 unit data"; if 80% of a department's documents are approved by user E, the association "user E - priority approval - documents of this department" is derived.

[0074] The initial node and edge structure of the permission-data association graph refers to the basic framework of the permission-data association graph. "Nodes" represent user roles or data resources, and "edges" represent the permission relationship between the two. For example, the nodes include system administrator (role) and confidential document (data), and the edge is "system administrator - manage - confidential document"; the nodes include ordinary user (role) and public news (data), and the edge is "ordinary user - view - public news".

[0075] Data resources refer to various types of data stored in the system, including structured data (such as database table records) and unstructured data (such as documents and pictures). They are the objects of access control, such as unit operation parameter tables in the production management system, photos of Party building activities in the Party and Mass Affairs section, and emergency plan documents in safety management.

[0076] Sensitivity levels refer to the degree of sensitivity based on the risk or importance of data leakage, and are used to fine-tune the granularity of access control.

[0077] Operation behavior type refers to the specific way a user operates on data resources, reflecting the operation dimension of permissions and ensuring that permission control covers all operation scenarios, such as read (viewing data content), write (adding / modifying data), delete (deleting data), approve (approving data release), and export (exporting data).

[0078] User role hierarchy refers to the role levels divided according to the scope of management or the size of permissions, reflecting the permission weight of the role and facilitating hierarchical permission control.

[0079] The three-dimensional association system refers to a three-dimensional permission association model that integrates user role hierarchy, operation behavior type, and data sensitivity hierarchy to achieve precise permission mapping. For example, "Level 2 role (department administrator) - write - internal level data (department work arrangements)" and "Level 3 role (ordinary employee) - read - public level data (factory news)".

[0080] The associated edge refers to the line segment connecting the "user role node" and the "data resource node" in the permission-data association graph. It represents the permission relationship between the two and is the core carrier of permission mapping.

[0081] The permission strength coefficient refers to a numerical value (e.g., 0-10) that quantifies the importance or priority of the permissions of related edges. The higher the coefficient, the closer the permission association, and the more important it is to ensure its effectiveness. The coefficient is calculated as: operation frequency × 0.3 + sensitivity weight × 0.4 + role level × 0.3.

[0082] The map incremental update engine refers to a program module that detects data changes in real time and updates permissions-data association maps during data migration, avoiding the inefficiency of full map reconstruction.

[0083] New data refers to data added to the system during the data migration process (including incremental data from the original website that was not migrated, and data newly generated after migration).

[0084] The permission inheritance rule for similar data refers to the rule that newly added data automatically inherits the permissions of existing data of the same type, ensuring the consistency of permissions and reducing the cost of manual configuration. For example, the newly added "Inspection Report" (type: document, department: Electrical Maintenance Department) automatically inherits the permissions of the same type of "Inspection Report" ("Electrical Maintenance Department administrator can approve, and employees of this department can view").

[0085] Associated permissions refer to the permission relationship between newly added data and user roles. This relationship is inherited from the permissions of similar data or generated manually. For example, after adding the document "#3 Unit Fault Analysis", the associated permissions are "The administrator of the Mechanical and Hydraulic Engineering Maintenance Department can approve it, and employees of this department can view it".

[0086] New associated edges refer to the new associated edges added to the graph due to new data or structural changes. They represent new permission relationships. For example, after adding the document "#3 Unit Fault Analysis", the graph will have a new associated edge "Mechanical and Hydraulic Engineering Maintenance Department Administrator - Approval - #3 Unit Fault Analysis".

[0087] The "pending verification" status refers to the temporary state of a new associated edge before its validity is confirmed. This avoids incorrect permissions from taking effect directly and reduces security risks. For example, if a new associated edge "Ordinary User - View - Confidential Data" is added, it may violate the rules and will be marked as "pending verification" and will only take effect after administrator confirmation.

[0088] Data structure changes refer to changes in the storage structure of data, including the addition, deletion, or type adjustment of fields (such as changing from text to numeric). This may affect permission mapping relationships. For example, the "Emergency Contact" field is added to the "Employee Information Table", the "Old Unit Number" field is deleted from the "Production Plan Table", and the "Power" field in the "Equipment Parameter Table" is changed from "integer" to "decimal".

[0089] The permission adaptation analysis process refers to the process of analyzing the impact of changes on permission mapping and adjusting the relationships when data structures change, to ensure that permissions match the data structure. For example, after the "Core Parameters" field (sensitivity level: confidential) is added to the "Device Parameter Table", the process automatically analyzes and needs to add a "viewable only by system administrator" permission mapping for this field.

[0090] The permission mapping relationship of associated nodes refers to the permission correspondence between role nodes and data nodes in the permission-data association graph. It is the core logic of permission control. For example, the mapping relationship between the system administrator node and all data nodes is full operation permission; the mapping relationship between the ordinary user node and public data nodes is view-only.

[0091] Virtual role operation simulation testing refers to a testing method that verifies the effectiveness of permission-data association graphs by simulating the operation behaviors of different roles, without the need for real user participation.

[0092] The validity of graph associations refers to the accuracy and compliance of the relationships in the permission-data association graph. That is, whether the association edges conform to the preset permission rules and can correctly control data access. For example, an association edge that allows a department administrator to approve internal data of their own department is valid; an association edge that allows a regular user to delete confidential data is invalid.

[0093] Invalid association edges refer to association edges that do not comply with permission rules or cannot properly control data access. They need to be removed to avoid permission vulnerabilities. For example, association edges generated due to configuration errors, such as ordinary user-delete-confidential data association edges, or old fields-role association edges that have become invalid after data structure changes.

[0094] The beneficial effects of the above technical solution are as follows: by constraining the scope of permission effectiveness through time and space dimensions, constructing an initial map by combining static permissions and dynamic behavioral characteristics, refining permission associations and quantifying their strength in three dimensions, updating the map incrementally to adapt to data changes, and finally ensuring effectiveness through simulation testing, dynamic and accurate mapping between permissions and data is achieved, which significantly improves the security and compliance of internal website data access.

[0095] In the preferred scheme, structured business information and unstructured document content in the migration data are automatically extracted, classified, and semantically annotated to generate knowledge units, including: Synchronously access the structured business information and unstructured document content in the migration data, and start the classification adaptation learner in conjunction with the source system identifier of the migration data.

[0096] The system automatically categorizes data based on the matching degree between the field features of structured data and the classification tree nodes, generating initial classification labels. It also dynamically adjusts the classification level based on the semantic similarity between the cross-modal feature set of unstructured data and the classification tree nodes.

[0097] The categorized structured fields and unstructured feature sets are mapped to a predefined domain knowledge graph, where structured data is labeled at the field level and unstructured data is labeled at the fragment level.

[0098] For new entities that do not match, the entity discovery module is activated to generate temporary entity nodes. After manual confirmation, these nodes are updated to the knowledge graph, and the classification tags and semantic annotation results are integrated to generate knowledge units containing core information blocks, related graph fragments, and access permission identifiers.

[0099] In this embodiment, structured business information refers to business data with a fixed format and clearly defined fields, which is usually stored in database tables or standardized tables, such as production plan tables (including date, unit number, planned power generation, and responsible person fields) and equipment ledgers (including equipment ID, model, purchase date, and department fields).

[0100] Unstructured document content refers to document data without a fixed format or with a flexible format, including text, images, audio and video, PDFs, etc., such as scanned copies of handwritten maintenance notes, safety production training videos, transcripts of meeting recordings, and PDFs of annual reports with complex layouts.

[0101] Cross-modal feature sets refer to feature sets extracted from multiple types of unstructured data. They contain the core information of different modal data and support cross-type data correlation analysis. For example, the cross-modal feature set of a certain equipment failure case includes "text keywords: bearing wear, repair time 2 hours; image features: bearing crack coordinates; audio features: 1000Hz abnormal noise frequency".

[0102] The source system identifier is a unique identifier of the original system from which the data originates. It is used to trace the source of the data and assist in classification (data from different systems may belong to different business areas). For example, the source system identifier "OA-202" means that the data comes from the original office automation system, and "ERP-301" means that it comes from the original enterprise resource planning system. It is usually associated with a classification tree node (such as "OA system data → administration").

[0103] A classification adaptation learner is a machine learning module that can automatically learn classification rules and dynamically adjust classification strategies based on the matching relationship between data features and classification tree nodes, thereby improving classification accuracy. For example, by learning the pattern that "data containing the keywords 'maintenance' and 'fault' mostly belong to the 'equipment maintenance' node", the new "#1 unit maintenance record" can be automatically classified as "equipment maintenance".

[0104] Field characteristics refer to the attribute characteristics of key fields in structured data (such as field value, data type, and business meaning). They are the core basis for classifying structured data. For example, the characteristics of the "planned power generation" field in the "production plan table" are "numerical type, unit MW, business meaning: production target"; the characteristics of the "department" field are "text type, value range: electrical department / mechanical department".

[0105] A classification tree node refers to a specific level node in a business domain classification tree. It represents a specific business category and is the target label for data classification. For example, the "Production Management → Equipment Maintenance → Mechanical Failure" node and the "Safety Management → Emergency Drill" node in the classification tree.

[0106] Matching score refers to the degree of similarity between the field features of structured data and the typical features of the classification tree node (usually expressed as 0-100 points). It is used to determine the category to which the data belongs. For example, the matching score of "Department = Mechanical Department" and "Equipment Type = Gearbox" of "Equipment Ledger" is 85 points with the "Mechanical Failure" node and 30 points with the "Electrical Failure" node. The matching score is calculated as: Matching score = Keyword overlap rate × 60% + Rule matching score × 40%.

[0107] Initial classification labels refer to the preliminary classification tree node labels determined after the structured data has been calculated based on the matching degree. They are the preliminary results of the classification. For example, the initial classification label for "#1 Unit Gearbox Maintenance Record" is "Production Management → Equipment Maintenance → Mechanical Failure".

[0108] Semantic similarity calculation refers to the algorithmic calculation of the closeness between the cross-modal feature set of unstructured data and the semantic features of the classification tree node, which is used for the classification of unstructured data. For example, the cosine similarity between the text features of "bearing wear and replacement parts" and the semantic features of the "mechanical failure" node in the maintenance report is 0.8 (high similarity), while the similarity with the "electrical failure" node is 0.2 (low similarity).

[0109] The classification level refers to the depth of the data in the classification tree. The deeper the level, the more refined the classification. It can be dynamically adjusted according to the data characteristics. For example, a certain maintenance data is initially classified as "equipment maintenance" (level 2). After semantic analysis, it is found to contain the feature "gear wear", and it is adjusted to "equipment maintenance → mechanical failure → transmission system failure" (level 4).

[0110] The structured fields after classification refer to the key fields of structured data that have been labeled with initial classification tags. They are the basic data for mapping knowledge graphs. For example, the fields “Equipment ID=D001, Fault Phenomenon=Gear Breakage” classified as “Mechanical Fault”.

[0111] Unstructured feature sets refer to the cross-modal feature sets of unstructured data that have been classified. They contain the core semantic information of the unstructured data. For example, the unstructured feature set classified as "emergency drill" includes: text keywords "fire, evacuation route"; image features "firefighting equipment, assembly point signs"; and audio features "alarm sounds, command commands".

[0112] A pre-built domain knowledge graph refers to a knowledge graph that is pre-constructed and covers the core business domains of an organization. It contains knowledge elements such as entities, relationships, and attributes. For example, a power plant domain knowledge graph contains entities such as "equipment" (Unit #1, gearbox), "fault" (bearing wear, gear breakage), and "operation" (maintenance, replacement), as well as relationships such as "equipment-occurrence-fault" and "fault-requirement-operation".

[0113] Field-level annotation refers to adding association tags to key fields of structured data with entities / relationships in the domain knowledge graph, clarifying the knowledge meaning of the fields. For example, the field "Equipment ID=D001" is annotated with "Associated entity: #1 unit (entity ID: E001)"; the field "Fault phenomenon=gear breakage" is annotated with "Associated entity: gear breakage (entity ID: F003), relationship: equipment failure".

[0114] Fragment-level annotation refers to adding association tags to key content fragments (such as sentences, paragraphs, and image areas) of unstructured data with entities / relationships in the knowledge graph, enabling refined knowledge association of unstructured data. For example, the fragment "The gearbox of Unit #1 broke due to insufficient lubrication in May 2024" in the maintenance report is annotated as follows: "Entity: Unit #1 (E001), Gearbox (E002), Insufficient lubrication (C001); Relationship: E002-Cause of failure-C001, Time: 2024-05".

[0115] Unmatched new entities refer to entities that appear in the structured fields or unstructured feature sets after classification but do not exist in the preset domain knowledge graph. These entities need to be added to the knowledge graph. For example, entities such as "new intelligent sensor" and "robot inspection" are not recorded in the knowledge graph.

[0116] The entity discovery module is a module that automatically identifies new entities that do not match and extracts their attribute features, supporting the dynamic expansion of the knowledge graph. For example, it can discover "AI vibration analyzer" from the "2024 New Equipment Procurement List" and extract the attributes "Type: Detection equipment, Purpose: Vibration monitoring, Procurement date: 2024-06".

[0117] Temporary entity nodes refer to nodes that temporarily store new entities in the knowledge graph and are marked as "pending confirmation" to avoid directly modifying the formal knowledge graph. For example, a temporary node "AI Vibration Analyzer (Temporary ID: T001)" has the following attributes: "Type: Detection Equipment, Source: 2024 Procurement List, Status: Pending Confirmation".

[0118] Manual confirmation refers to the review of the validity of temporary entity nodes by business experts or administrators, deciding whether to formally add them to the knowledge graph to ensure the accuracy of knowledge. For example, the administrator reviews the temporary node "AI Vibration Analyzer", confirms that it is a new equipment entity, adds the attribute "Model: VA-2000" and then approves its addition to the knowledge graph.

[0119] A knowledge unit refers to the smallest knowledge carrier formed by integrating classification tags and semantic annotation results. It contains core information, knowledge associations, and access permissions, which facilitates knowledge reuse and management. For example, the knowledge unit "#1 Unit Gearbox Fault Handling in May 2024" contains the classification tag "Mechanical Fault", the core information "Cause of Fault: Insufficient Lubrication, Solution: Replace Gear + Add Lubricant", the associated graph fragment (#1 Unit - Occurrence - Gear Fracture), and the access permission identifier "Internal Level".

[0120] The core information block refers to the most critical business information in the knowledge unit, which condenses the core value of the data and facilitates quick understanding of the knowledge content. For example, the core information block of the fault handling knowledge unit is: "Equipment: #1 unit gearbox, fault time: 2024-05-10, cause: insufficient lubrication, handling steps: 1. Stop the machine for inspection; 2. Replace the worn gear; 3. Add special lubricant; 4. Trial run."

[0121] A relational graph fragment refers to a subgraph of the domain knowledge graph associated with a knowledge unit. It contains related entities and relationships, and displays the relational network of knowledge. For example, the relational graph fragment of the knowledge unit "#1 Unit Gearbox Failure" contains the entities #1 Unit, Gearbox, Insufficient Lubrication, and Replacement Operation, and the relationships "#1 Unit - Contains - Gearbox", "Gearbox - Failure Cause - Insufficient Lubrication", and "Gearbox - Needs - Replacement Operation".

[0122] Access permission identifiers are labels that mark the access permissions of knowledge units. They are determined based on data sensitivity and classification domain to control the scope of knowledge access. For example, "core level" (such as equipment core parameter knowledge units, which can only be accessed by system administrators), "department level" (such as internal department maintenance knowledge, which can only be accessed by employees of that department), and "public level" (such as general security specifications, which can be accessed by all users).

[0123] The beneficial effects of the above technical solution are: it enables the synchronous processing of structured and unstructured data through a dual-track parsing engine, accurately classifies data by combining a classification and adaptation learner, and achieves deep binding between data and knowledge entities by relying on a knowledge graph association engine, ultimately generating knowledge units containing core information and access control, which significantly improves the efficiency and accuracy of knowledge transformation of migrated data.

[0124] In the preferred scheme, multi-factor authentication and dynamic generation of session keys are triggered when a user logs in, including: When the multi-factor authentication process is initiated, a user routine matrix is ​​generated based on the user terminal type, login network environment, and historical login behavior characteristics to determine the authentication factor combination. The validity verification results of the authentication factors are then synchronized in real time through the unified identity authentication interface. The matrix expression is as follows: ; in, This indicates the number of pre-defined, defensible attack types within the current timeframe of the logged-in network environment; This indicates the number of attack defense types configured for the login network environment; This indicates the number of attacks that do not fall under the pre-defined defendable attack types during the current time period when logging into the network environment; This represents the security gain coefficient based on historical login behavior characteristics; This represents the attack probability based on the terminal type; N represents a random number, and is a positive integer greater than 1. Symbol for random function; A unique session key is generated based on the combination of authentication factors, and the unique session key is bound to the authenticated user session in real time. The key lifecycle is dynamically associated with the duration of the user session. Based on the user's access permission level and the sensitivity of the object being operated on, the dynamic encryption module automatically adjusts the encryption algorithm strength of the session key and updates the encryption strategy in real time through permission change information fed back by the unified identity authentication interface.

[0125] In this embodiment, the multi-factor authentication process verifies identity through multiple independent authentication methods (such as "fingerprint + possession" and "biometric + dynamic code"), reducing the risk of cracking a single authentication. For example, when a user logs in, they need to enter a password (fingerprint) + mobile dynamic token (possession) or a fingerprint (biometric) + SMS verification code at the same time.

[0126] User terminal type refers to the category of the login device (such as PC, mobile phone) and its security attributes (whether it is a trusted terminal issued by the enterprise). For example, a secure mobile phone issued by the enterprise (marked as "trusted terminal", with a low probability of attack) and an employee's personal mobile phone ("ordinary terminal", with a high probability of attack).

[0127] The login network environment refers to the network affiliation at the time of login (internal network / external network / VPN), which is used to assess risk.

[0128] Historical login behavior characteristics are the time, device, and operation patterns of a user's past logins, used to calculate the security gain coefficient. For example, a user's long-term intranet login behavior (behavioral regularity, ud=0.9); frequent logins from different locations (abnormal behavior, ud=0.3). Specifically, data such as the user's login time, device identifier (such as MAC address, device serial number), network IP, and operation records are extracted from historical operation audit logs. The above behavioral characteristics are quantitatively scored (e.g., 1 point for conforming to regular time, 1 point for using common devices, 1 point for logging into the intranet, with a maximum score of 10 points). The scoring results are normalized to the range of 0-1 (e.g., a score of 8 points → security gain coefficient ud=0.8). The coefficient for regular behavior (e.g., long-term fixed time, device, intranet login) is close to 1, and the coefficient for abnormal behavior (e.g., frequent login from different locations, unfamiliar devices) is close to 0. The coefficients are recalculated daily based on the latest login behavior logs to ensure that they reflect the security of users' recent behavior in real time.

[0129] The user's regular matrix Dc is a 3×3 multi-factor matrix that integrates random numbers, network attack characteristics (sh1 / wh, sh2), historical gain (ud), and terminal attack probability (zl) to quantify login risk. For example, let sh1=3 (number of defendable attacks), wh=5 (number of preset defense types), sh2=1 (number of undefendable attacks), ud=0.8, zl=0.2, and N=10.

[0130] In this embodiment, the authentication factor combination is a dynamically selected authentication method (such as "password + face" or "token + SMS") based on the matrix risk value. For example, high risk (matrix sum ≥ 20) → three factors (password + SMS + face); low risk (sum ≤ 10) → password + fingerprint.

[0131] The unique session key is a unique encryption key for each session (such as multi-factor AES-256, SM4) to ensure the confidentiality of session data. Real-time session binding means that the key is immediately associated with the user session, and the key becomes invalid when the session ends.

[0132] User access permission levels are the permission levels corresponding to user roles (levels 1-5, with higher levels granting greater permissions), for example, system administrator (level 5) and ordinary employee (level 1).

[0133] The sensitivity of the object being operated on is the sensitivity level of the data (level 1-5, 1 = public, 5 = core secret), for example, employee salaries (level 5) and public news (level 1).

[0134] The beneficial effects of the above technical solution are as follows: by quantifying risks through a user conventional matrix, dynamically adapting multi-factor authentication combinations, solving the problem of "single multi-factor authentication", binding session keys throughout their entire lifecycle, relying on HSM to ensure randomness, and dynamically adjusting encryption algorithms according to permissions and sensitivity levels, the risk-authentication-encryption linkage is realized, which improves the anti-attack capability of internal website login and sessions, and builds a dynamic and precise protection system for user access security in the information technology innovation environment.

[0135] In the preferred scheme, generating a unique session key based on the authentication factor combination includes: splitting the authentication process of the authentication factor combination into authentication steps, identifying the mathematical combination of each segment, determining the global participation ratio of each mathematical variable in the mathematical combination, and calculating the global participation ratio and maximum ratio of the same mathematical variable according to a random calculation method in a predefined dynamic calculation set, setting a false value for the corresponding mathematical variable, and generating the first encryption factor.

[0136] Obtain the behavior feature map of historical login behavior characteristics, and perform interference processing on the random single local unit blocks of the behavior feature map. At the same time, scramble the single local unit blocks that have not been interfered with to obtain the first fake map. The first fake graph is divided into double local unit blocks, and the current fake combination of each double local unit block is constructed to predict the corresponding historical fake coefficient.

[0137] All spurious coefficients are randomly sorted and linearly fitted to obtain the first fitted coefficients and the fitting constant. At the same time, the average rate of change based on all spurious coefficients is obtained.

[0138] The final spurious coefficients of the first spurious plot are obtained by multiplying the average rate of change by the first fitting coefficient and adding it to the fitting constant.

[0139] Common login types and uncommon login types are extracted from historical login behavior characteristics, and one login type is randomly extracted from each of the common login types and uncommon login types to obtain a combined login type.

[0140] Based on the mapping coefficient between each double local unit block and the combined login type, and combined with the coefficient difference between the corresponding historical false coefficient and the final false coefficient, two rational numbers of the double local unit block are generated, and the behavior feature matrix based on the first false graph is randomly assigned.

[0141] The second encryption factor is generated based on the eigenvectors of the behavioral feature matrix.

[0142] A unique session key is generated based on the first encryption factor and the second encryption factor.

[0143] In this embodiment, the authentication process breakdown is to decompose the complete multi-factor authentication process, such as "password verification → token verification → biometric identification", into multiple independent stages, and extract mathematical relationships for each stage. For example, the "fingerprint + SMS" multi-factor authentication is broken down into four segments: "fingerprint collection → fingerprint verification → SMS sending → SMS verification".

[0144] Mathematical combination is the mathematical association of authentication parameters within each segment, such as "number of fingerprint feature points × verification code validity period". For example, the mathematical combination of fingerprint segment is "number of feature points (128) × matching threshold (0.85)", which is the operation relationship of 128 × 0.85.

[0145] The global participation ratio is a mathematical variable, such as the "number of feature points", which is the percentage of occurrence in all the split segments. For example, if the "number of feature points" appears in both the fingerprint segment and the secondary verification segment, and the total number of split segments is 4, then the global participation ratio = 2 / 4 = 50%.

[0146] The individual participation ratio is the influence weight of a mathematical variable within a single segment (such as the proportion of information entropy of the number of feature points in the fingerprint segment). For example, in the fingerprint segment, the information entropy of the number of feature points accounts for 60% (the other parameters account for 40%), so the maximum individual participation ratio is 60%.

[0147] The predefined dynamic calculation set is a set of predefined mathematical operation rules (such as "global ratio × 1.5 + maximum individual ratio" and "global ratio 2 + maximum individual ratio"). For example, the calculation set contains 5 formulas, and one is randomly selected each time (such as random.choice(calc_rules)).

[0148] Fake values ​​are created by adding perturbation values ​​to mathematical variables (e.g., the actual number of feature points is 128, but the fake number is 135) to mislead attackers in modeling. For example, based on the calculation results, a perturbation of ±5% is added to the "number of feature points" (128 → 135 or 121).

[0149] The first encryption factor is an encryption parameter generated from a fake value (such as the hash value of the number of fake feature points). For example, the fake value 135 is hashed using SHA-256, and the first 16 bits are taken as the first encryption factor (0x12345678). Specifically, the fake value is converted into a byte stream, a fixed-length factor is generated through a hash algorithm, and stored in the encryption context.

[0150] Behavioral feature graphs are structured graphs of historical login data (such as a three-dimensional relationship graph of time, device, and location). For example, the horizontal axis represents time (days), the vertical axis represents device (PC / mobile phone), the third dimension represents location (internal network / external network), and the nodes represent login events. Specifically, the behavioral graph is constructed using Graphviz, and the node attributes include login time, device type, and network location, while the edges represent consecutive login relationships.

[0151] A single local unit block is a segmentation of the behavior graph by time slices (e.g., one block every 2 hours), dividing it into equal-sized local regions. For example, a 24-hour day is divided into 12 single blocks (one block every 2 hours). Each block contains login events for that time period. Specifically, the graph is segmented using a sliding window algorithm (window size = 2 hours), and the node list for each block is recorded.

[0152] Interference handling involves adding noise to login events within a single block (e.g., randomly modifying the login time by ±10 minutes). For example, if the login time in a block is 9:00, it can be changed to 8:55 or 9:05 after interference.

[0153] Scrambling disrupts the order of login events within an undisturbed single block (breaking the original temporal correlation). For example, if the event order within the block is [9:00, 9:10, 9:20], after scrambling it becomes [9:10, 9:00, 9:20].

[0154] The first fake graph is a behavior graph that has been interfered with and scrambled to mislead attackers' analysis of real behavior. For example, the original graph shows an internal network PC login at 9:00, while the fake graph shows an external network mobile phone login at 8:55 (the result of interference and scrambling).

[0155] A double local unit block is formed by merging two adjacent single blocks into one double block (e.g., 2 hours × 2 = 4 hours into one block). For example, 12 single blocks → 6 double blocks (merging every two consecutive single blocks). Specifically, it involves traversing the list of single blocks, merging every two consecutive blocks, and recording the event characteristics after merging.

[0156] The current fake combination is a combination of login features after interference and scrambling within the double block (such as fake features of mobile phone + intranet). For example, the fake feature within the merged block is mobile phone + intranet (the real feature is PC + intranet). Specifically, the fake features (device, location, time interference value) of the merged block are extracted and feature tuples are generated (such as (device=mobile phone, net=intranet)).

[0157] The historical false coefficient is a statistical value of the interference degree of similar false combinations in historical data (such as the average interference rate of the mobile phone + intranet combination in the past six months). For example, historically, the proportion of interference events of the mobile phone + intranet combination has been 30% on average (that is, 30% of the events are false).

[0158] Randomizing spurious coefficients involves shuffling the order of spurious coefficients in all double blocks (disrupting the original correlation). For example, if the coefficients of 6 blocks are [0.3, 0.5, 0.2, 0.7, 0.4, 0.6], after shuffling they become [0.5, 0.2, 0.7, 0.3, 0.6, 0.4]. Specifically, the coefficient list is shuffled using random.sample and then sorted in ascending order (shuffling first and then reordering to increase randomness).

[0159] Linear fitting involves performing linear regression on the sorted spurious coefficients, calculating the fitting coefficients (slope k) and the fitting constant (intercept b). For example, the fitted equation is y = 0.1x + 0.2, where k = 0.1 (first fitting coefficient) and b = 0.2 (fitting constant).

[0160] The average rate of change is the spurious coefficient, which represents the average rate of change over time (e.g., ±5% per month). For example, over the past 3 months, the coefficient has changed from 0.3 to 0.35 to 0.4, with an average rate of change of 0.05 per month.

[0161] The final spurious coefficient is the result of combining the average rate of change, the fitting coefficient, and the fitting constant (formula: final coefficient = average rate of change × k + b). For example, if the average rate of change is 0.05, k = 0.1, and b = 0.2, then the final coefficient is 0.05 × 0.1 + 0.2 = 0.205.

[0162] Common / uncommon login types are login patterns categorized based on historical frequency (common: accounting for ≥80%, such as intranet PC login at 9 am on Monday; uncommon: accounting for <20%, such as external network mobile login at 10 pm on Saturday). For example, the common type is intranet PC - weekday 9 am (accounting for 85%), and the uncommon type is external network mobile - weekend (accounting for 10%).

[0163] Combination login types are created by randomly selecting one common type from the common types and one uncommon type from the uncommon types. For example, common types are selected as A (internal network PC - weekdays at 9 am) and uncommon types are selected as B (external network mobile phone - weekends), resulting in a combination of A+B.

[0164] The mapping coefficient is the matching strength (such as cosine similarity) between the false features of the double block and the combined login type. For example, if the false features of the double block are mobile phone + intranet, and the combination is PC + intranet + mobile phone + extranet, the mapping coefficient is 0.6 (partial match). Specifically, the features are converted into vectors, the matching degree is calculated using cosine similarity, and normalized to [0,1].

[0165] The coefficient difference is the difference between the historical spurious coefficient and the final spurious coefficient (e.g., historical 0.3, final 0.205 → difference -0.095). For example, difference = historical coefficient - final coefficient, which is used to adjust the generated rational number.

[0166] Two rational numbers are used to convert the mapping coefficients and coefficient differences into the simplest fractions (e.g., 0.6 = 3 / 5, -0.095 = -19 / 200). For example, the mapping coefficient 0.6 → 3 / 5, and the coefficient difference -0.095 → -19 / 200.

[0167] The behavioral feature matrix is ​​a symmetric matrix constructed from two rational numbers (increasing mathematical complexity), for example: .

[0168] Eigenvectors are the eigenvectors of a behavioral feature matrix (calculated through eigenvalue decomposition) used to generate encryption factors. For example, the eigenvectors of a matrix are [0.8, 0.6] and [-0.6, 0.8] (unit vectors).

[0169] The second encryption factor is an encryption parameter generated based on the feature vector (such as the hash value of the feature vector). For example, the feature vector [0.8,0.6] is hashed using SHA-512, and the first 32 bits are taken as the second encryption factor (0xABCD1234).

[0170] The unique session key is the final key generated by combining the first and second encryption factors (such as an AES-256 key). For example, the first factor 0x12345678 + the second factor 0xABCD1234 are concatenated and then used to generate a 256-bit key via HMAC-SHA256.

[0171] The beneficial effects of the above technical solution are: it deeply embeds the dynamic noise of the authentication process and the deceptive features of historical behavior into the key, and significantly improves the anti-analysis capability of the session key through mathematical complexity (matrix operation, feature decomposition) and behavioral obfuscation (fake graph, combined login), thus creating a three-dimensional protection system of dynamic obfuscation + mathematical hard resistance for user login and session security of internal websites.

[0172] In the preferred scheme, differentiated encryption based on access roles during data transmission includes: A multi-dimensional role permission matrix is ​​preset, which includes role level and corresponding sensitive data access scope, and a data sensitivity level mapping table is established. The role permission parsing module dynamically associates the user's access role with the data sensitivity level.

[0173] When a user initiates a data transmission request, the encryption strategy engine extracts the user's role information and the sensitivity level of the plaintext to be transmitted in real time, and automatically matches the first encryption scheme according to the preset association model.

[0174] The system pre-defines the association rules between user access roles and data sensitivity, and generates dynamic encrypted tuples in real time. These tuples include an initial scrambling sequence and multiple rounds of iterative offsets. The entropy of the initial scrambling sequence increases non-linearly with the product of role permissions and data sensitivity.

[0175] Construct a curve function for multi-round iterative offsets, and then perform periodic decomposition on the curve function to obtain the offset state in each period.

[0176] The first n1 offset states are transformed to obtain the first integrated state, and the plaintext parameters of each remaining state are set according to the first integrated state to construct a new plaintext.

[0177] The plaintext to be transmitted is phase-interleaved with the initial scrambling sequence in the dynamic encryption tuple to generate the first round of intermediate data.

[0178] The first round of intermediate data is superimposed with dynamic round scrambling codes and plaintext codes randomly extracted from the new plaintext. The self-updating replacement matrix is ​​then used to perform position inverse recombination to obtain encrypted ciphertext. The transmission channel is then encrypted in combination with the first encryption scheme.

[0179] During data transmission, if the role and permission resolution module detects a temporary change in the user's role, the encryption policy engine immediately interrupts the current transmission, re-matches the encryption scheme according to the new role and permissions, generates a new key, and synchronizes it to the receiving end through the encryption channel. Then, it resumes transmission and marks the boundary between the data packets before and after the permission change.

[0180] In this embodiment, the multi-dimensional role permission matrix is ​​a two-dimensional matrix constructed with role level and data sensitivity level as the axis. It defines the range of sensitive data that different roles can access, so as to realize fine-grained control of permissions. For example, the role level is divided into 1 (ordinary employee) to 5 (system administrator), and the data sensitivity level is divided into 0 (public) to 3 (core). The matrix stipulates that role 3 (department manager) can access data with sensitivity level ≤ 2 (confidential), and role 5 can access all sensitivity levels.

[0181] The data sensitivity level mapping table is a mapping relationship between data sensitivity levels (0~3) and business data types, which clarifies the confidentiality level of data. For example, 0 → public press releases, 1 → departmental work documents, 2 → annual budget reports, and 3 → core equipment parameters.

[0182] The role-based access control module parses the user's login role in real time, matches the sensitivity level of the data that the user can access, and establishes a dynamic association between permissions and data. For example, if the user's role is engineer (level 2), it will parse out that the user can only access data with a sensitivity level of ≤1 (internal).

[0183] The encryption strategy engine is a decision engine that dynamically selects encryption algorithms, key lengths, and modes based on the (role level, data sensitivity level) association pair. For example, role 2 + data level 1 → matches AES-128-CBC + national cryptographic SM4 combination; role 5 + data level 3 → matches SM9 elliptic curve encryption + chaotic encryption.

[0184] The first encryption scheme is a combination of the initially matched encryption algorithm, key, and pattern, serving as the basic encryption strategy for data transmission. For example, role 3 + data level 2 → scheme is SM4-128-ECB + initial scrambling entropy value = Bit.

[0185] The dynamic encryption tuple contains an initial scrambling sequence (high-entropy random number) and a set of encryption parameters (offset parameters for each round of encryption) to enhance encryption randomness. For example, the tuple {scrambling code: [0x12, 0x34, 0x56], offset: [5, 8, 3]} (3 rounds of iteration).

[0186] The curve function of the offset in multiple iterations is a mathematical function that describes how the offset changes with the number of iterations, such as a sine curve: Introducing periodic variations increases complexity; for example, let A = 5. , Then the offset in the nth round is 5. The cycle is 20 ( ).

[0187] Periodic splitting and offset states involve dividing the curve function into several intervals according to its period, with each interval corresponding to an offset state (the instantaneous value of the offset). For example, a period of 20 is split into 20 states, and the state of the 5th round corresponds to an offset of 5 when n=5. .

[0188] The transformation of the first n1 offset states is to select the offset states of the first n1 rounds (e.g., n1=3), and transform them through bitwise operations (e.g., XOR) to generate the first comprehensive state. For example, the first 3 rounds of states [5, 8, 3] → XOR transformation is [5 and 8 XOR result is 13, 8 and 3 XOR result is 11, 3 and 5 XOR result is 6] → comprehensive state 13|11|6=15 (binary 1111). It should be noted that: 5--0101, 8--1000, 3--0011.

[0189] The plaintext parameter setting and new plaintext are based on the first synthesis state, adjusting the plaintext parameters (length, position, padding) corresponding to the remaining offset state to generate new plaintext. For example, synthesis state 15 (1111) → the plaintext length of the remaining state is set to 16 bytes (2^4), and the position is offset by 4 bits; the original plaintext Hello (5 bytes) → padding 0x00 to 16 bytes, and the position is offset by 4 bits → \x00\x00\x00\x00Hello. Specifically, the synthesis state is parsed bit by bit (each bit controls one parameter), and the plaintext structure is adjusted by PKCS7 padding and bit operations.

[0190] Phase interleaving and the first round of intermediate data involve alternating the plaintext to be transmitted and the initial scrambling sequence bit by bit (e.g., plaintext bit 1 → scrambling bit 1 → plaintext bit 2 → scrambling bit 2…) to generate “first round of intermediate data”. For example, plaintext 0101 (binary), scrambling 1010 → interleaved 01100110 (0x66). Specifically, parity bits are separated by a bit mask (e.g., 0xAA), and plaintext and scrambling bits are alternately concatenated and stored as a byte array.

[0191] The dynamic round scrambling code is superimposed on the plaintext code. In each round of encryption, a new scrambling code (such as 0xAB, 0xCD) is generated and XORed with the intermediate data. A segment is randomly extracted from the new plaintext (such as 0x48, corresponding to 'H') to enhance randomness. For example, in the first round, the intermediate data is 0x66 → the round scrambling code 0xAB is superimposed → 0x66^0xAB=0xCF, and then the plaintext code 0x48 is superimposed → 0xCF^0x48=0x87. Specifically, in each round, SecureRandom is called to generate the round scrambling code, and random.randint is used to extract the plaintext code, which is then superimposed through an XOR operation.

[0192] The self-updating replacement matrix and positional inverse recombination are dynamically changing S-boxes (replacement matrices) that periodically update the mapping relationship; the bit order of encrypted data is reversed (e.g., 0123→3210) to achieve "positional inverse recombination". For example, the first round of S-box is {0x00→0x12, 0x01→0x34}, and the second round is updated to {0x00→0x56, 0x01→0x78}; the data 0x1234 is inversely recombinated into 0x4321.

[0193] Encryption channel and ciphertext generation combine a first encryption scheme (such as TLS) to encrypt the transmission channel, and finally output ciphertext that has undergone multiple rounds of processing. For example, the original plaintext "Hello" is interleaved, superimposed, replaced, and recombined to become the ciphertext "0x123456789ABCDEF", which is transmitted through the TLS channel.

[0194] Temporary role changes are temporary adjustments to role permissions during a user session (such as temporarily granting approval permissions), triggering a rematch of encryption policies. For example, a user may be temporarily upgraded from "regular employee" (role 1) to "temporary agent" (role 3), expanding their permission scope.

[0195] New key synchronization and data packet demarcation involve generating a new key (e.g., through Diffie-Hellman exchange) after a role change, encrypting and synchronizing it to the receiving end; marking the boundaries of data packets before and after the change (e.g., magic number 0xFF00FF) to facilitate segmented decryption. For example, the new key 0x11223344 is encrypted with the receiving end's public key and sent. Data packets before the change end with 0xFF and after the change begin with 0x00, with a demarcation symbol inserted. Specifically, an integrated key exchange protocol is used to add a 4-byte magic number before the ciphertext, allowing the receiving end to identify the demarcation during parsing and ensuring seamless switching.

[0196] The beneficial effects of the above technical solution are as follows: by defining the encryption baseline through dynamic association between permissions and sensitivity levels, constructing a mathematical confusion layer with dynamic tuples and multiple rounds of iteration, and enhancing the randomness of position states through phase interleaving and self-updating S-boxes, the solution ultimately achieves end-to-end security protection. Specifically, it deeply binds the dynamic changes of role permissions with the data sensitivity level, and uses mathematical methods such as nonlinear entropy, curve offset, and plaintext reconstruction to make the encryption process change in real time with permissions. At the same time, it supports seamless key switching and data demarcation when roles change, creating a dynamic protection system for internal website data transmission.

[0197] Example 2 To further illustrate with reference to Embodiment 1, a system for adaptive transformation and migration of internal websites includes: A layered domestic IT innovation adaptation architecture module is constructed to build the underlying domestic IT innovation environment based on server operating system, database and middleware. Through the environment adaptation layer, hardware driver adaptation module and software interface conversion module are dynamically loaded to realize automatic identification and compatible configuration of different models of servers and domestically controllable components.

[0198] A dynamic permission-data mapping mechanism module is established to extract user role permission data from the original website through the permission parsing module during the historical data migration process. Combined with preset multi-level permission rules, a permission-data association graph is generated. The migration tool classifies and marks historical data according to the permission-data association graph, and simultaneously completes data encryption storage and access permission binding.

[0199] The knowledge base-data migration linkage module is implemented to start the intelligent indexing engine during data migration. It automatically extracts, classifies and semantically annotates the structured business information and unstructured document content in the migrated data, generates knowledge units and writes them into the independent knowledge base of the intelligent customer service in real time. The independent knowledge base is linked with the website user permission system and only opens matching knowledge units to the corresponding permission roles.

[0200] Deploy an adaptive security protection chain module to integrate a unified identity authentication interface and a dynamic encryption module. When a user logs in, multi-factor authentication and dynamic generation of session keys are triggered. During data transmission, a differentiated encryption strategy based on access roles is adopted, and sensitive operation logs are synchronized to the security audit center in real time, forming a full-process adaptive protection from identity verification to data transmission and operation auditing.

[0201] This embodiment provides the working process, working details, and technical effects of a system for adaptive transformation and migration of internal websites, which can be found in Embodiment 1 and will not be repeated here.

[0202] The above embodiments are merely preferred technical solutions of the present invention and should not be considered as limitations on the present invention. The scope of protection of the present invention should be limited to the technical solutions described in the claims, including equivalent substitutions of the technical features described in the claims. That is, equivalent substitutions and improvements within this scope are also within the scope of protection of the present invention.

Claims

1. A method for adaptive transformation and migration of internal websites, characterized in that, Includes the following steps: S1. Construct a layered domestic IT innovation adaptation architecture: Build the underlying domestic IT innovation environment based on server operating system, database and middleware. Through the environment adaptation layer, dynamically load hardware driver adaptation module and software interface conversion module to realize automatic identification and compatibility configuration of different models of servers and independently controllable components. S2. Establish a dynamic permission-data mapping mechanism: During the historical data migration process, the original website user role permission data is extracted through the permission parsing module, and a permission-data association graph is generated by combining the preset multi-level permission rules. The migration tool performs hierarchical marking of historical data according to the permission-data association graph, and synchronously completes data encryption storage and access permission binding. S3. Implement knowledge base-data migration linkage: During data migration, start the intelligent indexing engine to automatically extract, classify and semantically annotate the structured business information and unstructured document content in the migrated data, generate knowledge units and write them into the independent knowledge base of intelligent customer service in real time. The independent knowledge base is linked with the website user permission system and only opens the matching knowledge units to the corresponding permission roles. S4. Deploy an adaptive security protection chain: Integrate a unified identity authentication interface and a dynamic encryption module. When a user logs in, multi-factor authentication and dynamic generation of session keys are triggered. During data transmission, a differentiated encryption strategy based on access roles is adopted. Sensitive operation logs are synchronized to the security audit center in real time, forming an adaptive protection throughout the entire process from identity verification to data transmission and operation auditing.

2. The method for adaptive transformation and migration of internal websites according to claim 1, characterized in that, Achieve automatic identification and compatible configuration for different server models and domestically controlled components, including: The hardware driver adaptation module captures hardware features in real time, compares them with the fingerprint database to generate a hardware adaptation requirement list, and automatically matches and loads the adapted hardware adaptation configuration file from the dynamic module pool. Based on the interface call logs of the software interface conversion module, parameter features are extracted to generate software interface conversion rules. Adaptive components in the interface conversion plugin library are called to perform protocol conversion and format mapping on the software interface and generate an interface adaptation configuration file. Based on the aforementioned hardware adaptation configuration file and interface adaptation configuration file, automatic identification and compatibility configuration are achieved.

3. The method for adaptive transformation and migration of internal websites according to claim 1, characterized in that, The generation of the permission-data association graph includes: The time decay rules and spatial constraints of user role permissions are preset. The original website role permission data and historical operation audit logs are mined through the permission parsing module to extract static permission items and dynamic permission association features, and the initial node and edge structure of the permission-data association graph is constructed. By labeling data resources with sensitivity levels and operation behavior types, and combining user role levels, a three-dimensional association dimension system is constructed for the permission-data association graph, and a permission strength coefficient is assigned to each association edge. During the historical data migration process, the graph incremental update engine is launched simultaneously: when new data is added, the associated permissions are automatically deduced based on the permission inheritance rules of similar data, new associated edges are generated and marked as pending verification status; when the data structure changes, the permission adaptation analysis process is triggered to update the permission mapping relationship of associated nodes. After the data migration is completed, a simulation test is conducted using virtual characters to verify the validity of the graph associations and remove invalid association edges.

4. The method for adaptive transformation and migration of an internal website according to claim 3, characterized in that, The data structure includes field addition, deletion, and / or type adjustment.

5. The method for adaptive transformation and migration of an internal website according to claim 1, characterized in that, The system automatically extracts, classifies, and semantically annotates structured business information and unstructured document content from the migration data to generate knowledge units, including: Synchronously access structured business information and unstructured document content from the migration data, and, in conjunction with the source system identifier of the migration data, start the classification adaptation learner: The system automatically categorizes data based on the matching degree between the field features of structured data and the classification tree nodes, generating initial classification labels. It also dynamically adjusts the classification level based on the semantic similarity between the cross-modal feature set of unstructured data and the classification tree nodes. The categorized structured fields and unstructured feature sets are mapped to a predefined domain knowledge graph, where structured data is labeled at the field level and unstructured data is labeled at the fragment level. For new entities that do not match, the entity discovery module is activated to generate temporary entity nodes. After manual confirmation, these nodes are updated to the knowledge graph, and the classification tags and semantic annotation results are integrated to generate knowledge units containing core information blocks, related graph fragments, and access permission identifiers.

6. The method for adaptive transformation and migration of an internal website according to claim 1, characterized in that, When a user logs in, multi-factor authentication and dynamic session key generation are triggered, including: When the multi-factor authentication process is initiated, a user routine matrix is ​​generated based on the user terminal type, login network environment, and historical login behavior characteristics to determine the authentication factor combination. The validity verification results of the authentication factors are then synchronized in real time through the unified identity authentication interface. The matrix expression is as follows: ； in, This indicates the number of pre-defined, defensible attack types within the current timeframe of the logged-in network environment; This indicates the number of attack defense types configured for the login network environment; This indicates the number of attacks that do not fall under the pre-defined defendable attack types during the current time period when logging into the network environment; This represents the security gain coefficient based on historical login behavior characteristics; This represents the attack probability based on the terminal type; N represents a random number, and is a positive integer greater than 1. Symbol for random function; A unique session key is generated based on the authentication factor combination, and the unique session key is bound to the authenticated user session in real time, with the key lifecycle dynamically related to the duration of the user session. Based on the user's access permission level and the sensitivity of the object being operated on, the dynamic encryption module automatically adjusts the encryption algorithm strength of the session key and updates the encryption strategy in real time through permission change information fed back by the unified identity authentication interface.

7. The method for adaptive transformation and migration of an internal website according to claim 6, characterized in that, A unique session key is generated based on the authentication factor combination, including the generation of a first encryption factor; Obtain the behavior feature map of the historical login behavior characteristics, and perform interference processing on the random single local unit blocks of the behavior feature map. At the same time, scramble the single local unit blocks that have not been interfered with to obtain the first fake map. The first fake graph is divided into double local unit blocks, and the current fake combination of each double local unit block is constructed to predict the corresponding historical fake coefficient. All spurious coefficients are randomly sorted and linearly fitted to obtain the first fitted coefficients and the fitting constant. At the same time, the average rate of change based on all spurious coefficients is obtained. The final spurious coefficient of the first spurious graph is obtained by multiplying the average rate of change by the first fitting coefficient and adding it to the fitting constant. Common login types and uncommon login types are extracted from the historical login behavior characteristics, and one login type is randomly extracted from each of the common login types and uncommon login types to obtain a combined login type; Based on the mapping coefficient between each double local unit block and the combined login type, and combined with the coefficient difference between the corresponding historical false coefficient and the final false coefficient, two rational numbers of the double local unit block are generated, and a behavior feature matrix based on the first false graph is randomly assigned. A second encryption factor is generated based on the eigenvectors of the behavioral feature matrix; A unique session key is generated based on the first encryption factor and the second encryption factor.

8. The method for adaptive transformation and migration of an internal website according to claim 7, characterized in that, The process of generating a unique session key based on the authentication factor combination specifically involves: The authentication process of the authentication factor combination is broken down into authentication steps, the mathematical combination of each segment is identified, and the global participation ratio of each mathematical variable in the mathematical combination is determined. Combined with the maximum ratio of the individual participation ratio of each mathematical variable, the global participation ratio and the maximum ratio of the same mathematical variable are calculated according to a random calculation method in a predefined dynamic calculation set. A false value is set for the corresponding mathematical variable, and the first encryption factor is generated.

9. The method for adaptive transformation and migration of an internal website according to claim 1, characterized in that, Differential encryption based on access roles during data transmission includes: A multi-dimensional role permission matrix is ​​preset, including role level and corresponding sensitive data access scope, and a data sensitivity level mapping table is established. The role permission parsing module dynamically associates the user's access role with the data sensitivity level. When a user initiates a data transmission request, the encryption strategy engine extracts the user's role information and the sensitivity level of the plaintext to be transmitted in real time, and automatically matches the first encryption scheme according to the preset association model. The association rules between user access roles and data sensitivity are preset, and dynamic encrypted tuples are generated in real time, including an initial scrambling sequence and multiple rounds of iterative offsets. The entropy value of the initial scrambling sequence increases non-linearly with the product of role permissions and data sensitivity. Construct a curve function for multi-round iterative offsets, and perform periodic decomposition on the curve function to obtain the offset state in each period; The first n1 offset states are transformed to obtain the first integrated state, and the plaintext parameters of each remaining state are set according to the first integrated state to construct a new plaintext. The plaintext to be transmitted is phase-interleaved with the initial scrambling sequence in the dynamic encryption tuple to generate the first round of intermediate data. The first round of intermediate data is overlaid with a dynamic round scrambling code and a plaintext code randomly extracted from the new plaintext. The self-updating replacement matrix is ​​then used to perform position inverse recombination to obtain encrypted ciphertext. The transmission channel is then encrypted in conjunction with the first encryption scheme. During data transmission, if the role and permission resolution module detects a temporary change in the user's role, the encryption policy engine immediately interrupts the current transmission, re-matches the encryption scheme according to the new role and permissions, generates a new key, and synchronizes it to the receiving end through the encryption channel. Then, it resumes transmission and marks the boundary between the data packets before and after the permission change.

10. A system for adaptive transformation and migration of internal websites, characterized in that, include: A layered information technology innovation adaptation architecture module is constructed to build the underlying information technology innovation environment based on server operating system, database and middleware. The hardware driver adaptation module and software interface conversion module are dynamically loaded through the environment adaptation layer to realize automatic identification and compatibility configuration of different models of servers and independently controllable components. A dynamic permission-data mapping mechanism module is established to extract user role permission data from the original website through the permission parsing module during the historical data migration process. Combined with preset multi-level permission rules, a permission-data association graph is generated. The migration tool uses the permission-data association graph to hierarchically mark the historical data and simultaneously completes data encryption storage and access permission binding. The knowledge base-data migration linkage module is implemented to start the intelligent indexing engine during data migration, automatically extract, classify and semantically annotate the structured business information and unstructured document content in the migrated data, generate knowledge units and write them into the independent knowledge base of the intelligent customer service in real time. The independent knowledge base is linked with the website user permission system and only opens the matching knowledge units to the corresponding permission roles. Deploy an adaptive security protection chain module to integrate a unified identity authentication interface and a dynamic encryption module. When a user logs in, multi-factor authentication and dynamic generation of session keys are triggered. During data transmission, a differentiated encryption strategy based on access roles is adopted, and sensitive operation logs are synchronized to the security audit center in real time, forming a full-process adaptive protection from identity verification to data transmission and operation auditing.

Images