Authority management method and system based on multi-modal hybrid strategy

Abstract

The invention discloses an authority management method based on a multi-mode mixed strategy, and the method comprises the steps: introducing a hierarchical decision architecture, the architecture comprises three hierarchies, a first-level PDP carries out the strategy matching and authority verification through employing an XACML rule, and is used for processing a conventional authority request, and determining whether the access is allowed or not; the second-level PDP adopts a reinforcement learning model to process a multi-attribute conflict scene; and the third-level PDP optimizes the permission propagation path between the devices by using graph calculation and hypergraph calculation technologies. The method aims at solving the efficiency problem of processing multi-attribute conflicts and large-scale equipment interconnection scenes in a dynamic environment in an existing authority management system, improving the performance and the real-time performance of the system under a high-load condition, and ensuring the safety and the compliance under cross-tenant and complex scenes. Meanwhile, by dynamically adjusting the attribute weight, the authority decision process is optimized, and the defects in cross-tenant data sharing and large-scale equipment interconnection in the prior art are overcome.

Description

Technical Field

[0001] This invention relates to a permission management method and system based on a multimodal hybrid strategy, belonging to the field of data permission management. Background Technology

[0002] Traditional access control systems are mostly based on role-based access control (RBAC) or attribute-based access control (ABAC). While RBAC performs well in static access control, it suffers from problems such as policy conflicts and untimely permission propagation in dynamic environments such as cross-tenant and large-scale device interconnection. Although ABAC can provide dynamic access control based on user attributes, its efficiency and decision-making flexibility are limited in complex scenarios with multi-attribute conflicts and cross-tenant collaboration, making it difficult to meet real-time requirements.

[0003] The invention patent CN119728168A, entitled "A Terminal Access Permission Analysis Method and System Based on Zero-Trust ABAC Model," proposes a terminal access permission analysis method based on a zero-trust ABAC model. This method includes: receiving resource access requests from user terminals through a policy execution point (PEP) and extracting multi-dimensional attribute data based on the request content; converting the extracted attribute data into attribute requests and sending them to a policy decision point (PDP) for permission analysis; the PDP using a preset access permission policy inference model and a policy management point (PAP) to evaluate the access request's permissions and feeding back the decision result to the PEP, including allow, deny, inapplicable, and unknown; and the PEP executing corresponding resource access control based on the feedback information. This method achieves fine-grained permission management based on the ABAC model and combines a zero-trust framework to address dynamic access control needs, effectively improving security and flexibility. However, this method relies on complex attribute extraction and multi-dimensional data analysis, which may lead to high computational complexity and a strong dependence on historical data, potentially affecting real-time response speed. Especially during the access request processing, the classification and analysis of attributes is quite complex. If there are errors in attribute extraction or model matching, it may affect the final access control decision. Summary of the Invention

[0004] Purpose of the invention: The purpose of this invention is to provide a permission management method and system based on a multimodal hybrid strategy, which improves the system's performance and real-time performance under high load conditions, and ensures security and compliance in cross-tenant and complex scenarios.

[0005] Technical Solution: The present invention provides a permission management method based on a multimodal hybrid strategy. The method includes introducing a hierarchical decision architecture, which comprises three levels: a first-level PDP that uses XACML rules for policy matching and permission verification to handle regular permission requests and determine whether access is allowed; a second-level PDP that uses a reinforcement learning model to handle multi-attribute conflict scenarios; and a third-level PDP that uses graph computing and hypergraph computing techniques to optimize the permission propagation path between devices.

[0006] Furthermore, the processing procedure for regular requests handled by the first-level PDP is as follows:

[0007] (1) Obtain user request information and match the request information with the XACML policy, which includes access control rules.

[0008] (2) The first-level PDP matches the XACML policy based on the attributes of the request information. The XACML rules compare the request information with the access conditions in the defined policy to determine whether access is allowed.

[0009] (3) Match the request information with the XACML rules to determine whether the request meets the access conditions in the rules; if the request meets the conditions, return “Allow” access; if the request does not meet the conditions, return “Deny” access.

[0010] Furthermore, the processing procedure of the secondary PDP using a reinforcement learning model is as follows:

[0011] (1) The model inputs user request information, business attributes, privacy requirements and data sensitivity;

[0012] (2) Evaluate the different input information attributes and assign weights to each attribute;

[0013] (3) Based on the input information and weights, the reinforcement learning model adjusts the priority of each attribute through a reward and punishment mechanism;

[0014] (4) Generate the final access decision through model training and optimization.

[0015] Furthermore, the reward and punishment mechanism includes: if the decision successfully protects privacy and improves efficiency, a reward will be given to strengthen the decision-making strategy; if the decision infringes on privacy or leads to inefficiency, a punishment will be given to weaken the decision-making strategy.

[0016] Furthermore, the priority adjustment generates the final access decision, using the following formula:

[0017]

[0018] Where Q(s,a) represents the expected reward of taking action a in state s, the value of the current policy; a is the learning rate, which determines the degree of influence of new information on the Q value; r is the immediate reward, representing the reward obtained after taking action a from the current state s; and γ is the discount factor, representing the weight of future rewards.

[0019] Furthermore, the three-level PDP resolves complex permission propagation and conflicts between devices through graph computation and hypergraph computation. The processing steps of the three-level PDP are as follows:

[0020] (1) Input data includes device permission information, requested resource information, and connection relationships between devices;

[0021] (2) Model the permission propagation path between devices: treat all devices as graph nodes, the connection relationship between devices as the edges of the graph, and each edge represents the permission propagation path between devices;

[0022] (3) Using graph computing and hypergraph computing algorithms, optimize the propagation of permissions between devices to obtain the optimal propagation path.

[0023] Furthermore, the calculation of the optimal propagation path includes defining an optimization objective:

[0024]

[0025] Among them, P opt This is the optimized permission propagation path; d i It is the access request priority of device i; cost(e) i ) is the cost of transferring permissions between devices; e i It is the permission propagation edge between devices.

[0026] The present invention discloses a permission management system based on a multimodal hybrid strategy, comprising:

[0027] Level 1 PDP module: Uses XACML rules for policy matching and permission verification, and is used to process regular permission requests and determine whether to allow access;

[0028] Level 2 PDP module: Employs a reinforcement learning model to handle multi-attribute conflict scenarios;

[0029] Level 3 PDP module: Optimizes the permission propagation path between devices using graph computing and hypergraph computing technologies.

[0030] A computer device includes one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the programs, when executed by the processors, implement the steps of the permission management method based on a multimodal hybrid strategy.

[0031] A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the permission management method based on a multimodal hybrid strategy.

[0032] Beneficial effects: Compared with the prior art, the present invention has the following significant advantages:

[0033] (1) Through the hierarchical decision architecture Multi-PDP, it is possible to efficiently handle permission requests of different complexities, thereby improving the system's response speed and processing efficiency.

[0034] (2) Dynamic attribute weight adjustment: The DW-ABAC algorithm is adopted to dynamically adjust the attribute weight according to the real-time scenario, which effectively solves the problem of multi-attribute conflict, especially in the balance between privacy protection and efficiency.

[0035] (3) The three-level PDP combined with hypergraph computing technology optimizes the permission propagation path between devices and effectively improves the permission management efficiency in device interconnection.

[0036] (4) This invention can adapt to complex scenarios such as cross-tenant and cross-regional data sharing, and ensure the security and compliance of access control.

[0037] (5) Through the hierarchical architecture and reinforcement learning model, the system can maintain good real-time response capability under high load scenarios, avoiding the performance bottleneck of existing technologies in large-scale systems.

[0038] (6) Combining XACML rules and reinforcement learning models ensures that optimal decisions can be made flexibly in different environments, thereby improving the system's adaptability and accuracy. Attached Figure Description

[0039] Figure 1 This is a diagram of the architecture of the multimodal hybrid decision-making system of the present invention.

[0040] Figure 2 This is a flowchart of the first-level PDP decision-making process of the present invention.

[0041] Figure 3 This is a flowchart of the two-level PDP decision-making process of the present invention.

[0042] Figure 4 This is a flowchart of the three-level PDP decision-making process of the present invention. Detailed Implementation

[0043] The technical solution of the present invention will be further described below with reference to the accompanying drawings.

[0044] This invention discloses a permission management method based on a multimodal hybrid strategy. The method includes introducing a hierarchical decision architecture to handle permission management tasks, including three levels of decision points (PDPs). Each level processes the task according to different task complexity and characteristics, thereby optimizing the system's performance and response time.

[0045] The first-level PDP uses XACML rules for policy matching and permission verification to handle routine permission requests and determine whether access is permitted. The second-level PDP employs a reinforcement learning model to handle multi-attribute conflict scenarios. The third-level PDP utilizes graph computing and hypergraph computing techniques to optimize the permission propagation path between devices. The multimodal hybrid decision system architecture is as follows: Figure 1 As shown.

[0046] Level 1 PDP:

[0047] Leveraging the rapid processing capabilities of XACML rules, an XML-based access control standard primarily used to define and enforce attribute-based access control policies, the Level 1 PDP handles simple permission requests, quickly determining whether access is permitted.

[0048] The Level 1 PDP uses XACML rules for policy matching and permission verification. XACML uses a declarative language to define policies and translates access control requests into policy enforcement decisions. XACML can quickly evaluate the legitimacy of access requests, has a fast processing speed, and is suitable for low-latency scenarios.

[0049] like Figure 2 As shown, the steps for processing a regular permission request using a Level 1 PDP are as follows:

[0050] Input: The user's access request and their identity, role, and other information.

[0051] Step 1: Match the request information with the XACML policy. The XACML policy contains access control rules that define which users or roles can access which resources, along with access conditions such as time and geographical location.

[0052] Step 2: The first-level PDP quickly matches the XACML policy based on the request's attributes, such as user identity and role. The XACML rules compare the request information with the access conditions in the defined policy to quickly determine whether access is allowed.

[0053] Step 3: Match the request information against XACML rules to determine if the request meets the access conditions in the rules. If the request meets the conditions, return "Allow" for access. If the request does not meet the conditions, return "Deny" for access, as shown in the following expression:

[0054] Decision=Match(Request,XACML Rule)

[0055] The Request section contains information such as user identity, accessed resources, and requested operations.

[0056] XACMLRule: Access control policy, which includes attributes such as subject, resource, action, and environment.

[0057] Decision: After the matching process, output the access decision, which may be "Allow" or "Deny".

[0058] Level 1 PDPs are primarily used for processing routine permission requests, and their response time must be less than 50 milliseconds to meet the system's high-efficiency requirements.

[0059] Secondary PDP:

[0060] Reinforcement learning models are employed to handle multi-attribute conflict scenarios, especially when dealing with trade-offs between privacy and efficiency in cross-tenant data collaboration. The secondary PDP handles more complex scenarios involving multi-attribute conflicts and dynamic adjustments, using reinforcement learning models to compute decisions.

[0061] The secondary PDP uses a reinforcement learning model to handle multi-attribute conflicts. The reinforcement learning model can dynamically adjust the weight between privacy protection and efficiency based on real-time requests and environmental feedback.

[0062] The system uses a reward and punishment mechanism to drive the model to learn optimal decisions. Decisions that meet privacy protection requirements are rewarded, while decisions that violate privacy are punished. Additionally, decisions that improve system efficiency are also rewarded.

[0063] like Figure 3 As shown, the processing steps using a secondary PDP are as follows:

[0064] The model's input includes the following:

[0065] User request information: the data type requested, user role, requested operation, etc.

[0066] Business attributes: such as the business importance of the data, the use cases, and the data's dependence on business processes.

[0067] Privacy requirements: different privacy levels for different types of data, and the privacy protection needs when sharing data.

[0068] Data sensitivity: The degree of sensitivity of the data, and different protection measures should be taken according to different levels of sensitivity.

[0069] Step 1: The system evaluates different input information attributes and assigns weights to each attribute. These attributes include:

[0070] Data sensitivity: The higher the sensitivity of the data, the greater the weight of privacy protection.

[0071] Business continuity: If a piece of data is critical to business operations, efficiency may be given higher weight.

[0072] User permissions: Different user roles may affect data access permissions.

[0073] Weighting can be done through expert rules or automated methods. The weight of each attribute will be adjusted based on real-time business needs and security events.

[0074] Step 2: Based on the input information and weights, the system uses a reinforcement learning model to determine how to balance privacy and efficiency. The reinforcement learning model explores different decision-making strategies and gradually adjusts the priority of each attribute.

[0075] A reward and punishment mechanism is used to drive the model to learn the optimal decision. If the decision successfully protects privacy and improves efficiency, the system will reward the decision and strengthen the decision strategy; if the decision violates privacy or leads to inefficiency, the system will punish the decision and weaken the decision strategy.

[0076] As the model continuously interacts with its environment, it adjusts the priority of its attributes to achieve the optimal access control strategy, as shown in the following formula:

[0077]

[0078] Where Q(s,a) represents the expected reward of taking action a in state s, the value of the current policy; a is the learning rate, which determines the degree of influence of new information on the Q value; r is the immediate reward, representing the reward obtained after taking action a from the current state s; and γ is the discount factor, representing the weight of future rewards.

[0079] Step 3: After multiple rounds of training and optimization, the reinforcement learning model can generate the optimal strategy based on the current environment, resolve the conflict between privacy protection and business efficiency, and generate the final access decision.

[0080] Data access control: The system dynamically adjusts its policies based on different data sensitivity and privacy requirements to ensure that sensitive information is not leaked while data is shared.

[0081] Level 3 PDP:

[0082] The Level 3 PDP employs graph computing and hypergraph computing technologies to solve the problem of permission propagation in large-scale device interconnection.

[0083] Level 3 PDP primarily handles the permission propagation problem in large-scale device interconnection scenarios. Specifically, it resolves complex permission propagation and conflicts between devices through graph computation and hypergraph computation. Its core objective is to optimize computation to ensure that permissions between devices can be efficiently and dynamically transferred while meeting security requirements.

[0084] Graph computing techniques can effectively model the connections between devices, where devices are considered nodes in a graph, and the paths for permission transfer are considered edges. In a scenario of interconnected devices, each device and the resources it can access can be viewed as a node in the graph, and the permission relationships between devices can be connected by edges.

[0085] Hypergraph computing is a technology that extends graph computing to handle many-to-many permission propagation problems. In a hypergraph, edges connect not only two nodes but also multiple nodes, making it particularly suitable for handling complex permission relationships between large-scale devices. Hypergraph computing can calculate the optimal permission propagation path based on the permission propagation requirements between devices.

[0086] The processing flow of a Level 3 PDP includes:

[0087] In a Level 3 PDP, the input data includes:

[0088] Device permission information: The types and scope of permissions that each device has, which usually includes access permissions to resources.

[0089] Information about the requested resource: The target resource that the user requests to access may be a file, device, service, etc.

[0090] Inter-device connections: The interconnections between devices can be represented by a diagram, where each device has direct or indirect connections with other related devices.

[0091] like Figure 4 As shown, the three-level PDP processing flow is as follows:

[0092] Step 1: Model the permission propagation path between devices. Treat all devices as nodes in a graph, and the connections between devices as edges. Each edge represents a permission propagation path between devices and may include different weights.

[0093] Step 2: Graph Computation and Hypergraph Computation

[0094] Graph computing and hypergraph computing algorithms are used to optimize permission propagation between devices, ensuring the selection of the optimal propagation path. The specific computational goal is to optimize the cost of permission propagation between devices, enabling efficient transfer of resource permissions while ensuring security and compliance.

[0095] By using a graph computing model, a weight is assigned to the permission propagation path between devices, representing the "cost" required to transmit the permission, such as computational latency, network bandwidth, etc.

[0096] The Hypergraph computing model further optimizes the many-to-many relationship between devices, ensuring that permission propagation between devices can be completed efficiently and securely in complex device interconnection scenarios.

[0097] Each device is represented as a node in a graph, and the permission propagation relationships between devices are represented as edges in the graph. Each edge is assigned a corresponding weight to reflect the cost of permission transmission, such as network latency, bandwidth limitations, or security risk levels. Based on this, a shortest path algorithm is used to calculate the optimal path for permission propagation to minimize the total propagation cost and ensure efficient and secure permission transmission. Simultaneously, the system incorporates a dynamic update mechanism that can adjust edge weights in real time based on changes in device status or network environment, and utilizes an incremental graph calculation algorithm to quickly respond to changes, avoiding the performance overhead of recalculating the entire graph.

[0098] To further handle many-to-many permission propagation scenarios, the system introduces a hypergraph computing model. In a hypergraph, a hyperedge connects multiple device nodes, suitable for describing complex relationships where a group of devices share or pass a certain permission. Through hypergraph partitioning algorithms or hyperpath search strategies, the system optimizes the efficiency of permission propagation within device groups and effectively detects and resolves conflicts that arise during permission propagation. The hypergraph model not only enhances the flexibility of permission propagation but also significantly improves the system's processing power and scalability in large-scale device interconnection environments. Ultimately, by comprehensively utilizing graph and hypergraph computing technologies, the system can achieve dynamic optimization and efficient management of permission propagation paths while meeting security and compliance requirements.

[0099] Step 3: Permission propagation path optimization. Through optimization calculations, the system will find the optimal permission propagation path. By solving the optimization problem, it will ultimately determine which devices can propagate which permissions under what conditions.

[0100] In a three-level PDP, hypergraph computation is used to optimize the permission propagation path. The optimal permission propagation path is solved by defining the optimization objective, and the formula is as follows:

[0101]

[0102] Among them, P opt This is the optimized permission propagation path; d i It is the access request priority of device i; cost(e) i ) is the cost of transferring permissions between devices; e iThese are the permission propagation edges between devices. By calculating and minimizing the cost of permission propagation between all devices, the optimal permission propagation path is selected.

[0103] This invention addresses the permission allocation problem in multi-attribute conflict scenarios using a Dynamic Attribute Weighting Allocation Algorithm (DW-ABAC). Based on the entropy weighting method, it calculates the importance of each attribute in real time and dynamically adjusts permission allocation, effectively balancing different security requirements and business efficiency. By evaluating attribute importance using the entropy weighting method, the algorithm can adjust the priority of each attribute according to different application scenarios, thereby making optimal permission decisions.

[0104] To dynamically adjust the attribute weights, the entropy weight method is used to calculate the importance of each attribute, and weights are applied according to the importance of the attributes, as shown in the following formula:

[0105]

[0106] Among them, W i H(S) is the weight of attribute i; i ) is the information entropy of attribute i, representing the uncertainty of attribute i;

[0107]

[0108] Where, p k is the probability of the kth value of attribute i, and m is the number of values ​​of attribute i.

[0109] After calculating the weight of each attribute, the weights of all attributes are normalized so that the sum of the weights of all attributes equals 1. The normalization process is performed by dividing the weight of each attribute by the sum of the weights of all attributes.

[0110]

[0111] The system can dynamically adjust the influence of attributes in decision-making based on their weights, ensuring that more important attributes occupy a larger proportion in permission decisions.

[0112] In the specific implementation process, the weight calculation is as follows: Assume that the system considers the following three main attributes during the permission decision-making process:

[0113] Attribute A1: Data sensitivity; Attribute A2: Business continuity; Attribute A3: User role level.

[0114] The attribute values ​​obtained after standardization for four sample requests in a specific scenario are shown in the table below:

[0115] property Sample 1 Sample 2 Sample 3 Sample 4 Data Sensitivity A1 0.90 0.80 0.70 0.95 Business Continuity A2 0.60 0.50 0.40 0.65 User role level A3 0.30 0.20 0.25 0.35

[0116] Calculate the proportion p of each attribute in each sample. ik Taking attribute A1 and sample 1 as an example, the ratio is calculated as follows:

[0117]

[0118] The proportional distribution of each attribute is calculated sequentially.

[0119] According to the information entropy formula of the entropy weight method:

[0120]

[0121] The calculated information entropy of each attribute is as follows:

[0122] Data sensitivity A1: e1 = 0.85; Business continuity A2: e2 = 0.92; User role level A3: e3 = 0.95.

[0123] Calculate the coefficient of difference: d i =1-e i

[0124] d1=0.15, d2=0.08, d3=0.05.

[0125] Finally, weight normalization is performed, and the weight calculation formula is as follows:

[0126]

[0127] Then, data sensitivity A1: w1 = 0.15 / 0.28; business continuity A2: w2 = 0.08 / 0.28; user role level A3: w3 = 0.05 / 0.28.

[0128] Therefore, in this scenario, data sensitivity has the highest weight and the strongest influence in the final permission decision; business continuity is second; and user role level is relatively low. Through this method, the system can dynamically adjust the role of attributes in permission decisions based on their importance, ensuring that key attributes occupy a reasonable proportion in cross-tenant data sharing and security control, thereby achieving an effective balance between privacy protection and business efficiency.

Claims

1. A permission management method based on a multimodal hybrid strategy, characterized in that, The method includes introducing a hierarchical decision architecture, which consists of three levels. The first-level PDP uses XACML rules for policy matching and permission verification to handle regular permission requests and decide whether to allow access. The second-level PDP uses a reinforcement learning model to handle multi-attribute conflict scenarios. Level 3 PDPs utilize graph computing and hypergraph computing technologies to optimize the permission propagation path between devices.

2. The permission management method based on a multimodal hybrid strategy according to claim 1, characterized in that, The processing procedure for regular requests by the Level 1 PDP is as follows: (1) Obtain user request information and match the request information with the XACML policy, which includes access control rules. (2) The first-level PDP matches the XACML policy based on the attributes of the request information. The XACML rules compare the request information with the access conditions in the defined policy to determine whether access is allowed. (3) Match the request information with the XACML rules to determine whether the request meets the access conditions in the rules; If the request meets the conditions, then return "Allow" for access; If the request does not meet the conditions, return "Deny" for access.

3. The permission management method based on a multimodal hybrid strategy according to claim 1, characterized in that, The processing procedure of the secondary PDP using a reinforcement learning model is as follows: (1) The model inputs user request information, business attributes, privacy requirements and data sensitivity; (2) Evaluate the different input information attributes and assign weights to each attribute; (3) Based on the input information and weights, the reinforcement learning model adjusts the priority of each attribute through a reward and punishment mechanism; (4) Generate the final access decision through model training and optimization.

4. The permission management method based on a multimodal hybrid strategy according to claim 3, characterized in that, The reward and punishment mechanism includes: if a decision successfully protects privacy and improves efficiency, a reward will be given to strengthen the decision-making strategy; if a decision infringes on privacy or leads to inefficiency, a punishment will be given to weaken the decision-making strategy.

5. The permission management method based on a multimodal hybrid strategy according to claim 3, characterized in that, The priority adjustment generates the final access decision, using the following formula: Where Q(s,a) represents the expected reward of taking action a in state s, the value of the current policy; a is the learning rate, which determines the degree of influence of new information on the Q value; r is the immediate reward, representing the reward obtained after taking action a from the current state s; and γ is the discount factor, representing the weight of future rewards.

6. The permission management method based on a multimodal hybrid strategy according to claim 1, characterized in that, The Level 3 PDP resolves complex permission propagation and conflicts between devices through graph computation and hypergraph computation. The processing steps of the Level 3 PDP are as follows: (1) Input data includes device permission information, requested resource information, and connection relationships between devices; (2) Model the permission propagation path between devices: treat all devices as graph nodes, the connection relationship between devices as the edges of the graph, and each edge represents the permission propagation path between devices; (3) Using graph computing and hypergraph computing algorithms, optimize the propagation of permissions between devices to obtain the optimal propagation path.

7. The permission management method based on a multimodal hybrid strategy according to claim 6, characterized in that, The calculation of the optimal propagation path includes defining an optimization objective: Among them, P opt This is the optimized permission propagation path; d i It is the access request priority of device i; cost(e) i ) is the cost of transferring permissions between devices; e i It is the permission propagation edge between devices.

8. A permission management system based on a multimodal hybrid strategy, characterized in that, include: Level 1 PDP module: Uses XACML rules for policy matching and permission verification, and is used to process regular permission requests and determine whether to allow access; Level 2 PDP module: Employs a reinforcement learning model to handle multi-attribute conflict scenarios; Level 3 PDP module: Optimizes the permission propagation path between devices using graph computing and hypergraph computing technologies.

9. A computer device, characterized in that, It includes one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the programs, when executed by the processors, implement the steps of a permission management method based on a multimodal hybrid strategy as described in any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the permission management method based on a multimodal hybrid strategy as described in any one of claims 1-7.

Images