A knowledge graph-oriented relation-level fine-grained access control system and method

Abstract

This invention discloses a relation-level fine-grained access control system and method for knowledge graphs, relating to the field of knowledge graph security technology. The system includes: a parsing and extraction module: parsing knowledge graph triples and extracting Predicates; a dynamic policy engine module: dynamically generating and adjusting user access permissions and corresponding policies based on real-time changes in user attributes and knowledge graph data; a relation path construction module: constructing relation path expressions; a path constraint module: setting path constraint functions; a relation verification module: verifying the legality of multi-hop relations in the expressions through constraint functions; a real-time permission determination module: verifying identity, parsing the request, and determining permissions and policies after a user initiates an access request; a secure query generation module: rewriting the request and generating query statements by adding Predicate filtering conditions to the request based on permissions, policies, and context; and a query execution module: executing the query statements in the database and returning the results. This invention is used to achieve secure and efficient access to knowledge graph data.

Description

Technical Field

[0001] This invention relates to the field of knowledge graph security technology, specifically to a relation-level fine-grained access control system and method for knowledge graphs. Background Technology

[0002] With the rapid development of information technology, data is experiencing explosive growth, especially graph-structured data, which is increasingly being used in many fields such as scientific research management and social networks.

[0003] Traditional methods face numerous pain points and challenges when implementing access control for such graph data. Traditional RBAC (Role-Based Access Control) and ABAC (Attribute-Based Access Control) models have significant limitations. RBAC models can only achieve access control at the entity (e.g., node) level and cannot distinguish between different relationships of the same entity. While ABAC models introduce attributes to define access policies, they struggle to handle relationship chains in graphs and are unable to effectively address complex dynamic relationship problems.

[0004] Furthermore, as the graph size continues to expand, the number of entity-level authorization policies in the traditional RBAC model grows exponentially, leading to a policy explosion. This makes policy management exceptionally complex and inefficient. In practical applications, there are also issues with insufficient node-level control, such as the inability to dynamically adjust permissions based on data attributes. When performing relational traversal queries, especially when the query depth is greater than 3, the performance bottleneck becomes increasingly severe, significantly impacting system response speed and user experience, and hindering the efficient application of graph data in real-world business scenarios.

[0005] Therefore, existing access control technologies cannot provide effective fine-grained access control solutions when faced with the complex relationships and dynamic characteristics of spectral data. There is an urgent need for a new method to solve the above problems, so as to achieve secure and efficient access control of spectral data and meet the practical needs of scientific research management and other fields. Summary of the Invention

[0006] This invention addresses the problems of coarse-grained control, policy explosion, insufficient dynamism, and performance bottlenecks in existing access control technologies for knowledge graph data access control. It provides a relation-level fine-grained access control system and method for knowledge graphs, enabling secure and efficient access control of knowledge graph data.

[0007] Firstly, the present invention provides a relation-level fine-grained access control system for knowledge graphs, and the technical solution adopted to solve the above-mentioned technical problems is as follows:

[0008] A relation-level fine-grained access control system for knowledge graphs includes:

[0009] The parsing and extraction module is used to parse the triples (Subject, Predicate, Object) in the knowledge graph, extract the Predicate as an independent permission control unit, and combine the attribute features of Subject and Object to achieve precise permission control of the relationship between different entities in the knowledge graph.

[0010] The dynamic policy engine module is used to dynamically generate and adjust the user's access permission scope and corresponding access control policies based on the user's static attributes, dynamic attributes, and real-time changes in knowledge graph data.

[0011] The relation path construction module is used to construct relation path expressions to explicitly describe the path structure of multi-hop relations;

[0012] The path constraint module is used to set path constraint functions to constrain multi-hop relationships in relational path expressions;

[0013] The relation validation module is used to validate the validity of multi-hop relations in relation path expressions using path constraint functions;

[0014] The real-time permission determination module is used to verify the user's identity and parse the access request after the user initiates an access request. Then, it calls the dynamic policy engine module / dynamic policy engine module and relationship verification module to determine the user's access permission scope and corresponding access control policy.

[0015] The security query generation module is used to add filtering conditions based on the Predicate extracted from the knowledge graph by the parsing and extraction module to the user's original access request, according to the determined user access permission scope, corresponding access control policy and current context environment, thereby rewriting the access request. Then, the knowledge graph data that is not authorized to be accessed is filtered out by the permission verification rules, and a security query statement that meets the permission requirements is generated.

[0016] The query execution module is used to send secure query statements to the knowledge graph database to perform query operations, and finally return results from the knowledge graph database that satisfy the user's access permission scope and access request.

[0017] Optionally, a user's static attributes include the user's basic identity information, role information, and department information;

[0018] The user's dynamic attributes include the user's current time period, network environment, and real-time operation status information.

[0019] Optionally, the path constraint function set by the path constraint module can constrain the multi-hop relation type or the path length of the multi-hop relation and the predicate type in the path represented by the relation path expression according to preset rules and conditions.

[0020] Optionally, after a user initiates an access request, the real-time permission determination module first extracts the user's identity information and verifies their identity through basic parsing; after successful authentication, it fully parses the access request to determine the access type and further obtains the user's access permission scope, corresponding access control policy, and context information.

[0021] a) For single-hop access requests, the real-time permission determination module directly calls the dynamic policy engine module to adjust the user's access permission scope and corresponding access control policy.

[0022] b) For multi-hop access requests, the real-time permission determination module first calls the dynamic policy engine module to adjust the user's access permission scope and corresponding access control policy, and then collaborates with the relationship verification module to verify the legality of multi-hop relationships in the relationship path expression through the path constraint function to complete the final permission determination.

[0023] Optionally, the access control system may also include:

[0024] The log auditing module records detailed logs of all access requests, including the time of the access request, the user's identity, the predicate of the access request, and the result of the access request. For access requests that are denied, the reason for the denial is also recorded.

[0025] Secondly, this invention provides a relation-level fine-grained access control method for knowledge graphs, and the technical solution adopted to solve the above-mentioned technical problems is as follows:

[0026] A relation-level fine-grained access control method for knowledge graphs includes the following steps:

[0027] S1. Parse the triples (Subject, Predicate, Object) in the knowledge graph, extract the Predicate as an independent permission control unit, and combine the attribute features of Subject and Object to achieve precise permission control over the relationships between different entities in the knowledge graph.

[0028] S2. Introduce a dynamic policy engine to dynamically generate and adjust the user's access permission scope and corresponding access control policies based on the user's static attributes, dynamic attributes, and real-time changes in knowledge graph data.

[0029] S3. Construct a relational path expression to explicitly describe the path structure of the multi-hop relationship; simultaneously set path constraint functions to constrain the multi-hop relationships in the relational path expression; then verify the legality of the multi-hop relationships in the constructed relational path expression through the path constraint functions.

[0030] S4. After a user initiates an access request, the following process is executed: ① Verify the user's identity and parse the access request; ② Based on the parsed access request parameters, call the dynamic policy engine to determine the user's access permission scope and corresponding access control policy; ③ Based on the determined user access permission scope, corresponding access control policy, and current context, add filtering conditions based on knowledge graph predicates to the user's original access request to rewrite the access request; ④ Based on the rewritten access request, filter out unauthorized knowledge graph data through permission verification rules and generate a secure query statement that meets the permission requirements; ⑤ Send the secure query statement to the knowledge graph database to perform the query operation, and finally return the result from the knowledge graph database that satisfies the user's access permission scope and access request.

[0031] Optionally, a user's static attributes include the user's basic identity information, role information, and department information;

[0032] The user's dynamic attributes include the user's current time period, network environment, and real-time operation status information.

[0033] Optionally, the path constraint function constrains the multi-hop relation type or the path length of the multi-hop relation and the predicate type in the path according to preset rules and conditions.

[0034] Optionally, after a user initiates an access request, the system first extracts the user's identity information and verifies their identity through basic parsing. After successful authentication, the system fully parses the access request to determine the access type and further obtains the user's permissions and context information.

[0035] a) For single-hop access requests, directly call the dynamic policy engine to adjust the user's access permission scope and corresponding access control policy;

[0036] b) For multi-hop relationship access requests, first call the dynamic policy engine to adjust the user's access permission scope and corresponding access control policy, and then verify the legality of the multi-hop relationship in the relationship path expression through the path constraint function to complete the final judgment.

[0037] Optionally, a log auditing module can be introduced to record detailed logs of all access requests, including the time of the access request, the user's identity, the predicate of the access request, and the result of the access request. For access requests that are denied, the reason for the denial can also be recorded.

[0038] The present invention provides a relation-level fine-grained access control system and method for knowledge graphs, which has the following advantages compared with the prior art:

[0039] This invention refines access control granularity to the relation level, enabling precise control over relationships between different entities in a knowledge graph. This meets the refined data security and privacy protection needs of fields such as scientific research management. The introduction of a dynamic policy engine allows for the dynamic generation and adjustment of access control policies based on changes in knowledge graph data and real-time user context, further refining the granularity of access control. By constructing relation path expressions and path constraint functions, the performance bottleneck of multi-hop relation access control is effectively solved, improving the user experience. The audit trail module records all denied predicate access requests, providing system administrators with detailed access control audit information, facilitating timely detection and resolution of security issues, further optimizing access control policies, and enhancing the security and reliability of access control. Attached Figure Description

[0040] Appendix Figure 1 This is a module connection block diagram of Embodiment 1 of the present invention;

[0041] Appendix Figure 2 This is a flowchart illustrating the process between modules after a user initiates an access request in Embodiment 1 of the present invention. Detailed Implementation

[0042] To make the technical solution, the technical problem solved, and the technical effect of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with specific embodiments.

[0043] Example 1:

[0044] Combined with appendix Figure 1 , 2 This embodiment proposes a relation-level fine-grained access control system for knowledge graphs, which includes:

[0045] The parsing and extraction module is used to parse the triples (Subject, Predicate, Object) in the knowledge graph, extract the Predicate as an independent permission control unit, and combine the attribute features of Subject and Object to achieve precise permission control of the relationship between different entities in the knowledge graph.

[0046] The dynamic policy engine module is used to dynamically generate and adjust the user's access permission scope and corresponding access control policies based on the user's static attributes, dynamic attributes, and real-time changes in knowledge graph data. The user's static attributes include the user's basic identity information, role information, and department information; the user's dynamic attributes include the user's current time period, network environment, and real-time operation status information.

[0047] The relation path construction module is used to construct relation path expressions to explicitly describe the path structure of multi-hop relations;

[0048] The path constraint module is used to set path constraint functions. The path constraint functions constrain the multi-hop relation type or the path length of the multi-hop relation and the predicate type in the path according to preset rules and conditions.

[0049] The relation validation module is used to validate the validity of multi-hop relations in relation path expressions using path constraint functions;

[0050] The real-time permission determination module is used to verify the user's identity and parse the access request after the user initiates an access request. Then, it calls the dynamic policy engine module / dynamic policy engine module and relationship verification module to determine the user's access permission scope and corresponding access control policy.

[0051] The security query generation module is used to add filtering conditions based on the Predicate extracted from the knowledge graph by the parsing and extraction module to the user's original access request, according to the determined user access permission scope, corresponding access control policy and current context environment, thereby rewriting the access request. Then, the knowledge graph data that is not authorized to be accessed is filtered out by the permission verification rules, and a security query statement that meets the permission requirements is generated.

[0052] The query execution module is used to send secure query statements to the knowledge graph database to perform query operations, and finally return results from the knowledge graph database that satisfy the user's access permission scope and access request.

[0053] In this embodiment, after a user initiates an access request, the real-time permission determination module first extracts the user's identity information and verifies the identity through basic parsing; after successful authentication, it fully parses the access request to determine the access type (single-hop access or multi-hop access), and further obtains the user's access permission scope, corresponding access control policy, and context information.

[0054] a) For single-hop access requests, the real-time permission determination module directly calls the dynamic policy engine module to adjust the user's access permission scope and corresponding access control policy.

[0055] b) For multi-hop access requests, the real-time permission determination module first calls the dynamic policy engine module to adjust the user's access permission scope and corresponding access control policy, and then collaborates with the relationship verification module to verify the legality of multi-hop relationships in the relationship path expression through the path constraint function to complete the final permission determination.

[0056] In this embodiment, the access control system further includes:

[0057] The log auditing module records detailed logs of all access requests, including the time of the access request, the user's identity, the predicate of the access request, and the result of the access request. For access requests that are denied, the reason for the denial is also recorded.

[0058] Example 2:

[0059] Reference Appendix Figure 1 , 2 This embodiment proposes a relation-level fine-grained access control method for knowledge graphs, which includes the following steps:

[0060] S1. Parse the triples (Subject, Predicate, Object) in the knowledge graph, extract the Predicate as an independent permission control unit, and combine the attribute features of Subject and Object to achieve precise permission control over the relationships between different entities in the knowledge graph.

[0061] S2. Introduce a dynamic policy engine to dynamically generate and adjust the user's access permission scope and corresponding access control policies based on the user's static attributes, dynamic attributes, and real-time changes in knowledge graph data. The user's static attributes include the user's basic identity information, role information, and department information. The user's dynamic attributes include the user's current time period, network environment, and real-time operation status information.

[0062] S3. Construct a relational path expression to explicitly describe the path structure of the multi-hop relation; simultaneously set a path constraint function, which constrains the type of multi-hop relation or the path length of the multi-hop relation and the predicate type in the path according to preset rules and conditions; then verify the legality of the multi-hop relation in the constructed relational path expression through the path constraint function.

[0063] S4. After a user initiates an access request, the following process is executed: ① Verify the user's identity and parse the access request; ② Based on the parsed access request parameters, call the dynamic policy engine to determine the user's access permission scope and corresponding access control policy; ③ Based on the determined user access permission scope, corresponding access control policy, and current context, add filtering conditions based on knowledge graph predicates to the user's original access request to rewrite the access request; ④ Based on the rewritten access request, filter out unauthorized knowledge graph data through permission verification rules and generate a secure query statement that meets the permission requirements; ⑤ Send the secure query statement to the knowledge graph database to perform the query operation, and finally return the result from the knowledge graph database that satisfies the user's access permission scope and access request.

[0064] In step S4, after a user initiates an access request, the user's identity information is first extracted and verified through basic parsing. After successful authentication, the access request is fully parsed to determine the access type (single-hop or multi-hop access), and further user permissions and context information are obtained.

[0065] a) For single-hop access requests, directly call the dynamic policy engine to adjust the user's access permission scope and corresponding access control policy;

[0066] b) For multi-hop relationship access requests, first call the dynamic policy engine to adjust the user's access permission scope and corresponding access control policy, and then verify the legality of the multi-hop relationship in the relationship path expression through the path constraint function to complete the final judgment.

[0067] The method in this embodiment also introduces a log auditing module to record detailed logs of all access requests, including the time of the access request, the user's identity, the predicate of the access request, and the result of the access request. For access requests that are denied, the reason for the denial is also recorded.

[0068] In summary, the relation-level fine-grained access control system and method for knowledge graphs proposed in this invention can achieve secure and efficient access control of knowledge graph data, solving the problems of coarse-grained control, policy explosion, insufficient dynamism, and performance bottlenecks in existing access control technologies for knowledge graph data access control.

[0069] The above specific examples illustrate the principles and implementation methods of the present invention in detail. These embodiments are merely for the purpose of helping to understand the core technical content of the present invention. Based on the above specific embodiments of the present invention, any improvements and modifications made to the present invention by those skilled in the art without departing from the principles of the present invention should fall within the patent protection scope of the present invention.

Claims

1. A relation-level fine-grained access control system for knowledge graphs, characterized in that, It includes: The parsing and extraction module is used to parse the triples in the knowledge graph, extract the Predicate as an independent permission control unit, and combine the attribute features of Subject and Object to achieve precise permission control over the relationships between different entities in the knowledge graph. The dynamic policy engine module is used to dynamically generate and adjust the user's access permission scope and corresponding access control policies based on the user's static attributes, dynamic attributes, and real-time changes in knowledge graph data. The relation path construction module is used to construct relation path expressions to explicitly describe the path structure of multi-hop relations; The path constraint module is used to set path constraint functions to constrain multi-hop relationships in relational path expressions; The relation validation module is used to validate the validity of multi-hop relations in relation path expressions using path constraint functions; The real-time permission determination module is used to verify the user's identity and parse the access request after the user initiates an access request. Then, it calls the dynamic policy engine module / dynamic policy engine module and relationship verification module to determine the user's access permission scope and corresponding access control policy. The security query generation module is used to add filtering conditions based on the Predicate extracted from the knowledge graph by the parsing and extraction module to the user's original access request, according to the determined user access permission scope, corresponding access control policy and current context environment, thereby rewriting the access request. Then, the knowledge graph data that is not authorized to be accessed is filtered out by the permission verification rules, and a security query statement that meets the permission requirements is generated. The query execution module is used to send secure query statements to the knowledge graph database to perform query operations, and finally return results from the knowledge graph database that satisfy the user's access permission scope and access request.

2. The relation-level fine-grained access control system for knowledge graphs according to claim 1, characterized in that, A user's static attributes include basic identity information, role information, and department information; The user's dynamic attributes include the user's current time period, network environment, and real-time operation status information.

3. The relation-level fine-grained access control system for knowledge graphs according to claim 1, characterized in that, The path constraint module sets a path constraint function that, according to preset rules and conditions, constrains the multi-hop relation type or the path length of the multi-hop relation represented by the relation path expression and the predicate type in the path.

4. A relation-level fine-grained access control system for knowledge graphs according to claim 1, characterized in that, After a user initiates an access request, the real-time permission determination module first extracts the user's identity information and verifies their identity through basic parsing. After successful authentication, it fully parses the access request to determine the access type and further obtains the user's access permission scope, corresponding access control policy, and context information. a) For single-hop access requests, the real-time permission determination module directly calls the dynamic policy engine module to adjust the user's access permission scope and corresponding access control policy. b) For multi-hop access requests, the real-time permission determination module first calls the dynamic policy engine module to adjust the user's access permission scope and corresponding access control policy, and then collaborates with the relationship verification module to verify the legality of multi-hop relationships in the relationship path expression through the path constraint function to complete the final permission determination.

5. A relation-level fine-grained access control system for knowledge graphs according to claim 1, characterized in that, The access control system further includes: The log auditing module records detailed logs of all access requests, including the time of the access request, the user's identity, the predicate of the access request, and the result of the access request. For access requests that are denied, the reason for the denial is also recorded.

6. A relation-level fine-grained access control method for knowledge graphs, characterized in that, Includes the following steps: S1. Parse the triples in the knowledge graph, extract the Predicate as an independent permission control unit, and combine the attribute features of Subject and Object to achieve precise permission control over the relationships between different entities in the knowledge graph; S2. Introduce a dynamic policy engine to dynamically generate and adjust the user's access permission scope and corresponding access control policies based on the user's static attributes, dynamic attributes, and real-time changes in knowledge graph data. S3. Construct relational path expressions to explicitly describe the path structure of multi-hop relations; Synchronously set path constraint functions to constrain multi-hop relationships in relational path expressions; The validity of multi-hop relations in the relational path expression is then verified using path constraint functions. S4. After a user initiates an access request, the following process is executed: ① Verify the user's identity and parse the access request; ② Based on the parsed access request parameters, call the dynamic policy engine to determine the user's access permission scope and corresponding access control policy; ③ Based on the determined user access permission scope, corresponding access control policy, and current context, add filtering conditions based on knowledge graph predicates to the user's original access request to rewrite the access request; ④ Based on the rewritten access request, filter out unauthorized knowledge graph data through permission verification rules and generate a secure query statement that meets the permission requirements; ⑤ Send the secure query statement to the knowledge graph database to perform the query operation, and finally return the result from the knowledge graph database that satisfies the user's access permission scope and access request.

7. A relation-level fine-grained access control method for knowledge graphs according to claim 6, characterized in that, A user's static attributes include basic identity information, role information, and department information; The user's dynamic attributes include the user's current time period, network environment, and real-time operation status information.

8. A relation-level fine-grained access control method for knowledge graphs according to claim 6, characterized in that, The path constraint function constrains the multi-hop relation type or the path length and the predicate type in the path represented by the relation path expression according to preset rules and conditions.

9. A relation-level fine-grained access control method for knowledge graphs according to claim 6, characterized in that, After a user initiates an access request, the system first extracts and verifies the user's identity information through basic parsing. Once authentication is successful, the system fully parses the access request to determine the access type and further obtains the user's permissions and context information. a) For single-hop access requests, directly call the dynamic policy engine to adjust the user's access permission scope and corresponding access control policy; b) For multi-hop access requests, first call the dynamic policy engine to adjust the user's access permission scope and corresponding access control policy, and then verify the legality of the multi-hop relationship in the relationship path expression through the path constraint function to complete the final judgment.

10. A relation-level fine-grained access control method for knowledge graphs according to claim 6, characterized in that, A log auditing module is introduced to record detailed logs of all access requests, including the time of the access request, the user's identity, the predicate of the access request, and the result of the access request. For access requests that are denied, the reason for the denial is also recorded.

Images