Semantic graph-based access process generation method, apparatus, device, and storage medium

Abstract

This application discloses a method, apparatus, device, and storage medium for generating access processes based on semantic graphs, relating to the field of process management technology. The method includes: acquiring access requirement information, a preset semantic graph model, and a preset process template. The access requirement information includes user access type, access location, authentication method, and security policy; determining a multi-dimensional semantic graph based on the access requirement information and the preset semantic graph model, wherein the multi-dimensional semantic graph consists of semantic nodes and semantic edges, with semantic nodes having node attributes including weight and confidence scores, and semantic edges having edge attributes including cost functions; determining a process path based on the multi-dimensional semantic graph; and mapping the process path into the preset process template to obtain the target access process. This achieves the generation of controllable and traceable target access processes, thereby improving the automation capabilities and operational efficiency of intelligent network access systems.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of process management, and particularly relates to an access process generation method and device based on a semantic graph, equipment and a storage medium. BACKGROUND

[0002] With the continuous evolution of enterprise network architecture, access scenarios gradually show the trend of diversification and complication. Enterprises need to handle access requests from different types of users, different access locations and multiple authentication methods, while also implementing security policies and service distribution in the access process. In this process, the configuration of access devices, the execution of authentication processes, the matching of security policies and the linkage between various business modules are involved. Any mistake in any link may cause security risks or a decrease in operating efficiency.

[0003] In traditional technical means, enterprises often rely on manual modeling and static template methods to configure access processes. Operators usually need to set access logic and security policies step by step according to experience, or arrange access processes through fixed template methods. Such methods often lead to complicated configuration steps, and are difficult to flexibly adapt to different business scenarios, and are insufficient in linkage and expansion.

[0004] The above content is only used to assist in understanding the technical solutions of the present application, and does not represent the acknowledgement of the above content as prior art. SUMMARY

[0005] The main purpose of the present application is to provide an access process generation method, device, equipment and storage medium based on a semantic graph, aiming to solve the technical problem that the generation of access processes lacks controllability and adaptability in complex and variable network access scenarios.

[0006] To achieve the above purpose, the present application provides an access process generation method based on a semantic graph, which comprises:

[0007] obtaining access requirement information, a preset semantic graph model and a preset process template, wherein the access requirement information includes user access type, access location, authentication method and security policy;

[0008] determining a multi-dimensional semantic graph according to the access requirement information and the preset semantic graph model, wherein the multi-dimensional semantic graph is composed of semantic nodes and semantic edges, the semantic nodes have node attributes including weights and confidence scores, and the semantic edges have edge attributes including cost functions;

[0009] determining a process path according to the multi-dimensional semantic graph;

[0010] performing process mapping in the preset process template according to the process path to obtain a target access process.

[0011] In one embodiment, the step of determining the multidimensional semantic graph based on the access requirement information and the preset semantic graph model includes:

[0012] The user access type, access location, authentication method, and security policy of the access requirement information are instantiated into semantic nodes;

[0013] Determine the preset process dependency table based on the preset semantic graph model;

[0014] Based on the preset process dependency table, directed connections are established between the semantic nodes to obtain initial semantic edges;

[0015] Based on the business compatibility matrix of the preset semantic graph model, the initial semantic edges are filtered to obtain compatible connections, and a multidimensional semantic graph is determined based on the compatible connections.

[0016] In one embodiment, the step of instantiating the user access type, access location, authentication method, and security policy of the access requirement information into semantic nodes includes:

[0017] An initial node is generated based on the user access type, access location, authentication method, and security policy in the access requirement information.

[0018] When the initial node has a parent node, the inherited node is obtained according to the basic attributes and initial weights inherited by the initial node from its parent node;

[0019] Based on the business definition of the initial node, the basic attributes and initial weights of the inherited nodes are updated to obtain semantic nodes.

[0020] In one embodiment, after the steps of filtering the initial semantic edges according to the business compatibility matrix of the preset semantic graph model to obtain compatible connections, and determining the multidimensional semantic graph based on the compatible connections, the method further includes:

[0021] Obtain the condition dependency steps, and determine the business conditions based on the condition dependency steps;

[0022] When the access requirement information meets the business conditions, the first semantic node corresponding to the authentication process and the second semantic node corresponding to the policy issuance process are searched in the multidimensional semantic graph.

[0023] Determine semantic edges based on the first semantic node and the second semantic node;

[0024] The semantic edge is associated with the preset process template to obtain the updated preset process template.

[0025] In one embodiment, the step of determining the process path based on the multidimensional semantic graph includes:

[0026] The starting node and target node are determined based on the access requirement information of the multidimensional semantic graph;

[0027] Based on the path planning strategy, the starting node, and the target node, potential paths are determined, wherein the potential paths are all potential paths that can reach the target node from the starting node in the multidimensional semantic graph;

[0028] The process cost of the semantic edges on the potential path is calculated based on the weight and confidence score of the semantic nodes to obtain the total path cost.

[0029] The process path is determined by selecting the corresponding potential path based on the total cost of the path.

[0030] In one embodiment, the step of calculating the process cost of the semantic edges on the potential path based on the weights and confidence scores of the semantic nodes to obtain the total path cost includes:

[0031] The process processing time, security level weight, and strategy complexity weight are obtained based on the preset cost function.

[0032] The process cost is calculated based on the confidence score, the process processing time, the security level weight, and the strategy complexity weight.

[0033] The total cost of the path is determined based on the process cost.

[0034] In one embodiment, after the step of mapping the process according to the process path in the preset process template to obtain the target access process, the method further includes:

[0035] Obtain the historical execution success rate, fault records, and preset success rate threshold of the target access process;

[0036] When the historical execution success rate is greater than the preset success rate threshold, the weight of the semantic node corresponding to the historical execution success rate is increased;

[0037] If a fault is detected in the fault record, the weight of the semantic node corresponding to the fault record is reduced.

[0038] In addition, to achieve the above objectives, this application also proposes an access process generation device based on semantic graphs. The access process generation device based on semantic graphs includes: a data acquisition module, used to acquire access requirement information, a preset semantic graph model and a preset process template. The access requirement information includes user access type, access location, authentication method and security policy.

[0039] A semantic graph generation module is used to determine a multidimensional semantic graph based on the access requirement information and the preset semantic graph model. The multidimensional semantic graph consists of semantic nodes and semantic edges. The semantic nodes have node attributes including weights and confidence scores, and the semantic edges have edge attributes including cost functions.

[0040] The path determination module is used to determine the process path based on the multidimensional semantic graph;

[0041] The process mapping module is used to perform process mapping in the preset process template according to the process path to obtain the target access process.

[0042] Furthermore, to achieve the above objectives, this application also proposes a semantic graph-based access process generation device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the semantic graph-based access process generation method described above.

[0043] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the semantic graph-based access process generation method described above.

[0044] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the semantic graph-based access process generation method described above.

[0045] One or more technical solutions proposed in this application have at least the following technical effects:

[0046] By acquiring access requirement information including user access type, access location, authentication method, and security policy, along with a pre-defined semantic graph model and pre-defined process template, this technology provides precise requirement basis and basic model support for subsequent process generation. This solves the problem of ambiguous requirement input and lack of a unified basic model in traditional process configuration, which leads to unclear direction in subsequent process generation. Furthermore, by determining a multi-dimensional semantic graph based on the access requirement information and the pre-defined semantic graph model—comprising semantic nodes and semantic edges with weighted and confidence score node attributes and cost function edge attributes—the semantic relationships, priorities, and constraints of access process-related elements are clearly quantified, breaking through the limitations of traditional manual modeling or static methods. The limitations of ambiguous element relationships and lack of quantifiable attribute support in templates solve the problems of weak linkage and poor adaptability of process elements in traditional methods. Furthermore, by determining the process path based on a multi-dimensional semantic graph and filtering the path using explicit node and edge attributes in the semantic graph, it avoids the problems of uncontrollable and untraceable process paths in reasoning based on unstructured corpora of large language models, thus solving the problems of strong process uncertainty and lack of traceability in existing generation technologies based on large language models. Finally, by mapping the process path into a preset process template to obtain the target access process, it achieves structured generation and rapid implementation of the process, solving the problems of cumbersome and inefficient traditional manual process configuration. Compared with existing technologies, this method, through the gradual advancement of the above series of technical means, ultimately achieves controllable and traceable target access process generation, with improved adaptability and generation efficiency, meeting the needs of access scenarios with high stability and security requirements, and improving the automation capabilities and operational efficiency of intelligent network access systems. Attached Figure Description

[0047] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0048] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0049] Figure 1 This is a flowchart illustrating an embodiment of the semantic graph-based access process generation method of this application.

[0050] Figure 2 This is a schematic diagram of the access process generation method based on semantic graphs provided in Embodiment 2 of this application;

[0051] Figure 3This is a schematic diagram of the module structure of the access process generation device based on semantic graphs according to an embodiment of this application;

[0052] Figure 4 This is a schematic diagram of the device structure of the hardware operating environment involved in the access process generation method based on semantic graphs in the embodiments of this application.

[0053] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0054] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0055] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0056] The main solution of this application embodiment is as follows: First, obtain access requirement information, a preset semantic graph model, and a preset process template. The access requirement information includes user access type, access location, authentication method, and security policy. Second, determine a multidimensional semantic graph based on the access requirement information and the preset semantic graph model. The multidimensional semantic graph consists of semantic nodes and semantic edges. The semantic nodes have node attributes including weight and confidence score, and the semantic edges have edge attributes including cost function. Third, determine a process path based on the multidimensional semantic graph. Fourth, perform process mapping in the preset process template based on the process path to obtain the target access process.

[0057] In this embodiment, for ease of description, the following description will focus on identifying the access process generation device based on the semantic graph.

[0058] Because existing technologies lack controllability and adaptability in complex and ever-changing network access scenarios, this application provides a solution. By acquiring access requirement information including user access type, access location, authentication method, and security policy, along with a preset semantic graph model and preset process template, this provides precise requirement basis and basic model support for subsequent process generation. This solves the problem of unclear requirement input and lack of a unified basic model in traditional process configuration, leading to unclear direction of subsequent process generation. Furthermore, by determining a multi-dimensional semantic graph based on the access requirement information and preset semantic graph model, consisting of semantic nodes and semantic edges with weighted and confidence score node attributes and cost function edge attributes, this enables semantic association and prioritization of access process-related elements. The constraints are clearly quantified, overcoming the limitations of vague element relationships and lack of quantified attribute support in traditional manual modeling or static templates. This solves the problems of weak linkage and poor adaptability of process elements in traditional methods. Furthermore, by determining the process path based on a multi-dimensional semantic graph and filtering the path using clearly defined node and edge attributes in the semantic graph, the uncontrollable and untraceable process paths encountered in unstructured corpus reasoning based on large language models are avoided. This addresses the issues of strong process uncertainty and lack of traceability in existing large language model-based generation technologies. Finally, by mapping the process path into a preset process template, the target access process is obtained, achieving structured generation and rapid deployment of the process. This solves the problems of cumbersome and inefficient traditional manual process configuration. Compared with existing technologies, this method, through the gradual advancement of the above series of technical means, ultimately achieves controllable and traceable target access process generation, with improved adaptability and generation efficiency. This meets the needs of access scenarios with high stability and security requirements, and improves the automation capabilities and operational efficiency of intelligent network access systems.

[0059] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device capable of implementing the above functions, such as a semantic graph-based access process generation device. The following description uses a semantic graph-based access process generation device as an example to illustrate this embodiment and the subsequent embodiments.

[0060] Based on this, embodiments of this application provide a method for generating access processes based on semantic graphs, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the access process generation method based on semantic graphs in this application.

[0061] In this embodiment, the access process generation method based on semantic graphs includes steps S10 to S40:

[0062] Step S10: Obtain access requirement information, preset semantic graph model and preset process template. The access requirement information includes user access type, access location, authentication method and security policy.

[0063] It should be noted that access requirement information is a set of key information that must be provided when initiating an access request to clarify access-related requirements. Its core function is to provide a basis for generating an access process that meets actual needs. This information specifically includes several dimensions such as user access type, access location, authentication method, and security policy. Each dimension corresponds to an indispensable key requirement in the access process. For example, the user access type determines the access scenario attributes, and the access location affects the allocation direction of network resources.

[0064] The pre-built semantic graph model is a structured model that is constructed beforehand to describe the semantic relationships between objects in the access process. It serves as the foundational framework for building a multi-dimensional semantic graph. Through defined semantic logic and association rules, it supports the matching of access requirement information with semantic elements, ensuring that the generation of the access process follows the established semantic relationship system.

[0065] Pre-defined process templates are a collection of standardized process components that are pre-designed and stored, and can be used to quickly generate access processes. These templates are built based on common access scenarios and business requirements. Each template corresponds to a specific access process framework. When mapping according to the process path later, the corresponding template components can be directly called, which greatly improves the efficiency of access process generation.

[0066] User access type is a category identifier used to distinguish the scenario or method to which a user initiates an access request. Different user access types correspond to different access requirements and technical implementation paths. For example, remote office access and local area network access are different user access types. Identifying the type is an important prerequisite for determining the key steps in the subsequent access process.

[0067] Access location refers to the geographical or network area where a user initiates an access request. Different access locations can affect network resource scheduling, the application of region-specific security policies, and may result in differences in network node selection and region-specific security verification.

[0068] Authentication methods are the means and methods used to verify the legitimacy of a user's identity. Their core purpose is to ensure that only authorized and legitimate users can successfully access the system. Common authentication methods include multi-factor authentication (MFA) and password authentication. Different authentication methods differ in terms of security and operational complexity, and the appropriate method must be selected based on the security requirements of the access scenario.

[0069] A security policy is a set of rules and measures established to ensure network and data security during the access process. These policies cover multiple aspects such as access control, data transmission encryption, and behavior auditing during the access process. For example, restricting access permissions to specific access locations and encrypting transmitted data are concrete manifestations of security policies.

[0070] Understandably, it's necessary to collect and acquire three types of key information and model templates required for access. First, access requirement information is needed, clearly defining the user access type, access location, authentication method, and security policy. This information directly reflects the user's actual access needs and security requirements, serving as the core basis for subsequent process generation. Next, a pre-built semantic graph model needs to be acquired. This model is a pre-constructed semantic association framework that provides the foundation for matching access requirements with semantic elements. Finally, pre-built process templates are also needed. These standardized process components will support subsequent process mapping. By acquiring these three key types of information, a solid foundation is laid for subsequently building a multi-dimensional semantic graph based on access requirements, determining process paths, and generating the target access process, ensuring that the entire access process generation process can proceed in an orderly manner around the user's actual needs. In this embodiment, if an enterprise user initiates an access request, the acquired access requirement information may include: user access type is remote work, access location is Shanghai, authentication method is multi-factor authentication, and security policy is enabled behavior auditing. Simultaneously, a pre-built semantic graph model suitable for enterprise network access scenarios and pre-built process templates containing common process steps such as identity authentication, network configuration, and policy distribution are also acquired.

[0071] Step S20: Determine a multidimensional semantic graph based on the access requirement information and the preset semantic graph model. The multidimensional semantic graph consists of semantic nodes and semantic edges. The semantic nodes have node attributes including weights and confidence scores, and the semantic edges have edge attributes including cost functions.

[0072] It should be noted that the multidimensional semantic graph is a structured graph built based on access requirement information and a pre-defined semantic graph model. It is used to comprehensively describe the semantic elements and their relationships in the access process. It shows the semantic relationships of related elements in the access process from multiple dimensions (such as device dimension, authentication dimension, security dimension, etc.), and can more comprehensively and accurately reflect the complex logic of the access process. It is the core basis for subsequently determining the process path.

[0073] Semantic nodes are the basic units in a multidimensional semantic graph used to represent various objects or concepts in the access process. Each semantic node corresponds to a specific element in the access process, such as a multi-factor authentication node in the authentication process or a region configuration node in the network configuration process. It is a fundamental component of the multidimensional semantic graph and carries key information related to the access process.

[0074] Semantic edges are the links in a multidimensional semantic graph used to connect different semantic nodes and represent the semantic relationships between them. They can clarify the logical relationships between different semantic nodes, such as sequential execution relationships and dependency relationships. Through the connection of semantic edges, the nodes in the multidimensional semantic graph form an ordered association system, reflecting the logical direction of the access process.

[0075] Node attributes are information attached to semantic nodes that describes their features and characteristics. In this step, node attributes include weights and confidence scores. These attributes provide a quantitative basis for prioritizing semantic nodes and assessing their reliability. For example, semantic nodes with higher weights will be given priority in process path selection.

[0076] Weight is a quantitative indicator in node attributes used to measure the importance or priority of a semantic node in the access process. The magnitude of the weight directly reflects the degree of influence of the semantic node on the entire access process. The higher the value, the stronger the importance of the node in process decision-making and path selection. For example, in scenarios with high security requirements, the weight of security-related semantic nodes will be set higher.

[0077] The confidence score is a quantitative metric used in node attributes to evaluate the reliability or effectiveness of a semantic node. This score is typically calculated based on the credibility of the data source or historical execution success rate. A higher score indicates greater reliability of the semantic node in the access process. For example, a node with a high historical execution success rate for a particular authentication method will have a correspondingly higher confidence score.

[0078] Edge attributes are information attached to semantic edges that describes their characteristics and constraints. In this step, edge attributes include cost functions. These attributes clarify the cost of the associations between nodes connected by the semantic edges, providing a basis for optimizing the selection of process paths.

[0079] The cost function is a function in edge attributes used to measure the association cost or resource consumption between nodes connected by a semantic edge. It comprehensively considers various factors in the access process, such as processing time, security, and policy complexity. The calculated cost value can help determine the cost of different semantic edge connection paths, providing a quantitative reference for selecting the optimal process path.

[0080] Understandably, a multi-dimensional semantic graph that meets the current access requirements is constructed based on the obtained access requirement information and a pre-defined semantic graph model. First, based on the user access type, access location, authentication method, and security policy information in the access requirement information, semantic elements related to the current access requirements are selected from the pre-defined semantic graph model and transformed into corresponding semantic nodes. Each semantic node is assigned a node attribute containing weight and confidence score. The weight is determined according to the importance of the access requirement; for example, in a remote office access scenario, the weight of authentication-related nodes will be higher than other non-critical nodes. The confidence score is calculated based on the data source credibility or historical execution success rate. Then, according to the logical relationship of the access process and the association rules in the pre-defined semantic graph model, semantic edges are established between related semantic nodes, clarifying the sequential execution, dependencies, and other associations between nodes. Finally, each semantic edge is assigned an edge attribute containing a cost function. The cost function comprehensively considers factors such as processing time, security, and policy complexity to measure the cost of association between nodes. Through this series of operations, a multi-dimensional semantic graph is ultimately formed, consisting of semantic nodes and semantic edges, with each node and edge having corresponding attributes. In this embodiment, based on the access requirements information of enterprise users working remotely, accessing Shanghai, using multi-factor authentication, and enabling behavior auditing, and a preset semantic graph model, semantic nodes such as remote office access nodes, Shanghai regional nodes, multi-factor authentication nodes, and behavior auditing nodes are selected. Multi-factor authentication nodes are assigned higher weights and higher confidence scores, while regional nodes are assigned lower weights. Semantic edges are established between multi-factor authentication nodes and subsequent policy distribution nodes, and a cost function is set for these semantic edges. The association cost is calculated by comprehensively considering factors such as authentication processing time and security assurance level.

[0081] In one feasible implementation, step S20 may include steps S21 to S24:

[0082] Step S21: Instantiate the user access type, access location, authentication method, and security policy of the access requirement information into semantic nodes;

[0083] It should be noted that semantic nodes are the basic units that constitute a multidimensional semantic graph. Each semantic node corresponds to a specific piece of information in the access requirement and has a unique identifier to distinguish different nodes, such as the identifier "Access Type_Remote" for office work. At the same time, semantic nodes also have attributes such as weight and confidence score. These attributes reflect the importance and reliability of the node in the access process and are key bases for subsequent path selection and process generation.

[0084] Understandably, this involves clearly defining the specific values ​​for the four elements in the access requirement information: user access type, access location, authentication method, and security policy. For example, the user access type might be remote work, the access location might be Shanghai, the authentication method might be multi-factor authentication, and the security policy might be enabled behavior auditing. A corresponding semantic node is created for each specific element, and each node is assigned a unique identifier consisting of a category and a specific value, such as "Access Type_Remote Work" or "Access Location_Shanghai". Then, an initial weight and confidence score are set for each semantic node. The weight can be determined according to business rules; for example, security-related nodes have higher weights. The confidence score can be determined based on the historical success rate of similar nodes; nodes with higher success rates have higher confidence scores. These operations complete the transformation from abstract requirement information to specific semantic nodes. In this embodiment, in the access requirement information of enterprise users, if the user access type is remote office, it is instantiated as the semantic node "Access Type_Remote Office"; if the access location is Shanghai, it is instantiated as the semantic node "Access Location_Shanghai"; if the authentication method is multi-factor authentication, it is instantiated as the semantic node "Authentication Method_Multi-factor Authentication"; if the security policy is to enable behavior auditing, it is instantiated as the semantic node "Security Policy_Enable Behavior Auditing".

[0085] Step S22: Determine the preset process dependency table based on the preset semantic graph model;

[0086] It should be noted that the preset process dependency table is a tabular data that records the execution order and dependencies between various semantic node categories in the access process. The table clearly indicates which node categories need to be executed before other node categories, such as "the authentication method node needs to be executed before the security policy node." This dependency relationship is determined based on the business logic and the actual needs of the access process, ensuring that the execution order of the access process conforms to business specifications. It is the core basis for establishing directed connections between nodes in the future.

[0087] Understandably, the module storing business rules in the preset semantic graph model is invoked. This module stores a large amount of process dependency logic based on historical access business summaries. Then, content related to the execution order and dependency relationships of semantic node categories is filtered from these business rules. For example, rules such as "the access type node is the starting node of the process, and can subsequently connect to the authentication method node" and "the access location node can only be connected after the authentication method node has been executed" are filtered out. The filtered dependency rules are then organized into a table according to a unified format. The table typically contains three columns: the category of the preceding node, the category of the following node, and the dependency description, clearly presenting the dependency relationships between nodes. Finally, through such extraction, filtering, and organization operations, a complete preset process dependency table that meets business requirements is determined. In this embodiment, the dependency rules extracted from the preset semantic graph model include "the access type node is the starting node of the process and can connect to the authentication method node," "when the authentication method node is a preceding node, the following node can be an access location node," and "when the access location node is a preceding node, the following node can be a security policy node." After organizing these rules, the corresponding preset process dependency table is obtained.

[0088] Step S23: Establish directed connections between the semantic nodes according to the preset process dependency table to obtain initial semantic edges;

[0089] It's important to note that a directed connection is a directional association established between two semantic nodes. This direction represents the execution order of the corresponding steps in the access process, i.e., from the preceding node to the succeeding node. This means that the steps corresponding to the preceding node must be completed before the steps corresponding to the succeeding node can proceed. Directed connections clearly demonstrate the logical flow of the access process, avoiding confusion in the relationships between nodes, and are the basic form for constructing semantic edges.

[0090] Initial semantic edges are preliminary semantic associations formed by establishing directed connections between instantiated semantic nodes based on a pre-defined process dependency table. They only consider the sequential execution dependencies between nodes and have not yet verified business compatibility. Some associations may not conform to business logic. They serve as the initial objects for subsequent semantic edge filtering, carrying preliminary process logic association information between nodes.

[0091] Understandably, the category to which each instantiated semantic node belongs is explicitly defined. For example, "Access Type_Remote Office" belongs to the Access Type node category, and "Authentication Method_Multi-Factor Authentication" belongs to the Authentication Method node category. Then, a pre-defined process dependency table is queried to find the preceding or following node category for each node category. For instance, according to the dependency table, the following node category for the Access Type node category is the Authentication Method node category. Based on the queried dependencies, directed connections are established between the corresponding semantic nodes, with the connection direction from the preceding node to the following node. For example, a directed connection is established between the "Access Type_Remote Office" node and the "Authentication Method_Multi-Factor Authentication" node, pointing from the former to the latter. Similarly, directed connections are established for all semantic nodes that match the dependencies. For instance, according to the dependency table, the following node category for the Authentication Method node category is the Access Location node category, so a directed connection is established between the "Authentication Method_Multi-Factor Authentication" node and the "Access Location_Shanghai" node. Finally, these established directed connections are defined as initial semantic edges, completing the construction of the initial semantic edges. In this embodiment, the instantiated semantic nodes include "Access Type_Remote Office", "Authentication Method_Multi-Factor Authentication", "Access Location_Shanghai", and "Security Policy_Enable Behavior Auditing". Based on the dependency relationships of "Access Type Node, Authentication Method Node, Access Location Node, and Security Policy Node" in the preset process dependency table, directed connections are established between "Access Type_Remote Office" and "Authentication Method_Multi-Factor Authentication", "Authentication Method_Multi-Factor Authentication" and "Access Location_Shanghai", and "Security Policy_Enable Behavior Auditing". These directed connections are the initial semantic edges.

[0092] Step S24: Based on the business compatibility matrix of the preset semantic graph model, the initial semantic edges are filtered to obtain compatible connections, and a multidimensional semantic graph is determined based on the compatible connections.

[0093] It's important to note that the business compatibility matrix is ​​a pre-defined semantic graph model used to determine whether different semantic nodes can be logically linked in a valid way. The rows and columns of the matrix correspond to different semantic nodes or semantic node categories. The elements in the matrix identify the compatibility relationship between corresponding row and column nodes; for example, a compatible element indicates that two nodes can be linked, while an incompatible element indicates that they cannot be linked. It is designed based on business scenarios and security requirements, effectively filtering out node associations that do not conform to business logic, and is an important tool for ensuring the rationality of the integration process.

[0094] Compatible connections are semantic associations that remain after the initial semantic edges have been filtered by the business compatibility matrix. They satisfy both the execution order logic in the preset process dependency table and the compatibility rules in the business compatibility matrix. They are effective semantic edges that constitute a multidimensional semantic graph, ensuring that the associations between nodes in the access process meet both the execution order requirements and the business logic requirements.

[0095] This can be understood as follows: First, obtain the business compatibility matrix from the preset semantic graph model, clarifying the semantic nodes corresponding to the matrix rows and columns and the compatibility relationships represented by the elements. Then, extract each initial semantic edge one by one, determine its start and end nodes, and query the matrix to determine whether they are compatible. If compatible, retain the initial semantic edge; otherwise, discard it. The retained initial semantic edges are the compatible connections. Finally, integrate the semantic nodes and compatible connections, adding weights and confidence scores to the nodes and cost functions to the compatible connections to form a multidimensional semantic graph. In this embodiment, all three initial semantic edges are found to be compatible after matrix querying and are retained as compatible connections. After integrating them with the four semantic nodes and adding attributes, the multidimensional semantic graph is determined.

[0096] In one feasible implementation, step S21 may include steps S211 to S213:

[0097] Step S211: Generate an initial node based on the user access type, access location, authentication method, and security policy in the access requirement information;

[0098] It should be noted that the initial node is a basic node generated directly based on the user access type, access location, authentication method, and security policy in the access requirement information, and it has not yet inherited the attributes of the parent node. It only carries the basic identification information corresponding to the access requirement.

[0099] Understandably, it's necessary to extract four key elements from the access requirement information: user access type, access location, authentication method, and security policy, specifying the exact value for each element. For each specific value, a corresponding initial node is created. Each initial node is assigned a unique identifier, typically composed of an information category and a specific value, clearly distinguishing different types of initial nodes. During this process, the initial node retains only the basic identifier information corresponding to the access requirement, without adding attributes such as weight or confidence score, thus completing the generation of the initial node.

[0100] Step S212: When the initial node has a parent node, the inheriting node is obtained according to the basic attributes and initial weights inherited by the initial node from its parent node.

[0101] It should be noted that a parent node is a node in the semantic graph system that has a hierarchical relationship with the initial node and is located above the initial node. It carries the basic attributes and initial weights common to a certain type of node.

[0102] Basic attributes are attribute information shared by a certain type of node and carried by the parent node, used to describe the core characteristics of the node. Different types of parent nodes have different basic attributes. For example, the basic attributes of a parent node of the "Access Location_Regional Node" type may include regional network bandwidth thresholds and regional firewall rules. These attributes are common features that initial nodes need to inherit to ensure that nodes of the same type have a unified basic attribute benchmark.

[0103] The initial weight is an initial quantitative indicator shared by a certain type of node and carried by the parent node. It is used to measure the importance of a node in the access process. It is based on the common business rules of nodes of the same type.

[0104] An inherited node is formed when an initial node, in the presence of a parent node, inherits the basic attributes and initial weights of the parent node. It retains the basic identifier of the initial node and adds common attributes and initial weights inherited from the parent node. It is an intermediate node connecting the initial node and the final semantic node, realizing the transfer and inheritance of common attributes between nodes.

[0105] Understandably, it's necessary to determine whether each initial node has a corresponding parent node, based on a pre-defined node hierarchy table within the semantic graph system. If the query finds that an initial node has a parent node, the basic attributes and initial weights of that parent node are extracted from the semantic graph system. Then, the extracted basic attributes and initial weights of the parent node are assigned to the corresponding initial node, allowing the initial node to retain its original basic identifier while adding common basic attributes and initial weights inherited from the parent node. The node formed after this operation is the inherited node.

[0106] Step S213: Based on the business definition of the initial node, update the basic attributes and initial weights of the inherited node to obtain a semantic node.

[0107] Understandably, this involves extracting the business definition corresponding to each initial node. This definition includes personalized business characteristics and attribute adjustment rules for the access scenario corresponding to that initial node. Based on the extracted business definition, the original basic attributes of the inherited nodes are adjusted, adding or modifying content that matches the specific business scenario to make the basic attributes more aligned with actual access requirements. Then, also combining information from the business definition, such as the importance of the business scenario and historical execution results, the initial weights of the inherited nodes are adjusted to better reflect the actual importance of the node in the specific scenario. Finally, a confidence score is calculated based on historical data from the business definition. The updated basic attributes, initial weights, and confidence score are then combined to form a semantic node with complete attributes. By updating basic attributes based on business definitions, the characteristics of semantic nodes are made more aligned with the needs of specific access scenarios, avoiding a disconnect between attributes and actual business. On the other hand, by combining historical data updates and confidence scores in the business definitions, the quantitative attributes of semantic nodes can better reflect the actual business value and reliability, allowing subsequent path selection to prioritize efficient and reliable nodes. At the same time, complete semantic node attributes also provide accurate data support for subsequent semantic edge construction and process path optimization, improving the accuracy and adaptability of access process generation.

[0108] In one feasible implementation, after step S24, the method may further include: obtaining a condition dependency step and determining business conditions based on the condition dependency step; when the access requirement information meets the business conditions, searching for a first semantic node corresponding to the authentication process and a second semantic node corresponding to the policy issuance process in the multidimensional semantic graph; determining semantic edges based on the first semantic node and the second semantic node; and associating the semantic edges with a preset process template to obtain an updated preset process template.

[0109] It should be noted that the first semantic node is the semantic node in the multidimensional semantic graph that corresponds to the authentication process and carries authentication-related information. This node has attributes such as authentication method, authentication weight, and authentication confidence score. The second semantic node is the semantic node in the multidimensional semantic graph that corresponds to the policy issuance process and carries policy issuance-related information. This node has attributes such as policy type, policy weight, and policy execution requirements.

[0110] Additionally, condition-dependent steps are related steps in the access process that can only be triggered based on specific scenarios or requirements. These steps are not executed in all access scenarios, but only when preset conditions are met.

[0111] Furthermore, updating the preset process template involves integrating the process logic corresponding to the newly established semantic edge into the original preset process template, forming a process template adapted to specific conditions and scenarios. While retaining the core logic of the original template, it adds condition-triggered process content, enabling the template to cover more subdivided access scenarios and improving the template's adaptability and usability.

[0112] Understandably, the process begins by retrieving conditional dependencies and determining business conditions. These conditional dependencies are associated steps within the access process that need to be triggered based on specific scenarios. From these steps, business conditions for determining whether to add a semantic edge are extracted. Next, it is determined whether the access requirement information meets these business conditions. If so, the first semantic node corresponding to the authentication process and the second semantic node corresponding to the policy issuance process are located in the constructed multi-dimensional semantic graph. Then, based on the business association logic of these two nodes, a semantic edge is established between them for connection. Finally, the newly established semantic edge is associated with a preset process template, and the process logic corresponding to the semantic edge is integrated into the preset process template to form an updated preset process template. By adding semantic edges based on the conditional dependency steps and updating the preset process template, the scenario adaptability and flexibility of the access process are further improved. On the one hand, semantic edges are added only when business conditions are met, avoiding redundant node connections in scenarios where the process logic is not needed, thus ensuring process simplicity. On the other hand, the updated preset process templates can adapt to subdivided access scenarios, such as mobile terminal access and specific area access, without the need to rebuild templates for different scenarios, reducing template development costs. At the same time, it also allows subsequent process generation to more accurately match specific access requirements, improving the targeting and execution efficiency of the access process.

[0113] Step S30: Determine the process path based on the multidimensional semantic graph;

[0114] It should be noted that the process path is an ordered sequence of semantic nodes and semantic edges formed in the multidimensional semantic graph, from the starting semantic node to the target semantic node of the access process. It reflects the specific execution order and logical direction of the access process from start to finish. Each process path corresponds to a complete access process execution plan and is the direct basis for subsequent process mapping to generate the target access process.

[0115] Understandably, based on the constructed multidimensional semantic graph, a process path from the starting semantic node to the target semantic node that meets the access requirements is selected. First, the starting and target semantic nodes of the access process are clearly defined. The starting semantic node typically corresponds to the initial stage of the access process, such as the semantic node corresponding to the user access type, while the target semantic node corresponds to the final target stage of the access process, such as the semantic node corresponding to policy issuance. Based on information such as the weights, confidence scores, and cost functions of semantic nodes in the multidimensional semantic graph, all possible paths from the starting node to the target node in the multidimensional semantic graph are evaluated. During the evaluation process, paths with high semantic node weights, high confidence scores, and low costs calculated by the semantic edge cost function are prioritized. Simultaneously, it is necessary to consider whether the logical relationships between nodes conform to the business rules of the access process; for example, the authentication node must precede the policy issuance node. Through this evaluation and selection, an optimal or most suitable process path for the current access requirements is finally determined. In this embodiment, the starting semantic node of the multidimensional semantic graph is the remote office access node, and the target semantic node is the policy distribution node. By evaluating the weight, confidence score, and edge cost of the nodes in each possible path, the process path that includes the remote office access node, multi-factor authentication node, Shanghai area configuration node, behavior audit node, and policy distribution node is finally determined.

[0116] In one feasible implementation, step S30 may include steps S31 to S34:

[0117] Step S31: Determine the starting node and the target node based on the access requirement information of the multidimensional semantic graph;

[0118] It should be noted that the starting node is a semantic node in the multidimensional semantic graph that represents the beginning of the access process. It directly corresponds to the initiation requirement dimension in the access requirement information and is the starting point of the access process path. This node has attributes related to the initiation stage, and all subsequent potential paths start from this node, which is the basic starting point for path planning.

[0119] The target node is a semantic node in the multidimensional semantic graph that represents the final target stage of the access process. It directly corresponds to the target requirement dimension in the access requirement information and is the end point of the access process path. All potential path planning aims to reach this node, which is the core basis for judging whether the path is complete.

[0120] Understandably, key content that defines the start and end points of the access process can be extracted from the access requirement information associated with the multidimensional semantic graph. Core dimensions such as user access type and security policy objectives in the access requirement information directly correspond to specific semantic nodes in the multidimensional semantic graph. The node representing the beginning of the access process is the starting node, which usually corresponds to the initiating requirement dimension such as user access type. The node representing the final target stage of the access process is the target node, which usually corresponds to the requirement target dimension such as security policy implementation and service configuration completion. By matching the core dimensions of the access requirement information with the semantic nodes in the multidimensional semantic graph, the starting node and the target node can be clearly distinguished and determined.

[0121] Step S32: Determine potential paths based on the path planning strategy, the starting node, and the target node, wherein the potential paths are all potential paths that can reach the target node from the starting node in the multidimensional semantic graph;

[0122] The path planning strategy is a set of pre-defined rules used to filter paths from the starting node to the target node in a multidimensional semantic graph. The strategy is set based on the business logic and priority of the access process. Common rules include traversing all non-cyclic paths, excluding low-confidence node paths, and prioritizing short paths. It determines the scope and criteria for filtering potential paths and is the core guiding rule for determining potential paths.

[0123] A potential path is a set of all paths that can reach the target node in a multidimensional semantic graph, starting from the starting node. It is a set of paths after being filtered by the path planning strategy. Each potential path consists of a series of semantic nodes and semantic edges connecting the nodes, representing a possible execution order of the access process, but has not yet been evaluated for cost. It is the basic object for calculating the total cost of the path and selecting the final process path.

[0124] Understandably, the first step is to define a pre-defined path planning strategy. This strategy is a set of rules used to filter paths from the starting node to the target node in a multidimensional semantic graph. Then, taking the starting node as the path origin, the path planning strategy is followed to traverse along the semantic edges between semantic nodes in the multidimensional semantic graph. During the traversal, the association rules between nodes in the semantic graph are followed to collect all paths that can start from the starting node and eventually reach the target node. These collected paths are the potential paths.

[0125] Step S33: Calculate the process cost of the semantic edges on the potential path based on the weight and confidence score of the semantic nodes to obtain the total path cost;

[0126] Process cost value is an indicator used to quantify the process cost corresponding to a semantic edge, calculated by using preset rules based on the weights and confidence scores of the two semantic nodes connected by the semantic edge. The higher the cost value, the higher the cost of the process link corresponding to the semantic edge. It is a quantitative standard for measuring the rationality of a single semantic edge process.

[0127] The total cost of a path is the overall cost metric obtained by summing the process costs of all semantic edges on a potential path. It represents the total cost of the access process corresponding to that potential path. The lower the total cost, the lower the process cost and the higher the rationality of the path. It is the core basis for selecting the final process path.

[0128] Understandably, the process involves first identifying all semantic edges on each potential path, as well as the weights and confidence scores of the two semantic nodes connected by each semantic edge. Then, based on the preset cost calculation rules, the process cost of each semantic edge on each potential path is calculated. Finally, the process cost of all semantic edges on the same potential path is summed to obtain the overall cost quantification index of the potential path, i.e., the total cost of the path.

[0129] In one feasible implementation, step S33 may include steps S331 to S333:

[0130] Step S331: Obtain the process processing time, security level weight, and strategy complexity weight according to the preset cost function;

[0131] It should be noted that the process processing time is the actual execution time of the process steps corresponding to the two semantic nodes connected by the semantic edge, which is usually obtained based on historical execution data statistics or real-time monitoring. The longer this time, the lower the efficiency of that process step.

[0132] Security level weight is a quantitative indicator set according to the security requirements of the corresponding process links of the semantic edge. The higher the security requirements of the process link, such as the links involving identity authentication and data encryption, the greater the weight value.

[0133] The strategy complexity weight is a quantitative indicator set based on the complexity of the strategies involved in the process links corresponding to the semantic edge. The more strategy rules involved in the process links and the more complex the logical nesting, such as access control policies containing multiple condition branches, the greater the weight value.

[0134] Understandably, the composition of the pre-defined cost function is clearly defined. This function is a pre-defined formula used to calculate the process cost value, and its core input parameters include process processing time, security level weight, and policy complexity weight. From the business data and configuration information associated with the multi-dimensional semantic graph, the process processing time corresponding to each semantic edge is extracted. This time represents the actual execution time of the process steps corresponding to the two semantic nodes connected by the semantic edge. Simultaneously, the security level weight related to the semantic edge is obtained from the attributes of the semantic nodes or the pre-defined business rule base. This weight is set based on the security requirements of the process steps. Finally, the policy complexity weight is extracted from the policy configuration document or the policy attributes of the semantic graph. This weight is determined based on the complexity of the policies involved in the process steps, thus completing the acquisition of these three parameters.

[0135] Step S332: Calculate the process cost based on the confidence score, the process processing time, the security level weight, and the strategy complexity weight.

[0136] Understandably, the formula for calculating the cost of a process can be... *Processing time of the entire workflow generation chain+ *Security+ *Policy complexity, where security refers to the level of protection for network resources, data transmission, and user identity throughout the entire access process and its subsequent execution; policy complexity refers to the complexity of rules such as security policies and network configuration policies involved in the access process, covering dimensions such as the number of policy rules, logical nesting levels, and the number of associated components. , as well as These are weights for process processing time, security level, and strategy complexity, respectively.

[0137] Security can be quantified by selecting key security-related aspects of the access process as evaluation dimensions, including but not limited to authentication strength, data transmission encryption level, access control granularity, and behavior audit coverage. Policy complexity can be quantified by using the number of policy rules, logical nesting levels, and the number of associated systems or components as evaluation dimensions to comprehensively reflect the policy's complexity.

[0138] Step S333: Determine the total path cost based on the process cost.

[0139] Understandably, this involves identifying all semantic edges within a potential path, and calculating the corresponding process cost for each semantic edge. Following the order of the semantic edges in the path, the process costs of all semantic edges are accumulated, ensuring no omissions or duplicates during the accumulation process—that is, the cost of each semantic edge is counted only once. Finally, the accumulated result is used as the overall cost indicator for the potential path, i.e., the total path cost, thus completing the calculation from the cost of a single semantic edge to the overall path cost.

[0140] Step S34: Select the corresponding potential path to determine the process path based on the total path cost.

[0141] Understandably, a predefined path selection rule is established, using the total path cost as the core criterion. Then, the total path costs of all potential paths are compared and analyzed according to the selection rule to filter out those that meet the rule requirements. Finally, the filtered potential paths are determined as the final process paths used to generate the access process, and these paths are the core basis for the execution order of the access process. In this embodiment, the predefined path selection rule can be to select the potential path with the lowest total path cost.

[0142] Step S40: Map the process according to the process path in the preset process template to obtain the target access process.

[0143] It should be noted that process mapping is the process of matching and mapping each semantic node and the relationships between nodes in a defined process path with specific process components in a preset process template, transforming the abstract semantic path into concrete, executable process steps. It is a key link connecting abstract semantic logic with concrete process implementation. Through process mapping, the process path determined based on the semantic graph can be transformed into process steps that conform to actual business operations.

[0144] The target access process is a specific, structured process plan generated through process mapping that can be directly used to guide access operations. It includes the specific operation content, execution order, and related parameters of each step in the access process. It is the final result of the access process generation and can be directly sent to the relevant execution system or platform for execution to meet the user's access requirements.

[0145] Understandably, based on a defined process path and a preset process template, a target access process is generated through process mapping. First, each semantic node in the process path and the relationships between nodes are analyzed to clarify the specific business operation steps corresponding to each node. Then, process components matching each semantic node and its relationships are found in the preset process template. For example, a multi-factor authentication node in the process path corresponds to a multi-factor authentication process component in the preset process template that includes authentication methods and steps. Next, the matched preset process template components are sequentially assembled according to the order of the semantic nodes in the process path. Simultaneously, based on specific parameters in the access requirements information, such as the access location (Shanghai) and the authentication method (multi-factor authentication), the assembled process components are configured to meet the specific requirements of the current access scenario. Finally, through this matching, assembling, and configuration, a target access process containing specific execution steps, operation content, and parameters is generated. In this embodiment, remote office access template component and multi-factor authentication template component are matched in the preset process template. These can be configured as LDAP combined with SMS authentication method, Shanghai area configuration template component, DMZ area, behavior audit template component, AuditX tool, policy distribution template component, rate limiting and logging rules. After these components are concatenated in sequence and configured with parameters, the target access process containing four specific steps is obtained: identity authentication, access network configuration, policy distribution, and behavior audit.

[0146] This embodiment provides a semantic graph-based access process generation method. By using the technical means of semantic graph-based access process generation, it solves the technical problems of low process generation efficiency, poor adaptability, and difficulty in meeting diverse access scenarios caused by the lack of accurate matching of complex access requirements in traditional access process generation methods. It achieves the beneficial effects of efficiently and accurately generating access processes that adapt to diverse access requirements, improving the efficiency and flexibility of access process generation, and ensuring network access security.

[0147] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in the first embodiment described above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 2 Following step S40, the semantic graph-based access process generation method further includes steps S50-S70:

[0148] Step S50: Obtain the historical execution success rate, fault records, and preset success rate threshold of the target access process;

[0149] It should be noted that the historical execution success rate is the proportion of successful executions in the past to the total number of executions of the target access process. It is a core quantitative indicator for measuring the reliability of the process. This indicator is associated with the semantic nodes corresponding to the process. The higher the success rate, the better the actual performance of the associated semantic nodes, which is a key basis for subsequently increasing the weight of nodes.

[0150] Fault logs are detailed records of anomalies and failures that occurred during the past execution of the target access process, including the time of occurrence, fault type, and associated semantic nodes. Each fault log must be precisely mapped to a specific semantic node, serving as the direct basis for subsequently reducing the weight of that node.

[0151] The preset success rate threshold is a standard value set in advance in the business rule base to determine whether the historical execution performance of the target access process meets the standard. This threshold is set based on the minimum requirements of the business for process reliability. If the historical execution success rate is higher than this threshold, it means that the process performance meets the standard; otherwise, it does not meet the standard. It is one of the judgment criteria for triggering node weight adjustment.

[0152] Understandably, it's crucial to define the set of semantic nodes corresponding to the target access process, as these semantic nodes are the core units constituting the process path. Relevant data from the past execution of this target access process is extracted from the business execution database. The historical execution success rate is the probability of success calculated based on the statistical results of multiple executions of the process, and can be calculated as the number of historical successful executions divided by the total number of executions. Fault records are detailed records of anomalies or failures that occurred during the past execution of the process; the specific semantic node (i.e., the fault-related node) corresponding to each fault record must be clearly identified. A preset success rate threshold is obtained from the preset business rule base. This threshold is a standard value set based on the business's requirements for process reliability and is used to determine whether the historical execution performance of the process meets the standard. This completes the acquisition of these three key pieces of information.

[0153] Step S60: When the historical execution success rate is greater than the preset success rate threshold, increase the weight of the semantic node corresponding to the historical execution success rate;

[0154] Understandably, the historical execution success rate of the target access process is compared with the preset success rate threshold to determine if the former is greater than the latter. If the result is yes, it means that the historical execution performance of the target access process is better than the business-defined standard, and it is necessary to further clarify all semantic nodes corresponding to the process, that is, the semantic nodes that constitute the process path. Next, the weight increase magnitude is obtained from the preset business rule base, such as a fixed increase of 0.1, or the increase magnitude is calculated as "(historical execution success rate - preset threshold) × 0.01", and the current weight of all related semantic nodes is adjusted upward according to this magnitude to complete the weight increase.

[0155] Step S70: If a fault is detected in the fault record, the weight of the semantic node corresponding to the fault record is reduced.

[0156] Understandably, the process involves analyzing the acquired target access process fault records to identify the specific semantic node corresponding to each fault record, i.e., the fault-associated node, ensuring the accuracy of the correspondence between faults and nodes. Next, the weight reduction margin is obtained from a pre-defined business rule base, such as a fixed reduction of 0.1, or a reduction calculated as "number of faults × 0.02". The current weight of the semantic node associated with each fault record is then adjusted downwards according to this margin. If the same semantic node is associated with multiple fault records, the reduction margin needs to be calculated cumulatively. For example, if it is associated with two fault records, and each record is reduced by 0.05, the total reduction is 0.1, completing the weight reduction of the fault-associated node.

[0157] This embodiment provides a semantic graph-based access process generation method. By adding monitoring and analysis of the historical execution success rate and fault records of the target access process to the semantic graph-based access process generation method, and dynamically adjusting the weight of semantic nodes according to a preset success rate threshold, it solves the technical problems in the prior art, such as the lack of feedback on the historical execution effect of the generated access process, which leads to lagging process optimization, difficulty in adapting to changes in dynamic access requirements, and inability to accurately assess process reliability. It achieves the beneficial effects of being able to dynamically optimize the access process based on historical execution data, improve process reliability and adaptability, and enhance the self-optimization capability of the access process generation method.

[0158] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the access process generation method based on semantic graphs in this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0159] This application also provides an access process generation device based on semantic graphs, please refer to... Figure 3 The semantic graph-based access process generation device includes:

[0160] Data acquisition module 10 is used to acquire access requirement information, preset semantic graph model and preset process template. The access requirement information includes user access type, access location, authentication method and security policy.

[0161] The semantic graph generation module 20 is used to determine a multidimensional semantic graph based on the access requirement information and the preset semantic graph model. The multidimensional semantic graph is composed of semantic nodes and semantic edges. The semantic nodes have node attributes including weights and confidence scores, and the semantic edges have edge attributes including cost functions.

[0162] The path determination module 30 is used to determine the process path based on the multidimensional semantic graph.

[0163] The process mapping module 40 is used to perform process mapping in the preset process template according to the process path to obtain the target access process.

[0164] The semantic graph-based access procedure generation apparatus provided in this application, employing the semantic graph-based access procedure generation method described in the above embodiments, can solve the technical problem of lack of controllability and adaptability in access procedure generation in complex and ever-changing network access scenarios. Compared with the prior art, the beneficial effects of the semantic graph-based access procedure generation apparatus provided in this application are the same as those of the semantic graph-based access procedure generation method provided in the above embodiments, and other technical features in the semantic graph-based access procedure generation apparatus are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0165] In one embodiment, the semantic graph generation module 20 is further configured to instantiate the user access type, access location, authentication method, and security policy of the access requirement information into semantic nodes; determine a preset process dependency table according to the preset semantic graph model; establish directed connections between the semantic nodes according to the preset process dependency table to obtain initial semantic edges; filter the initial semantic edges according to the business compatibility matrix of the preset semantic graph model to obtain compatible connections, and determine a multidimensional semantic graph according to the compatible connections.

[0166] In one embodiment, the semantic graph generation module 20 is further configured to generate an initial node based on the user access type, access location, authentication method, and security policy in the access requirement information; when the initial node has a parent node, to obtain an inherited node based on the basic attributes and initial weights inherited by the initial node from its parent node; and to update the basic attributes and initial weights of the inherited node according to the business definition of the initial node to obtain a semantic node.

[0167] In one embodiment, the semantic graph generation module 20 is further configured to obtain conditional dependency steps and determine business conditions based on the conditional dependency steps; when the access requirement information meets the business conditions, search for a first semantic node corresponding to the authentication process and a second semantic node corresponding to the policy issuance process in the multidimensional semantic graph; determine semantic edges based on the first semantic node and the second semantic node; and associate the semantic edges with a preset process template to obtain an updated preset process template.

[0168] In one embodiment, the path determination module 30 is further configured to: determine a starting node and a target node based on the access requirement information of the multidimensional semantic graph; determine potential paths based on the path planning strategy, the starting node, and the target node, wherein the potential paths are all potential paths in the multidimensional semantic graph that can reach the target node starting from the starting node; calculate the process cost of the semantic edges on the potential paths based on the weights and confidence scores of the semantic nodes to obtain the total path cost; and select the corresponding potential path to determine the process path based on the total path cost.

[0169] In one embodiment, the path determination module 30 is further configured to obtain the process processing time, security level weight, and strategy complexity weight according to a preset cost function; calculate the process cost value based on the confidence score, the process processing time, the security level weight, and the strategy complexity weight; and determine the total path cost based on the process cost value.

[0170] In one embodiment, the process mapping module 40 is further configured to obtain the historical execution success rate, fault records, and preset success rate threshold of the target access process; when the historical execution success rate is greater than the preset success rate threshold, increase the weight of the semantic node corresponding to the historical execution success rate; and when a fault record shows that a fault has occurred, decrease the weight of the semantic node corresponding to the fault record.

[0171] This application provides a semantic graph-based access process generation device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the semantic graph-based access process generation method in Embodiment 1 above.

[0172] The following is for reference. Figure 4 This document illustrates a structural diagram of a semantic graph-based access process generation device suitable for implementing embodiments of this application. The semantic graph-based access process generation device in these embodiments may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Figure 4The semantic graph-based access process generation device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0173] like Figure 4 As shown, the semantic graph-based access process generation device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in ROM (Read Only Memory) 1002 or a program loaded from storage device 1003 into RAM (Random Access Memory) 1004. RAM 1004 also stores various programs and data required for the operation of the semantic graph-based access process generation device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via bus 1005. Input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to I / O interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the semantic graph-based access procedure generation device to communicate wirelessly or wiredly with other devices to exchange data. Although a semantic graph-based access procedure generation device with various systems is shown in the figure, it should be understood that it is not required to implement or possess all the systems shown. More or fewer systems may be implemented alternatively.

[0174] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0175] The semantic graph-based access procedure generation device provided in this application, employing the semantic graph-based access procedure generation method described in the above embodiments, can solve the technical problem of lack of controllability and adaptability in access procedure generation in complex and ever-changing network access scenarios. Compared with the prior art, the beneficial effects of the semantic graph-based access procedure generation device provided in this application are the same as those of the semantic graph-based access procedure generation method provided in the above embodiments, and other technical features in this semantic graph-based access procedure generation device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0176] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0177] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0178] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the semantic graph-based access process generation method in the above embodiments.

[0179] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, RAM (Random Access Memory), ROM (Read Only Memory), Erasable Programmable Read Only Memory (EPROM), optical fiber, CD-ROM (CD-Read Only Memory), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0180] The aforementioned computer-readable storage medium may be included in a semantic graph-based access process generation device; or it may exist independently and not be assembled into a semantic graph-based access process generation device.

[0181] The aforementioned computer-readable storage medium carries one or more programs. When these programs are executed by a semantic graph-based access process generation device, the semantic graph-based access process generation device: acquires access requirement information, a preset semantic graph model, and a preset process template. The access requirement information includes user access type, access location, authentication method, and security policy. It then determines a multidimensional semantic graph based on the access requirement information and the preset semantic graph model. The multidimensional semantic graph consists of semantic nodes and semantic edges. The semantic nodes have node attributes including weights and confidence scores, and the semantic edges have edge attributes including cost functions. Finally, it determines a process path based on the multidimensional semantic graph and performs process mapping in the preset process template based on the process path to obtain the target access process.

[0182] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including LAN (Local Area Network) or WAN (Wide Area Network)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0183] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0184] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0185] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described semantic graph-based access procedure generation method. This addresses the technical problem of the lack of controllability and adaptability in access procedure generation within complex and ever-changing network access scenarios. Compared to existing technologies, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the semantic graph-based access procedure generation method provided in the above embodiments, and will not be elaborated upon here.

[0186] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the semantic graph-based access process generation method described above.

[0187] The computer program product provided in this application can solve the technical problem of the lack of controllability and adaptability in the generation of access procedures in complex and ever-changing network access scenarios. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the semantic graph-based access procedure generation method provided in the above embodiments, and will not be repeated here.

[0188] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A semantic graph based access flow generation method, characterized in that, The method comprises: acquiring access requirement information, a preset semantic graph model, and a preset process template, wherein the access requirement information comprises a user access type, an access location, an authentication method, and a security policy; determining a multi-dimensional semantic graph according to the access requirement information and the preset semantic graph model, wherein the multi-dimensional semantic graph is composed of semantic nodes and semantic edges, the semantic nodes have node attributes comprising weights and confidence scores, and the semantic edges have edge attributes comprising cost functions; determining a process path according to the multi-dimensional semantic graph; performing process mapping in the preset process template according to the process path to obtain a target access process.

2. The method of claim 1, wherein, The step of determining the multi-dimensional semantic graph according to the access requirement information and the preset semantic graph model comprises: instantiating the user access type, the access location, the authentication method, and the security policy of the access requirement information into semantic nodes; determining a preset process dependency table according to the preset semantic graph model; establishing a directed connection between the semantic nodes according to the preset process dependency table to obtain initial semantic edges; screening the initial semantic edges according to a business compatibility matrix of the preset semantic graph model to obtain compatible connections, and determining a multi-dimensional semantic graph according to the compatible connections.

3. The method of claim 2, wherein, The step of instantiating the user access type, the access location, the authentication method, and the security policy of the access requirement information into semantic nodes comprises: generating an initial node according to the user access type, the access location, the authentication method, and the security policy in the access requirement information; when a parent node exists in the initial node, inheriting basic attributes and an initial weight of the parent node of the initial node to obtain an inherited node; updating the basic attributes and the initial weight of the inherited node according to a business definition of the initial node to obtain a semantic node.

4. The method of claim 2, wherein, After the step of screening the initial semantic edges according to the business compatibility matrix of the preset semantic graph model to obtain compatible connections, and determining a multi-dimensional semantic graph according to the compatible connections, the method further comprises: acquiring a conditional dependency step and determining a business condition according to the conditional dependency step; when the access requirement information satisfies the business condition, searching for a first semantic node corresponding to an authentication process and a second semantic node corresponding to a policy issuing process in the multi-dimensional semantic graph; determining a semantic edge according to the first semantic node and the second semantic node; associating the semantic edge to a preset process template to obtain an updated preset process template.

5. The method of claim 1, wherein, The step of determining a process path according to the multi-dimensional semantic graph comprises: determining a starting node and a target node according to access requirement information of the multi-dimensional semantic graph; determining potential paths according to a path planning strategy, the starting node, and the target node, wherein the potential paths are all potential paths that can reach the target node in the multi-dimensional semantic graph with the starting node as a starting point; calculating a process cost value of the semantic edge on the potential paths according to weights and confidence scores of the semantic nodes to obtain a total path cost; selecting a corresponding potential path according to the total path cost to determine a process path.

6. The method of claim 5, wherein, The step of calculating the flow cost value of the semantic edge on the potential path according to the weight and confidence score of the semantic node includes: According to the preset cost function, the process processing time, the security level weight and the policy complexity weight are obtained; According to the confidence score, the process processing time, the security level weight and the policy complexity weight, the flow cost value is calculated; According to the flow cost value, the total path cost is determined.

7. The method of claim 1, wherein, After the step of performing flow mapping in the preset flow template according to the flow path to obtain the target access flow, the method further includes: Obtain the historical execution success rate, the fault record and the preset success rate threshold of the target access flow; When the historical execution success rate is greater than the preset success rate threshold, the weight of the semantic node corresponding to the historical execution success rate is increased; When the fault record shows that a failure occurs, the weight of the semantic node corresponding to the fault record is reduced.

8. A semantic graph based access procedure generation apparatus, characterized in that, The device includes: A data acquisition module is configured to acquire access demand information, a preset semantic graph model and a preset flow template, wherein the access demand information includes user access type, access location, authentication method and security policy; A semantic graph generation module is configured to determine a multi-dimensional semantic graph according to the access demand information and the preset semantic graph model, wherein the multi-dimensional semantic graph is composed of semantic nodes and semantic edges, the semantic nodes have node attributes including weights and confidence scores, and the semantic edges have edge attributes including cost functions; A path determination module is configured to determine a flow path according to the multi-dimensional semantic graph; A flow mapping module is configured to perform flow mapping in the preset flow template according to the flow path to obtain a target access flow.

9. A semantic graph based access procedure generation device, characterized in that, The device includes a memory, a processor and a computer program stored on the memory and executable on the processor, and the computer program is configured to implement the steps of the semantic graph-based access flow generation method according to any one of claims 1 to 7.

10. A storage medium, characterized by The storage medium is a computer readable storage medium, and the storage medium stores a computer program, and the computer program is executed by the processor to implement the steps of the semantic graph-based access flow generation method according to any one of claims 1 to 7. The storage medium is a computer readable storage medium, and the storage medium stores a computer program, and the computer program is executed by the processor to implement the steps of the semantic graph-based access flow generation method according to any one of claims 1 to 7.

Images