Heterogeneous database security access and report generation method based on MCP and agent

Abstract

The invention relates to the technical field of database security, and discloses an MCP and agent-based heterogeneous database security access and report generation method, which comprises the following steps of: receiving a task request, acquiring a task context, synchronizing capability declarations from a plurality of database adapters according to the MCP, generating a capability graph and determining a capability version identifier; performing semantic mapping to obtain a strategy inline rewriting rule and a rewriting abstract fingerprint; the method comprises the following steps: signing and issuing a minimum permission access token, generating cross-source query, performing forced rewriting according to a strategy inline rewriting rule in a compilation stage, verifying consistency, processing an original result to obtain a purified result, only allowing to read a generated report from a buffer area of the purified result under the constraint of a structured mode template, and calculating a report fingerprint at the same time. And writing a chained audit log, fixing the audit log, and verifying report reproduction based on the audit log. According to the method and the system, minimum access, unauthorized prevention and control, compliance audibility and result reproducibility are realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of database security, in particular to a heterogeneous database security access and report generation method based on MCP and intelligent agent. BACKGROUND

[0002] With the adoption of relational, document, time series and big data lake storage by enterprises, cross-source query and unified management have become the norm. In order to reduce the risk of exceeding authority and compliance exposure, the industry has gradually introduced fine-grained access control, policy-driven query rewriting, and centralized management for big data scenarios. However, in the face of "inconsistent multi-source capabilities, inconsistent policy interpretation, and controllability and traceability requirements brought by intelligent agent automation", the existing path focuses on runtime interception and single-source endogenous control, and it is difficult to pre-fix the consistency of "what can be done, what is allowed to do, and what is actually done" at the cross-source orchestration level, and form an end-to-end closed loop with subsequent token execution, privacy shaping, report restricted reading and verifiable playback.

[0003] In the prior art, for example, CN108475288B - a system, method and device for unified access control of a joint database, based on central authorization metadata, checks and modifies tables, columns and rows, and can replace allowed columns when there are wildcard columns, add filters to restricted rows, and directly abandon queries for restricted objects, thereby realizing centralized fine-grained control. However, it mainly focuses on permission verification and rewriting at runtime or planning level, and does not bind the "version state of data source capability declaration, forced inline rewriting result in the compilation phase" with the "minimum permission token and consistency check before execution", nor does it include "automatic downgrading of minimum judgment failure, template restricted report generation under purified results, chain audit and minimum playback" in the same evidence chain, making it difficult to provide pre-fix verifiable consistency and reproducible experiment capability in cross-source and intelligent agent participation scenarios.

[0004] Therefore, it is necessary to design a heterogeneous database security access and report generation method based on MCP (Model Context Protocol) and intelligent agent to solve the problems in the current technology. SUMMARY

[0005] In view of this, the present application provides a heterogeneous database security access and report generation method based on MCP and intelligent agent, aiming to solve the problem that the prior art cannot bind the data source capability, access policy and actual query for verifiable consistency before execution, and lacks a mechanism that penetrates the minimum access, restricted report generation and chain playback audit, resulting in the problem of unauthorized disclosure and non-reproducible report.

[0006] The application provides a heterogeneous database security access and report generation method based on MCP and agent, comprising: Receiving a task request and obtaining a task context, generating a capability graph by normalizing the capability declaration of multiple database adapters according to the MCP, and determining a capability version identifier; Semantically mapping the organization access policy, data classification constraints and the capability graph to obtain policy inline rewriting rules and rewriting summary fingerprints; Issuing a minimum privilege access token according to the task context, the rewriting summary fingerprints and the capability version identifier, the minimum privilege access token including a time range, a data range and an operator range, the minimum privilege access token being bound to a tool server identifier; Generating a cross-source query according to the agent, and performing forced rewriting according to the policy inline rewriting rules in the compilation stage, and converting the cross-source query into an alternative query that only returns statistical information and generating minimum proof information when it is determined that the data minimization principle is not met or rewriting fails; Verifying the consistency of the minimum privilege access token, the rewriting summary fingerprints and the capability version identifier in a controlled execution environment, and performing restricted access to the heterogeneous database and obtaining the original result when consistent; Processing the original result according to privacy and compliance shaping rules to obtain a purified result, and only allowing reading from the buffer of the purified result to generate a report under the constraint of a structured mode template, while calculating a report fingerprint; Writing the task request, capability version identifier, policy inline rewriting rule, minimum privilege access token, rewriting summary fingerprint, minimum proof information and report fingerprint into a chain audit log, fixing the audit log, and verifying report reproduction based on the audit log.

[0007] Further, when receiving a task request and obtaining a task context, generating a capability graph by normalizing the capability declaration of multiple database adapters according to the MCP, and determining a capability version identifier, it comprises: Identity verification of the database adapter and establishment of a controlled communication channel; Receiving capability declaration according to a unified terminology table and performing structured parsing, extracting data source identifier, resource range, field list, available operation, parameter limit, data classification and regional boundary; Eliminating repeated or conflicting entries according to a preset priority and forming a consistent result; Based on the sensitivity annotation of fields and operations, a data source node, a resource node, a field node, an operation node and a constraint relationship are established in the capability graph; Forming a complete snapshot of the generated capability graph and calculating a summary check value, and determining a unique capability version identifier in combination with the effective time and source list.

[0008] Further, when the organization access policy, data classification constraints and the capability profile are semantically mapped, the policy inline rewriting rules are obtained, and the rewriting summary fingerprints are obtained, comprising: A unified term and field mapping relationship is established, and the policy entries are classified according to column sets, row filters, operation categories, regional boundaries and data quotas; According to the sensitivity annotation, the mandatory aggregation, the bucket interval, the minimum sample threshold and the time window are generated, and are aligned with the resource range and available operations in the capability profile, forming a rewriting rule chain; The structured query statement to be executed is syntax normalized and sequentially merged, and the forced rewriting is completed in the compilation stage according to the rewriting rule chain, obtaining a rewriting product; Based on the rewriting product and the capability version identifier, a unique rewriting summary fingerprint is generated by an irreversible digest algorithm; when the rule conflict cannot meet the data minimization principle, an alternative query template containing only the count and distribution is output, and minimization proof information is generated.

[0009] Further, when the minimum privilege access token is issued according to the task context, the rewriting summary fingerprint and the capability version identifier, comprising: The task time requirement, data usage range and operation requirement are analyzed, and the time range, data range and operator range are determined; According to the rewriting summary fingerprint, the column set, the row filter and the aggregation requirement are extracted, and are written into the token limit field; the capability version identifier is written into the token consistency field; the digest check value is generated; The token is issued to the tool server and is bound with the tool server identifier; The expiration condition, the quota depletion condition and the revoked condition are set, and the token limit field, the token consistency field and the digest check value are saved in the issuance registration.

[0010] Further, the minimum privilege access token checks the consistency of the digest check value, the token consistency field, the rewriting summary fingerprint and the capability version identifier before each execution, and can continue only when consistent; during the execution process, the time range, data range and operator range are compared and counted one by one, and when any limit is broken or the quota is exhausted, the access is terminated, and the downgrade reason is recorded; if the minimization principle cannot be met, the execution is refused, and the verification record and the quota consumption record are written into the audit log.

[0011] Further, when the forced rewriting is performed according to the policy inline rewriting rules in the compilation stage, comprising: The syntax normalization and dependency parsing of the cross-source query are performed to determine column set, row filtering, connection relationship and operation sequence; the strategy inline rewriting rule is taken as a sequential rule chain, column-level filtering, row-level filtering, sensitive field desensitization, mandatory aggregation, bucket grouping, sampling upper limit and time window are sequentially inserted, cross-source connection is limited, and exceeding the allowed connection is replaced by an aggregation result; high-risk operations are replaced, and the replaced operations and reasons are recorded in the rewriting record; when the rewritten query still has resources or operations inconsistent with the capability version identifier, the execution phase is prohibited.

[0012] Further, when the cross-source query is converted into an alternative query that only returns statistical information and the minimization proof information is generated when it is determined that it does not meet the data minimization principle or rewriting fails, comprising: The minimization is determined according to the preset threshold for the number of columns, the proportion of sensitive fields, the row coverage range and the time span, and any index does not meet the requirement, which triggers the degradation; The original query is converted into an alternative query template containing only count, distribution or top several items, and the grouping size and time window are fixed; The minimization proof information is generated, which includes the list of excluded fields, the list of limited operations, the trigger threshold, the identifier of the adopted alternative query template and the degradation reason; The minimization proof information and the rewriting summary fingerprint are registered before entering the execution phase.

[0013] Further, when the consistency of the minimum permission access token, the rewriting summary fingerprint and the capability version identifier is verified in the controlled execution environment, comprising: An isolated execution session is established, and the tool server identifier, capability version identifier, minimum permission access token and rewriting summary fingerprint are collected; The validity of the minimum permission access token is checked, and the checking content includes time range, revoked state and quota consumption state; The consistency is compared, and the comparison content includes whether the token consistency field and the capability version identifier are consistent, whether the standardized representation of the query to be executed and the rewriting summary fingerprint are consistent, and whether the tool server identifier bound by the token and the current tool server identifier are consistent; When consistent, the restricted access is enabled, and each item is compared and executed according to the time range, data range and operator range of the token.

[0014] Further, when the original result is processed according to the privacy and compliance shaping rules and the report is generated under the constraint of the structured mode template, comprising: establish a shaping rule set, which includes de-identification, column-level retention, row-level filtering, geographical boundary, minimum sample threshold, bucketing and aggregation, statistical perturbation, sensitive word replacement, privacy budget deduction, and out-of-limit rejection condition; shape the original results in a fixed order, sequentially completing de-identification, compliance filtering, aggregation and bucketing, statistical perturbation and threshold testing, and pruning results that do not meet the minimum sample threshold, while generating error annotations and credibility explanations, obtaining the purified results and registering privacy budget consumption records; write the purified results into a buffer in the execution session; The report generator checks the field name, value range, unit of measurement, and chart type under the constraint of the structured mode template, and when the check is passed, only reads the purified results from the buffer to generate a report; The generated report and the corresponding purified result summary and structured mode template are used to calculate an irreversible digest check value as a report fingerprint.

[0015] Further, when writing a chain audit log and for reproduction verification, it includes: Generate a log unit for a time, format normalize the task request summary, the capability version identifier, the policy inline rewrite rule summary, the minimum permission access token summary, the rewrite summary fingerprint, the minimization proof information, and the report fingerprint, and calculate the irreversible digest check value of the current log unit; sequentially connect the irreversible digest check value of the previous log unit and the irreversible digest check value of the current log unit, generate a connection check field and write it together with a trusted time marker to the chain audit log; The chain audit log adopts an append-only and non-modifiable storage strategy, and is solidified in multiple copies after being written; When performing reproduction verification, locate the target log unit according to the report fingerprint or the task request, check the continuity of the connection check field from the starting log unit to the target log unit, and after passing the check, perform minimization playback according to the policy inline rewrite rule summary and the minimization proof information, only recalculate the summary of the purified results with the alternative query template and the structured mode template, and generate a verification fingerprint for comparison; When the verification fingerprint is consistent with the report fingerprint, it is determined that the reproduction is passed, otherwise the reproduction result output is rejected.

[0016] Compared with the prior art, the present application has the beneficial effects that: by binding the capability profile with the capability version identification, the inline rewriting rule with the rewriting summary fingerprint, and the minimum permission access token in consistency before execution, and performing item-by-item comparison in the controlled execution environment according to the time range, data range and operator range of the token, cooperating with the automatic degradation of the query that does not meet the data minimization principle to the alternative query that only returns statistical information and outputting the minimization proof information, and then de-identifying, filtering and aggregating the original result according to the privacy and compliance shaping rules, only allowing to read the report from the buffer of the purified result under the constraint of the structured mode template to generate the report and calculate the report fingerprint, and finally writing the result into the chain audit log and supporting the report reproduction verification based on the log, the pre-verified control and minimum access of cross-source access are realized, the risk of unauthorized access and leakage is reduced, the policy bypass and permission drift are avoided, the secondary leakage on the report side is eliminated, the compilation stage forced rewriting and read-only purification channel reduce the running period overhead and detailed data migration, and the compliance pass rate, audit efficiency and report credibility in the heterogeneous database and agent cooperation scene are improved. BRIEF DESCRIPTION OF DRAWINGS

[0017] Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The accompanying drawings are included to provide a description of the preferred embodiments and are not intended to limit the scope of the application. Moreover, the same reference numerals in different drawings represent the same or similar elements. In the drawings: Figure 1 A flow chart of a heterogeneous database security access and report generation method based on MCP and agent is provided for the embodiments of the present application. DETAILED DESCRIPTION

[0018] Exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided so that the present disclosure can be more thoroughly understood and the scope of the present disclosure can be accurately conveyed to those skilled in the art. It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict. The present application will be described in detail below with reference to the accompanying drawings and in conjunction with the embodiments.

[0019] In the traditional existing heterogeneous database cross-source access control system, the multi-source capability declaration lacks versioning synchronization mechanism, resulting in semantic deviation in policy mapping and execution stage. The policy rewriting rule and access token issuance process are not bound by three-party consistency, and the data minimization principle cannot be pre-fixed in the compilation stage, resulting in unauthorized risk and compliance exposure in cross-source query. The automated query generated by the intelligent agent lacks a forced degradation mechanism, and the execution environment does not establish a dynamic verification link of token, rewriting fingerprint and capability version. The purification result and report generation link do not build structured template constraints and chain audit evidence chain, making it difficult to realize end-to-end closed-loop verification and reproducibility guarantee.

[0020] For example, in the financial risk control scene, the user initiates a joint query request of cross-relational database and big data lake through the intelligent agent. Due to the fact that the capability declaration of different database adapters is not versioned and synchronized according to a unified terminology table, the policy engine produces conflicts between column sets and row filtering rules when performing semantic mapping. The rewriting process in the compilation stage is not bound with the operator range of the access token, resulting in that the aggregation operation exceeds the data classification constraint. The execution environment does not verify the consistency of the capability version identifier and the token, and the sensitive fields in the original result are not statistically disturbed according to the privacy budget. The report generator is not constrained by the structured mode template, and directly reads the detailed data from the purification buffer to generate a chart, triggering privacy leakage. The audit log does not use chain storage and fixed strategy, and cannot reproduce the report fingerprint through the alternative query template and template constraint.

[0021] If the above problems are not solved, the permission control of cross-source query will produce policy escape vulnerabilities due to version drift and lack of three-party binding, resulting in excessive exposure of data and compliance violations. The automated query generated by the intelligent agent cannot be forced to degrade to statistical information output in the compilation stage, increasing the risk of sensitive data leakage. The purification result buffer lacks template constraints, which will cause the report generation link to bypass the privacy shaping rules, violating the data minimization principle. Non-chain audit log cannot guarantee the integrity and non-tamperability of operation traceability, making it difficult to verify the authenticity and reproduction path of historical reports in compliance audit, reducing credibility and legal effectiveness.

[0022] To this end, referring to Figure 1 The application proposes a heterogeneous database secure access and report generation method based on MCP and intelligent agent: S100: receiving a task request and obtaining a task context, synchronizing capability declarations from multiple database adapters according to MCP, generating a capability graph through normalization processing and determining a capability version identifier; S200: performing semantic mapping of organizational access policies, data classification constraints and capability graph, obtaining policy inline rewriting rules and obtaining rewriting summary fingerprints; S300: issuing a minimum-privilege access token according to the task context, the rewrite summary fingerprint, and the capability version identifier, the minimum-privilege access token including a time range, a data range, and an operator range, the minimum-privilege access token being bound to the tool server identifier; S400: generating a cross-source query according to the agent, and performing forced rewriting according to the policy-inlined rewriting rule in a compilation stage, and when it is determined that the data minimization principle is not met or rewriting fails, converting the cross-source query into an alternative query that only returns statistical information and generating minimization proof information; S500: verifying the consistency of the minimum-privilege access token, the rewrite summary fingerprint, and the capability version identifier in a controlled execution environment, and when consistent, performing restricted access to the heterogeneous database and obtaining an original result; S600: processing the original result according to privacy and compliance shaping rules to obtain a purified result, and only allowing reading from a buffer of the purified result to generate a report under the constraint of a structured mode template, while calculating a report fingerprint; S700: writing the task request, the capability version identifier, the policy-inlined rewriting rule, the minimum-privilege access token, the rewrite summary fingerprint, the minimization proof information, and the report fingerprint into a chain audit log, fixing the audit log, and verifying report reproduction based on the audit log.

[0023] Specifically, MCP refers to a model context protocol, which can be implemented by using a declarative interface based on a unified terminology table and a version snapshot mechanism, is used for synchronizing the capability declaration of multi-source database adapters and generating a normalized capability graph, and solves the problem of inconsistent multi-source capabilities. The capability graph refers to a unified resource view formed by structured analysis and conflict resolution, which can be implemented by using a graph database or a resource description framework, is used for mapping the capability boundaries and constraint relationships of heterogeneous data sources, and ensures the semantic consistency of policy alignment. The policy inline rewriting rule refers to the conversion of access policies and data hierarchical constraints into query compilation stage forced rewriting logic, which can be implemented by using syntax tree traversal and rule chain matching algorithm, is used for implementing the minimization principle in the pre-compiled stage, and avoids the hysteresis of run-time interception. The minimum permission access token refers to a dynamic permission credential bound to a tool server, which can be implemented by using a token issuance and verification mechanism based on a digest check value, is used for implementing three-dimensional permission control of time, data and operator range in a controlled execution environment, and preventing unauthorized access. The alternative query refers to a query template that only returns statistical information after degradation, which can be implemented by using a pre-defined aggregation template and a threshold trigger mechanism, is used for automatically switching to a low-risk query mode when rewriting fails or the minimization principle is violated, and guarantees the compliance of the results. The chain audit log refers to an operation record that is tamper-proof and reproducible, which can be implemented by using a hash chain and a multi-copy solidification storage technology, is used for forming an end-to-end closed loop by linking the key evidence of the whole process, and supports trusted reproduction and responsibility tracing.

[0024] The application binds the three parties of capability graph normalization, policy inline rewriting and token execution verification, pre-fixes the permissions and compliance requirements in the cross-source query compilation stage, combines the alternative query degradation mechanism and the chain audit log, forms an end-to-end closed loop covering declaration synchronization, policy mapping, permission control, execution verification, result purification and trusted audit, and solves the problems of inconsistent policy interpretation, run-time control hysteresis and evidence chain breakage in heterogeneous database access.

[0025] The working process and principle of the application are as follows: first, receiving a task request and obtaining a task context, then synchronizing capability declarations from multiple database adapters according to MCP. The capability declarations are normalized to generate a capability graph, and the capability version identifier is determined. Then, the organization access policy, data hierarchical constraint and capability graph are semantically mapped to obtain policy inline rewriting rules and rewriting summary fingerprints. According to the task context, rewriting summary fingerprint and capability version identifier, a minimum permission access token is issued, which contains time range, data range and operator range, and is bound to a tool server identifier.

[0026] The intelligent agent generates a SQL query statement according to the user's intention. In the SQL compilation phase, the query is rewritten according to the policy inline rewriting rules. For example, sensitive fields are replaced with desensitization functions, data hierarchical filtering conditions are added, detailed queries are converted into aggregate queries, and the like. If the rewritten query still does not meet the data minimization principle, it is converted into an alternative query that only returns the number of records, distribution statistics, and the like, and minimization proof information is generated to explain the reason for the conversion.

[0027] In the execution environment, the validity of the access token is first verified, and then the capability version identifier, rewriting summary fingerprint in the token are compared with the current environment. After verification, the query is executed according to the restriction conditions of the token, and the original result is obtained.

[0028] The privacy protection algorithm, such as differential privacy, k-anonymity, etc., is applied to the original result to generate a purified result and store it in a temporary buffer. The report generator generates a report from the buffer only by reading the allowed fields and statistical values according to the pre-defined structured template. The hash value of the report content is calculated as the report fingerprint.

[0029] Finally, the key information of the whole process, including the task request summary, the capability version identifier, the rewriting rule summary, the access token summary, the rewriting fingerprint, the minimization proof, and the report fingerprint, etc., are written in time sequence in the block chain-like audit log. Each log entry contains the hash value of the previous entry, forming a chain structure that cannot be tampered with. The log is backed up in multiple copies and stored in encrypted form.

[0030] In subsequent compliance audits, the corresponding audit log entry can be located through the report fingerprint. The integrity of the log chain is verified, and then the query is re-executed using the recorded rewriting rules and minimization proof information, and the authenticity and reproducibility of the report are confirmed by comparing the generated verification fingerprint with the original report fingerprint.

[0031] Through the above scheme, the application realizes fine-grained control and full-process auditability of heterogeneous database access. Through capability versioning and three-party consistency binding, the scheme effectively prevents unauthorized access caused by changes in data source capabilities or policy execution bias. The query generated by the intelligent agent is subjected to forced rewriting and degradation processing, ensuring the implementation of the data minimization principle. The structured template constrained report generation mechanism and chain audit log provide end-to-end technical support for data use compliance. It reduces the risk of data leakage and improves the accuracy and traceability of access control in a heterogeneous data environment.

[0032] In some of the above schemes of the present application, the identity of the database adapter is not verified, which may lead to malicious data source access. The format and terminology of the capability declaration are inconsistent, which makes it difficult to normalize. The repeated or conflicting entries are not resolved, which makes the capability graph unreliable. The lack of sensitivity annotation and constraint relationship affects the accuracy of policy mapping. The lack of a complete snapshot and unique version identifier makes it impossible to verify the consistency of the data source state in the process.

[0033] The present application further proposes to verify the identity of the database adapter and establish a controlled communication channel. The capability declaration is received according to a unified terminology table and is structured parsed to extract the data source identifier, resource range, field list, available operation, parameter limit, data classification and regional boundary. The repeated or conflicting entries are resolved according to a preset priority and a consistent result is formed. Based on the sensitivity annotation of the field and operation, the data source node, resource node, field node, operation node and constraint relationship are established in the capability graph. A complete snapshot of the generated capability graph is formed and a digest check value is calculated. The unique capability version identifier is determined in combination with the effective time and source list.

[0034] The identity verification is achieved through two-way TLS certificate verification, and the controlled communication channel uses an encrypted transmission protocol. The structured parsing extracts the data source identifier field and resource range parameter based on a predefined JSON Schema template. The preset priority is sorted according to the data source trust level and the declaration timestamp. The declaration of a high-trust data source overrides the declaration of a low-trust data source. The sensitivity annotation dynamically marks the data classification field according to the security level. The constraint relationship connects the field node and the operation node through a directed edge. The complete snapshot contains the serialized representation and metadata of the capability graph. The digest check value is generated using the SHA-256 algorithm. The capability version identifier is generated by concatenating the snapshot hash value, the effective timestamp and the data source identifier list and then hashing it again.

[0035] Specifically, the database adapter needs to submit a digital certificate when establishing a connection. The certificate chain is used to verify the agency and data source type. If the verification fails, the connection is rejected. The capability declaration is converted into structured data according to a unified terminology table. For example, the "time range" field is mapped to the start and end timestamps in ISO 8601 format. In the conflict resolution process, if two data sources have different available operations for the same resource, the declaration content of the high-trust data source is preferred. In the capability graph construction, an inhibitory constraint relationship is established between sensitive fields and high-risk operations. For example, a field node containing personal identification information is prohibited from being directly associated with the raw data export operation. After the snapshot is generated, the capability graph is detected for changes by comparing the historical snapshot hash value. The version identifier ensures that the policy mapping and token issuance in the process are based on the same data source state.

[0036] As a preferred embodiment, the scheme of the application is implemented as follows: When receiving a task request and obtaining a task context, synchronizing capability declarations from multiple database adapters according to MCP, performing normalization processing to generate a capability graph and determining a capability version identifier, the following steps are included: First, the database adapter is identity-verified and a controlled communication channel is established. Specifically, a two-way TLS authentication method is used to verify the digital certificate of the adapter and an encrypted HTTPS communication channel is established.

[0037] Secondly, the capability declarations are received according to a unified terminology table and are structurally parsed, and the data source identifier, resource range, field list, available operation, parameter constraint, data classification and geographical boundary are extracted. For example, a unified capability declaration format is defined using JSON Schema, including the fields of dataSourceId, resourceList, fieldList, operationList, parameterConstraints, dataClassification and geoBoundary. The field values are extracted by a JSON parser.

[0038] Further, repeated or conflicting entries are resolved according to a preset priority and consistent results are formed. Specifically, when multiple adapters declare the same resource, the latest valid declaration is retained by selecting according to the update timestamp, version number and other priorities of the adapters.

[0039] Thus, based on the sensitivity annotation of fields and operations, data source nodes, resource nodes, field nodes, operation nodes and constraint relationships are established in the capability graph. For example, a graph database is used to store the capability graph, and the data source, resource, field and operation are modeled as different types of nodes, and the edges represent the relationships and constraints between them.

[0040] Finally, a complete snapshot of the generated capability graph is formed and a digest check value is calculated, and a unique capability version identifier is determined in combination with the effective time and source list. Specifically, the graph database is serialized to obtain a snapshot file, and its SHA256 hash value is calculated as the digest check value. The digest check value, effective timestamp and adapter source list are concatenated and Base64 encoded to obtain a capability version identifier string.

[0041] Through the above technical scheme, the application realizes the unified abstraction and versioned management of heterogeneous data source capabilities. Due to the use of standardized capability declaration format and graph-structured storage method, the consistency and queryability of capability description are improved. At the same time, by introducing the version identifier mechanism, the capability changes are traceable, which is convenient for access control and auditing. It helps to ensure the consistency and verifiability of the entire process.

[0042] In the above some schemes of the application, in the process of semantically mapping the organization access policy, data classification constraints and capability map, there are problems such as unclear classification of policy entries, misalignment of rule generation and capability map resource range and available operations, which leads to difficulty in ensuring the consistency of policy and data source capability during cross-source query rewriting, and also cannot automatically generate alternative query templates in case of rule conflict, affecting the execution of data minimization principle and traceability.

[0043] The application further proposes to establish a unified term and field mapping relationship, classify policy entries according to column set, row filtering, operation category, regional boundary and data quota; generate mandatory aggregation, bucket interval, minimum sample threshold and time window according to sensitivity annotation, and align them with the resource range and available operations in the capability map to form a rewriting rule chain; perform syntax normalization and order merging on the structured query statement to be executed, complete forced rewriting according to the rewriting rule chain in the compilation phase, and obtain the rewriting product; generate a unique rewriting summary fingerprint based on the rewriting product and capability version identifier through an irreversible digest algorithm; when the rule conflict cannot meet the data minimization principle, output an alternative query template containing only count and distribution and generate minimization proof information.

[0044] Among them, the establishment of unified term and field mapping relationship is realized through a pre-defined term comparison table, ensuring that the terms in the policy are consistent with the field names in the capability map. The policy entry classification adopts a pattern matching method based on regular expressions, which automatically classifies the policy content into column set, row filtering, operation category, regional boundary or data quota category. The generation of rewriting rule chain adopts a rule priority sorting algorithm, which arranges the mandatory aggregation, bucket interval and time window rules in descending order according to the sensitivity annotation level, ensuring that high-sensitive fields apply constraint rules first. The syntax normalization process is realized through abstract syntax tree reconstruction, eliminating the syntax differences of different database dialects. The irreversible digest algorithm uses SHA-256 hash function, and the input parameters include the hexadecimal encoding of the rewritten query text and the capability version identifier. The generation of alternative query template is realized by matching the pre-set statistical template library, and the corresponding count, quantile or distribution statistical template is selected according to the type of the triggering conflict rule.

[0045] Specifically, in the policy mapping stage, the "customer identification" field in the policy is mapped to the "user_id" field in the capability map through the term correspondence table, eliminating semantic ambiguity. The policy entry classifier identifies the "only allow access to north China order data" statement in the policy and classifies it into the regional boundary and line filtering category. The rewrite rule chain generator creates a bucket interval rule to convert specific amount values to amount interval identifiers based on the high sensitivity annotation of the order amount field. The syntax normalizer converts the original query "SELECT * FROM orders" to the standardized "SELECT col1, col2 FROM orders WHERE region='north_china'", eliminating wildcard queries. The abstract generator hashes the standardized query text and the capability version identifier "v2.3.1" to generate a 64-bit hexadecimal fingerprint. When it is detected that the query involves high-sensitive fields and does not meet the minimum sample threshold, the replacement engine calls the "COUNT_DISTINCT" template to generate a replacement query and records the list of excluded fields and the triggering threshold. The entire process is applied through the hierarchical application of rule chains to ensure that the rewritten query strictly matches the data source capability range and policy constraints, while the abstract fingerprint and replacement template mechanism ensure the verifiability of the operation and the transparency of the degradation processing.

[0046] As a preferred embodiment, the scheme of the application is implemented as follows: A unified term and field mapping relationship is established, and policy entries are classified according to column sets, line filtering, operation categories, regional boundaries, and data quotas. For example, "customer ID" is mapped to "user_id", "transaction amount" is mapped to "amount", and policy entries are classified into "visible columns", "line-level filtering", "allowed operations", "data region", and "query quota".

[0047] According to the sensitivity annotation, generate mandatory aggregation, bucket interval, minimum sample threshold, and time window, and align them with the resource range and available operations in the capability map to form a rewrite rule chain. Specifically, for fields marked as "highly sensitive", generate "mandatory aggregation" rules; for continuous data, set the bucket interval, such as "0-18", "19-30", "31-50", "51+" intervals; set the minimum sample threshold to 100 and the time window to 30 days. Match these rules with the declared resources and operations in the capability map to form a series of sequentially executed rewrite rules.

[0048] The syntax of the structured query statement to be executed is normalized and sequentially merged, and the forced rewriting is completed in the compilation phase according to the rewriting rule chain to obtain a rewritten product. Further, the SQL query is converted into a standardized abstract syntax tree, the tree is transformed by applying the rewriting rule chain, such as adding an aggregation function, replacing an exact value with a bucket interval, adding a time range limit, and the like, and finally a rewritten query statement is generated.

[0049] Based on the rewritten product and the capability version identifier, a unique rewritten summary fingerprint is generated by using an irreversible summary algorithm. Thus, by using a cryptographic hash function such as SHA-256, the rewritten query statement and the capability version identifier are concatenated to calculate a summary, and a fixed-length fingerprint value is obtained.

[0050] When the rule conflict cannot meet the data minimization principle, an alternative query template containing only the count and the distribution is output, and minimization proof information is generated. For example, when the original query involves too many sensitive fields or the sampling range is too large, the query is automatically converted into a query that only returns the total number and the percentage distribution, and the reason for triggering the minimization and the measures taken are recorded.

[0051] Through the above technical solutions, the semantic-level mapping and consistency guarantee of the policy and the capability are realized. The generation of the rewriting rule takes into account the data sensitivity, hierarchical constraints and capability limitations, ensuring that the query is forcibly adjusted to a compliant form in the compilation phase. Illegal access is prevented by bypassing the rewriting. When the minimization requirement cannot be met, the query is automatically degraded to a statistical query and the proof is retained, which protects sensitive data and retains necessary analysis capabilities. This method improves the query efficiency and controllability in a cross-source heterogeneous environment while guaranteeing data security and compliance.

[0052] In some of the above schemes of the present application, when generating the minimum permission access token, there are problems of insufficient dynamic adjustment of permission range, loose binding of token and execution environment, and unclear invalidation conditions, which may lead to misuse or unauthorized access of the token, and it is difficult to ensure the consistency of the permission control and the execution process of the cross-source query.

[0053] The present application further proposes that when issuing the minimum permission access token, the task time requirement, the data usage range and the operation requirement are analyzed, the time range, the data range and the operator range are determined, the column set, the row filtering and the aggregation requirement are extracted according to the rewritten summary fingerprint, and written into the token restriction field, the capability version identifier is written into the token consistency field, the digest check value is generated, the token is issued to the tool server and bound with the tool server identifier, the invalidation conditions including expiration, quota exhaustion and revocation are set, and the token restriction field, the token consistency field and the digest check value are saved in the issuance registration.

[0054] Wherein, when analyzing the task time requirement, the time range is set to twice the task execution time, for example, if the task is expected to execute for 2 hours, the time range is set to 4 hours; the data range is limited to the column set of a specific database table through the field list and resource identifier in the task context; and the operator range is limited to summation, average calculation and grouping statistics according to the task operation requirement. When generating the summary check value, SHA-256 algorithm is used to hash calculate the token limit field, the consistency field and the tool server identifier to generate a 64-bit check code. When binding the tool server identifier, the tool server identity is verified through a digital certificate, and the certificate fingerprint is associated with the token. When setting the invalidation condition, the quota exhaustion invalidation is realized through a preset data row threshold or an aggregated result quantity threshold, for example, a maximum of 1000 rows of data is returned for a single query.

[0055] Specifically, in the issuance phase, the task time requirement is parsed into a time window, for example, from 08:00 on October 1, 2024 to 12:00 on October 1, 2024, and query requests exceeding the time range will be rejected. The data range is limited according to the column set extracted from the rewritten summary fingerprint, for example, only the "age" and "region" fields of the user table are allowed to be accessed, and the "name" field is filtered out. The operator range is limited according to the aggregation requirement in the policy inline rewriting rule, for example, only bucket statistics and counting operations are allowed to be performed. The token consistency field writes the capability version identifier, for example, "Capability_v2.3", to ensure consistency with the capability graph version in the execution phase. The summary check value is generated through a hash algorithm, for example, the input field is "age | region | count | Capability_v2.3 | Server_001", and the output is a fixed-length check code. When binding the tool server identifier, the fingerprint information of the server certificate is verified, for example, "Cert_123456", to ensure that the token can only be used on the specified server. In the invalidation condition, the quota exhaustion invalidation is realized through a counter, for example, 1 quota is consumed for each query, and the total quota is 10 times, which will automatically expire after exceeding. The fields saved in the issuance registration are used for auditing and consistency verification, for example, the registration information includes the time range, field list, hash value and server identifier. Through the above steps, the permission range of the token is dynamically limited, strongly bound with the execution environment and capability version, and the invalidation condition is quantified, so as to realize fine-grained permission control and traceability of the execution process in cross-source query.

[0056] As a preferred embodiment, the scheme of the application is implemented as follows: The time range, data range and operator range are determined by analyzing the task time requirement, data usage range and operation requirement. For example, for a task of analyzing the purchase behavior of users in a certain region in the past 30 days, the time range is set to 30 days before the current time, the data range is limited to the user purchase record table of the region, and the operator range includes basic operations such as selection, projection and aggregation.

[0057] The column set, row filtering and aggregation requirements are extracted according to the rewritten abstract fingerprint, and the token limit field is written. Specifically, the list of column names allowed to access, the row-level filtering condition and the aggregation operation that must be performed are parsed from the rewritten abstract fingerprint, and the information is encoded and written to the limit field of the token.

[0058] The capability version identifier is written to the token consistency field. The capability version identifier is a unique identifier of the data source capability declaration, which is used to ensure that the token is consistent with the current data source capability.

[0059] The abstract check value is generated. Further, a cryptographic hash function is used to calculate all fields of the token to obtain a fixed-length abstract check value, which is used to verify the integrity of the token.

[0060] The token is issued to the tool server and bound to the tool server identifier. Thus, the generated token is securely transmitted to the designated tool server, and the unique identifier of the server is recorded in the token to prevent the token from being transferred and used.

[0061] The expiration condition is set, including expiration, quota exhaustion and revocation, and the token limit field, token consistency field and abstract check value are saved in the issuance register. Specifically, the token is set with an expiration date, a maximum number of uses or a data volume limit, and a mechanism that can be actively revoked by an administrator.

[0062] Through the above technical solutions, the present application realizes minimum privilege access control based on task context, rewritten results and data source capabilities. The token contains fine-grained access restrictions and is bound to a specific tool server, preventing unauthorized access. Through multiple failure mechanisms and a central issuance register, the security and manageability of the token are enhanced. At the same time, the consistency field and abstract check value contained in the token ensure the consistency of the access control policy and the data source capability, and prevent the token from being tampered with. This method not only ensures data security, but also improves the flexibility and efficiency of heterogeneous database access.

[0063] In some of the above schemes of the present application, a minimum privilege access token is used to limit the time range, data range and operator range of access. However, there is a lack of dynamic quota consumption monitoring and real-time consistency verification mechanism during execution, which may lead to repeated use or out-of-range execution of the privilege token, and there is a risk of abuse of privileges.

[0064] The application further proposes that before each execution, the token's digest check value, token consistency field, and the consistency of the rewritten digest fingerprint and capability version identification are checked in advance, and if consistent, the execution can continue; during the execution process, the time range, data range, and operator range are compared and accumulated one by one, and when any limit is broken or the quota is exhausted, the access is terminated, and the downgrade reason is recorded; if the minimization principle cannot be met, the execution is rejected, and the verification record and quota consumption record are written into the audit log.

[0065] Among them, the digest check value is generated by an irreversible algorithm, which is used to verify that the token has not been tampered with; the token consistency field stores the digest value of the capability version identification, which is compared with the version digest of the current capability graph to ensure that the policy and data source capability are synchronized; the item-by-item comparison during the execution process includes whether the timestamp is within the allowed interval, whether the access field exceeds the data range, and whether the operation type is within the operator range, and the cumulative count updates the data row count or calculates the resource consumption in real time through the counter, and when the preset threshold is reached, the termination is triggered; the downgrade reason record includes the specific values of timeout, super field, super operation type, or quota exhaustion; the verification record includes the execution time, tool server identification, comparison result, and execution status.

[0066] Specifically, before execution, the token is verified by the double verification of the digest check value and the consistency field to ensure that it matches the current policy version and the rewritten result, preventing the use of expired or invalid tokens. During the execution process, the timestamp, field list, and operation type are compared in real time, and the data row access volume or the calculation resource consumption is accumulated by the counter, and the quota usage state is dynamically monitored. For example, when the time range is set to January to June 2024, and the query time window is detected as July 2024 during execution, the execution is immediately terminated; when the data range is limited to the sales data of department A, and the data field of department B is accessed, the downgrade is triggered. The verification record generated by each execution includes the actual access time, the number of access fields, the operation type, and the number of rows consumed, which is calculated by the difference with the preset threshold and written into the audit log. When the quota is exhausted, the session is automatically terminated and the resources are released, preventing unauthorized operations. This process forms a closed-loop control through dynamic verification and real-time monitoring, ensuring that each access strictly follows the principle of least privilege, while recording the execution trajectory to support post-audit and responsibility tracing.

[0067] As a preferred embodiment, the scheme of the application is implemented as follows: The minimum-privilege access token is checked for consistency of the digest verification value, the token consistency field, and the rewritten digest fingerprint, and the capability version identifier before each execution. Specifically, the execution environment first obtains the digest verification value and the consistency field in the token, and simultaneously obtains the current rewritten digest fingerprint and the capability version identifier. Then, these values are compared, and only when all values completely match, is the execution allowed to continue.

[0068] During the execution, the time range, data range, and operator range are compared and accumulated count by item. For example, for the time range, it is checked whether the timestamp of each operation is within the allowed range; for the data range, it is tracked whether the accessed data volume exceeds the limit; for the operator range, it is recorded that each type of operation and the number of times are used. When any limit is broken or the quota is exhausted, the access is terminated, and the downgrade reason is recorded.

[0069] If the minimization principle cannot be met, the execution is rejected. Further, it is evaluated whether the request meets the data minimization requirement, and if not, the execution of the request is directly rejected.

[0070] Finally, the verification record and the quota consumption record are written into the audit log. The verification record includes the token verification result, the range comparison result, and the like; the quota consumption record details the use of various operations. These information are written in a structured format into the non-tamperable audit log.

[0071] Through the above technical solutions, the present application realizes multiple verification and fine control of database access. Thus, unauthorized access and operations beyond the authority can be prevented, ensuring data security and privacy protection. Further, through detailed audit log recording, the traceability and accountability are improved. Specifically, the scheme can timely discover and prevent potential data leakage risks, reducing the possibility of abuse of sensitive information.

[0072] In some schemes of the present application, when the cross-source query is forcibly rewritten in the compilation phase, due to the lack of systematic syntax standardization and dependency parsing mechanism, the rewritten query may still contain un-identified sensitive fields or high-risk operations, or introduce resources beyond the allowed range in cross-source connection, thereby triggering permission verification failure or causing data leakage risk in the execution phase.

[0073] The application further proposes a specific method of forced rewriting according to policy inline rewriting rules in the compilation phase, including: syntax normalization and dependency parsing of cross-source queries, determining column sets, row filtering, connection relationships and operation sequences; taking policy inline rewriting rules as sequential rule chains, inserting column-level filtering, row-level filtering, sensitive field desensitization, mandatory aggregation, bucket grouping, sampling upper limit and time window in sequence, and limiting cross-source connections, replacing allowed connections with aggregation results; replacing high-risk operations and recording the replaced operations and reasons in the rewriting record; when the rewritten query still contains resources or operations inconsistent with the capability version identifier, prohibiting entering the execution phase.

[0074] Among them, syntax normalization converts queries into standard intermediate representations by unifying the syntax differences of different databases, such as converting JOIN operations of different dialects into unified relational algebra expressions. Dependency parsing identifies column references, filtering conditions and connection paths in the query by constructing an abstract syntax tree, such as extracting the field list in the SELECT clause and the filtering conditions in the WHERE clause by traversing the tree nodes. Column-level filtering automatically adds field whitelist restrictions based on policy rules, such as retaining only allowed fields and excluding unauthorized sensitive columns. Row-level filtering injects additional conditional expressions, such as appending time range or regional boundary constraints in the WHERE clause. Sensitive field desensitization uses dynamic masking functions, such as retaining the first three digits of an ID number and replacing the rest with asterisks. Cross-source connection restriction checks whether the connection table belongs to the same data hierarchy or regional boundary, such as replacing cross-regional table connections with pre-computed aggregation results. High-risk operation replacement maps the original operation to a compliant operation, such as replacing direct reading of user lists with counting the number of users by grouping.

[0075] Specifically, in the compilation phase, the cross-source query is first parsed into an intermediate representation form, and key elements are extracted through dependency parsing, such as identifying the involved tables, fields, and operation types. Then, according to the policy rule chain, constraints are inserted in sequence, such as retaining only authorized fields in the SELECT clause and adding time filtering conditions in the WHERE clause. For sensitive fields, a desensitization function is dynamically called for processing, such as partially hiding phone numbers. The cross-source connection is checked for legality after parsing, and if it exceeds the allowed range, it is replaced by a pre-aggregated result, such as converting a detailed join query into a form that only returns aggregated indicators of each table. High-risk operations such as full export are replaced by paginated statistics, and the replaced records are written to a log for auditing. Finally, the rewritten query must be consistent with the resource and operation list in the capability version identifier, such as checking that all involved tables are registered in the current version of the capability map and that the operation type conforms to the permission range. If there is an inconsistency, the execution process is terminated to avoid potential unauthorized access. Through the above steps, the rewriting process in the compilation phase achieves fine-grained control of the query, ensuring that the query meets the policy requirements before execution, and reducing the risk of data exposure through replacement and restriction mechanisms.

[0076] As a preferred embodiment, the scheme of the present application is implemented as follows: In the compilation phase, when performing forced rewriting according to the policy inline rewriting rules, first, the cross-source query is subjected to syntax normalization and dependency parsing. Specifically, the query statement is converted into a standard Abstract Syntax Tree (AST) form and subjected to syntax checking. Then, by traversing the AST, the column set involved in the query, the row filtering condition, the inter-table connection relationship, and the operation sequence are determined.

[0077] Next, the policy inline rewriting rules are used as a sequential rule chain to modify the AST in sequence. First, column-level filtering is inserted to remove unauthorized columns from the selection list. Second, row-level filtering conditions such as time range, data owner, and other constraints are added. For sensitive fields, desensitization function calls are inserted, such as partial masking of ID numbers.

[0078] Further, mandatory aggregation operations such as sum or average of sensitive indicators are forcibly inserted. For continuous data, grouping is performed according to predefined bucket intervals. At the same time, a sampling upper limit is set to control the number of returned rows, and the time window range of the query is limited.

[0079] For cross-source connection operations, it is checked whether the connection exceeds the allowed range. If it does, the connection is replaced by aggregated results for each table. For example, a detailed join query is converted into a form that only returns aggregated indicators of each table.

[0080] In addition, for high-risk operations such as batch update, deletion, etc., replace them with safe equivalent operations or directly prohibit them. The replaced or prohibited operations and reasons are recorded in the rewriting record for auditing.

[0081] Finally, the rewritten query is compared with the capability version identifier. When it is found that there are still resources or operations in the query that are inconsistent with the current capability version, the query is prevented from entering the execution phase, thereby ensuring the compliance of the query.

[0082] Through the above technical solutions, the present application realizes comprehensive security rewriting of cross-source queries in the compilation phase. As a result, the query is forced to be adjusted to a form that complies with the access policy before execution, preventing unauthorized access and sensitive data leakage. At the same time, by binding the rewriting process with the capability version, it is ensured that the query is always executed within the authorized scope, improving security and controllability. The transparency and explainability of the entire data access process are enhanced.

[0083] In some of the above schemes of the present application, when the cross-source query is forced to rewrite according to the policy inline rewriting rule in the compilation phase, although it can achieve policy compliance through the insertion of filtering, desensitization and aggregation operations, it cannot deal with scenarios where the number of columns, the proportion of sensitive fields, the row coverage range or the time span exceed the preset threshold, resulting in the possibility of violating the data minimization principle in the execution phase and the risk of exposing sensitive information.

[0084] The present application further proposes a technical solution of converting the cross-source query into an alternative query that only returns statistical information and generating minimization proof information when it is determined that it does not comply with the data minimization principle or rewriting fails.

[0085] Among them, the preset threshold is pre-configured as the upper limit of the number of columns, the percentage of the proportion of sensitive fields, the limit of the row coverage range and the maximum value of the time span, and the number of columns involved in the query, the proportion of sensitive fields, the row coverage range and the time span are calculated in real time. Compare with the threshold; the alternative query template is designed to have a fixed format containing only counting, distribution statistics or the first few results, and the grouping yardstick and time window are forced to align to the preset safe range; the minimization proof information is formed by recording the list of excluded fields, the list of limited operations, the trigger threshold entry, the alternative query template identifier and the degradation reason, forming a complete evidence chain; before the execution phase, register the proof information with the rewriting summary fingerprint to ensure traceability in the auditing phase.

[0086] Specifically, when the cross-source query completes the policy rewriting in the compilation phase, the number of columns, the proportion of sensitive fields, the row coverage range, and the time span are quantitatively evaluated. For example, if the query involves more than 5 sensitive fields and the proportion is more than 30%, the degradation mechanism is triggered. At this time, the original query is replaced by a substitute template that only returns the number of records under each group, and the grouping is fixed according to the monthly time window. The generated minimization proof information records the sensitive field names that are removed, the original aggregation operations that are limited, the 30% sensitive field threshold entries that are triggered, and the substitute template identifier that is used. This proof information is written into the registration table together with the rewriting summary fingerprint to ensure that the execution and audit phases are verifiable. Through preset threshold judgment and automatic degradation conversion, the query execution path that violates data minimization is blocked in the compilation phase, and through structured proof information and registration mechanism, complete basis is provided for audit reproduction.

[0087] As a preferred embodiment, the scheme of the present application is implemented as follows: According to the preset threshold, the number of columns, the proportion of sensitive fields, the row coverage range, and the time span are determined for minimization. Specifically, the column number threshold can be set to 10 columns, the sensitive field proportion threshold to 30%, the row coverage range threshold to 100 million rows, and the time span threshold to 1 year. When any indicator exceeds the corresponding threshold, degradation processing is triggered.

[0088] Further, the original query is converted into a substitute query template that only contains counting, distribution, or the first few items. For example, for the original detailed query "SELECT FROM table WHERE date _ '2022-01-01'", it can be converted into "SELECT COUNT() FROM table WHERE date _ '2022-01-01'" or "SELECT field, COUNT() FROM table WHERE date _ '2022-01-01' GROUP BY field ORDER BY COUNT() DESCLIMIT 10" and other substitute query templates. Among them, the grouping range and time window are fixed to ensure that the granularity of the query result meets the minimization principle.

[0089] Thus, the minimization proof information is generated. This information includes the list of removed fields, the list of limited operations, the trigger threshold entries, the identifier of the substitute query template used, and the reason for degradation. Specifically, the list of removed fields records the sensitive fields removed in the original query; the list of limited operations contains the high-risk operations that are replaced or disabled; the trigger threshold entries indicate the specific indicators that cause degradation; the substitute query template identifier is used to mark the template type used; and the reason for degradation briefly explains the reason for triggering degradation, such as "high proportion of sensitive fields" or "large query range".

[0090] Finally, the minimization proof information is registered with the rewritten summary fingerprint before entering the execution phase. This step ensures the traceability of the downgrade process.

[0091] Through the above technical solutions, the present application realizes automatic conversion of cross-source queries into alternative queries that only return statistical information in the case of non-compliance with the data minimization principle or rewriting failure, and generates detailed minimization proof information. This method prevents the overexposure of sensitive data while preserving the core statistical value of the query. Through fixed alternative query templates and strict threshold control, the consistency and controllability of the query results are ensured. In addition, the generated minimization proof information enhances the transparency and traceability of the entire query process. The security of data access is improved, and the need for manual intervention is reduced.

[0092] In some of the above schemes of the present application, controlled access to cross-source queries is achieved through policy inline rewriting rules and minimum privilege access tokens. However, there may be risks of data leakage caused by inconsistency between capability version identification and policy rewriting results, token tampering or usurpation, and execution environment not isolated, which in turn leads to unauthorized access or policy execution deviation.

[0093] The present application further proposes that when verifying the consistency of minimum privilege access tokens, rewritten summary fingerprints, and capability version identification in a controlled execution environment, the following steps are included: establishing an isolated execution session, collecting tool server identification, capability version identification, minimum privilege access tokens, and rewritten summary fingerprints; checking the validity of the minimum privilege access tokens, which includes time range, revoked state, and quota consumption state; comparing the consistency, which includes whether the token consistency field and the capability version identification are consistent, whether the normalized representation of the query to be executed and the rewritten summary fingerprint are consistent, and whether the tool server identification bound by the token and the current tool server identification are consistent; if consistent, enabling restricted access and performing item-by-item comparison and execution according to the token's time range, data range, and operator range.

[0094] Among them, the isolated execution session realizes resource isolation through independent processes and network namespaces, preventing external processes from interfering or stealing session data. The tool server identification is obtained using a two-way authentication mechanism, including the serial number in the digital certificate and the hardware fingerprint. The capability version identification and the rewritten summary fingerprint are generated through a hash algorithm and stored in a tamper-proof register. The validity check is implemented by querying the token state table in the issuance registration, and the quota consumption state is updated in real time by an accumulation counter. The consistency comparison uses memory calculation, avoiding disk read-write delay, and triggering an alarm and terminating the session when the comparison fails. Restricted access is achieved through dynamic loading of an access control list, and data range and operator range are stored in bitmap form, with fast matching through bitwise operations during execution.

[0095] Specifically, the execution environment creates an independent container at startup, allowing only the tool server identifier, capability version identifier and token to be transmitted through a secure channel. The verification module calls the issuance registration interface to verify whether the token is within the valid time window and has not been marked as revoked, while checking whether the number of queries or the amount of data consumed exceeds the preset quota. The comparison module performs string matching between the consistency field embedded in the token and the capability version identifier, and calculates the hash value of the normalized abstract syntax tree after rewriting the query statement, and performs equality checking with the rewritten abstract fingerprint. The tool server identifier comparison uses asymmetric encryption signature verification to ensure that the execution subject and the token binding object are consistent. After passing the consistency check, the access engine parses the time range, data range and operator range in the token and compiles them into access control rules. During execution, the current timestamp is checked before each data operation to determine whether it is within the allowed range, whether the access field and operation code are included in the permission bitmap, and the number of rows or aggregate results are accumulated. When time overrun, field out-of-bounds or quota exhaustion is detected, the query is terminated immediately and the temporary data is rolled back, and the exception event is written to the audit log.

[0096] As a preferred embodiment, the scheme of the application is implemented as follows: when establishing an isolated execution session, a secure container technology is used to create an independent running environment and configure resource access boundaries. After the execution session is started, the digital certificate identifier of the current tool server is collected, the minimum permission access token issued is read from the local cache, the current valid value of the capability version identifier is obtained through a trusted channel, and the verification code of the rewritten abstract fingerprint is extracted from the compilation phase log. During the validity verification process, the time synchronization service is called to verify whether the time range of the token is within the valid period, the token registration table is queried to confirm that it has not been marked as revoked, and the cumulative consumption quota of the data range and operator range is checked to determine whether it exceeds the preset threshold. In the consistency comparison stage, the consistency field embedded in the token is compared with the current effective capability version identifier, the normalized syntax tree of the query to be executed is compared with the pre-stored template corresponding to the rewritten abstract fingerprint for structural similarity, and the tool server certificate identifier and the device fingerprint bound by the token are verified for complete match. When all verification items pass, the rewritten query statement is loaded in the controlled execution environment, the row-level filter condition is dynamically generated according to the data range recorded in the token, the number of calls to the aggregation function is limited according to the operator range, and the quota consumption counter is updated after each data access operation.

[0097] By the technical solution, the application solves the technical problems of insufficient credibility of an execution environment in a cross-source heterogeneous database access process and overstepping operation caused by disconnection of a permission token and a policy version. By establishing a multiple consistency checking mechanism and an isolated execution environment, it is ensured that an actual executed query operation is strictly synchronized with a pre-declared data source capability version and a policy rewriting result, effectively preventing data leakage risks caused by version drift or token tampering. An access control mechanism based on dynamic quota counting and real-time state checking further limits the influence range of abnormal operation.

[0098] In some solutions of the application, the execution stage only relies on the preliminary checking of the token and the query fingerprint, lacks multi-dimensional dynamic checking of the tool server identity, capability version state and token quota consumption, and thus the execution environment may be hijacked or tampered with, resulting in the risk of overstepping of permissions and data leakage.

[0099] The application further proposes that when checking the consistency of the minimum permission access token, the rewritten summary fingerprint and the capability version identifier in the controlled execution environment, the following steps are included: establishing an isolated execution session, collecting the tool server identifier, the capability version identifier, the minimum permission access token and the rewritten summary fingerprint; checking the validity of the minimum permission access token, the checking content including the time range, the revoked state and the quota consumption state; comparing the consistency, the comparison content including whether the token consistency field and the capability version identifier are consistent, whether the normalized representation of the to-be-executed query and the rewritten summary fingerprint are consistent, and whether the tool server identifier bound by the token and the current tool server identifier are consistent; when consistent, enabling restricted access and performing item-by-item comparison and execution according to the time range, data range and operator range of the token.

[0100] The isolated execution session creates an independent process space through virtualization technology or container technology to block illegal injection of external processes; the tool server identifier is in the form of a digital certificate or a hardware feature code, and identity verification is completed through a two-way authentication protocol in the session initialization stage; the capability version identifier and the rewritten summary fingerprint are stored in an encrypted form after being generated in the compilation stage, and the original values are restored through decryption before execution for comparison; the token validity check is completed by querying the revocation list and the quota consumption record in real time, and the quota consumption record includes the accessed data volume, the operation times and the time span; the consistency comparison adopts a hash algorithm to calculate the summary of the token consistency field and the capability version identifier, and verifies whether the syntax tree of the to-be-executed query and the preset syntax tree corresponding to the rewritten summary fingerprint are structurally identical.

[0101] Specifically, the execution environment starts by first creating an isolated session space, loading the secure sandbox module to restrict the process's permissions, and only allowing access to predefined database connection endpoints. The tool server submits a digital certificate upon connection, which is verified through a certificate chain to confirm its legitimacy and extracts a unique identifier from the certificate as the tool server identification. Subsequently, the encrypted capability version identifier and rewritten digest fingerprint are read from the compiled product, and decrypted using a preset key to obtain the plaintext values. Upon loading, the minimum-privilege access token sends a query request to the issuing service to obtain the revocation status and current quota consumption ratio of the token, and if the token has been revoked or the time range exceeds the current time window, execution is terminated immediately. In the consistency comparison phase, the capability version identifier embedded in the token is compared byte by byte with the decrypted capability version identifier to ensure that the data source capability declaration has not been tampered with; at the same time, the abstract syntax tree of the query to be executed is serialized into a byte stream, and its hash value is calculated and matched with the rewritten digest fingerprint to prevent the query from being maliciously modified. The tool server identification comparison checks whether the identification field bound to the token is consistent with the identification verified in the current session to prevent the token from being illegally transferred. After all comparisons pass, an access controller is created according to the time range, data range, and operator range defined in the token, which monitors the data access volume, operation type, and timestamp of each operation in real time during query execution, and immediately interrupts the connection and triggers an alarm when the cumulative value exceeds the token quota or an unauthorized operation is detected.

[0102] As a preferred embodiment, the scheme of the present application is implemented as follows: The privacy and compliance shaping rule set is pre-configured to include de-identification rules, column-level retention rules, row-level filtering rules, regional boundary rules, minimum sample threshold rules, bucketing and aggregation rules, statistical perturbation rules, sensitive word replacement rules, privacy budget deduction rules, and over-limit rejection rules. The original result is first de-identified to remove direct identifiers such as names and ID numbers; then the row-level filtering rules are applied to exclude data rows that do not meet the regional boundary conditions. Aggregation and bucketing operations are forcibly applied to sensitive fields, such as bucketing the age field into ten-year intervals and converting the salary field into a level interval. The statistical perturbation module adds Laplace noise to the aggregated results, and the noise level is dynamically adjusted by the privacy budget. The purified results need to pass the minimum sample threshold test, and if the number of samples in a group is below the preset threshold, the over-limit rejection condition is triggered, and the relevant results are cropped and an error label is added. The purified results are written to a buffer that only allows internal access within the execution session. The report generator reads the field names, numerical units, and chart types defined in the structured mode template, such as allowing only the salary distribution after bucketing to be displayed in a bar chart, and the numerical unit is limited to thousands of yuan. The report fingerprint is generated by the SHA-256 algorithm, and the input data includes the purified result digest, template version identifier, and noise parameter.

[0103] By the technical solution, the content and granularity of the original data are controlled, direct identification information is forcibly eliminated, and the data display form is restricted, so that the sensitive fields are prevented from being exposed at the report level by accident. Through the cooperation of the shaping rules in the fixed sequence and the structured template, it is ensured that the output result always meets the minimum necessity principle and the compliance requirement. The fingerprint generation mechanism based on the irreversible digest check value can quickly identify any tampering of the report content and the generation process.

[0104] In some solutions of the application, the generation and reproduction verification mechanism of the chain audit log lacks the guarantee of the continuity and consistency between the log units, and the log content is not bound with the structured mode template and the alternative query template, so that the audit log is easy to be tampered with or the report generation process cannot be accurately reproduced, and it is difficult to verify the integrity and credibility of the purification result.

[0105] The application further generates one log unit in one processing, normalizes the task request digest, the capability version identifier, the policy inline rewriting rule digest, the minimum permission access token digest, the rewriting digest fingerprint, the minimization proof information and the report fingerprint, calculates the irreversible digest check value of the current log unit, sequentially connects the irreversible digest check value of the previous log unit and the irreversible digest check value of the current log unit, generates a connection check field and writes it into the chain audit log together with the trusted time mark, adopts an append-only and unmodifiable storage strategy for the chain audit log, and solidifies multiple copies after writing. In the reproduction verification, the target log unit is located according to the report fingerprint or the task request, the connection check fields from the starting log unit to the target log unit are checked for continuity and consistency, and after the check is passed, the minimum playback is performed according to the policy inline rewriting rule digest and the minimization proof information, the digest of the purification result is recalculated only with the alternative query template and the structured mode template, and the verification fingerprint for comparison is generated. When the verification fingerprint is consistent with the report fingerprint, it is determined that the reproduction is passed, otherwise the reproduction result output is refused.

[0106] The generation of the log unit calculates the irreversible digest check value by the SHA-256 algorithm, for example, splicing the task request digest and the capability version identifier and inputting the hash function; the implementation mode of the connection check field is to perform XOR operation on the hash value of the previous log and the hash value of the current log and then perform twice hashing; the multiple copy solidification adopts a distributed storage node synchronous writing mechanism, and each copy is stored in an independent physical device; the minimum playback in the reproduction verification stage matches the template identifier through the preset alternative query template library, and only allows to use the aggregation function and the bucketing rule defined in the template.

[0107] Specifically, when the log unit is generated, the task request summary, capability version identifier, and the like are serialized into a JSON format and Base64 encoded, and a fixed-length check value is generated by a hash function. The connection check field is formed by sequentially splicing the hash values of the previous unit and the current unit and hashing again to form a chain structure. When the log is written, an append-only mode is adopted, and after each write, data replicas are synchronized to three independent nodes. In the reproduction verification stage, the corresponding log unit is searched according to the report fingerprint, and the hash continuity is checked by traversing the chain structure. After that, the column filter condition and aggregation function in the strategy inline rewrite rule summary are extracted, combined with the bucketing parameters in the alternative query template, and the query is re-executed in a sandbox environment to calculate the sanitized result summary. If the newly generated summary matches the report fingerprint, it is determined that the reproduction is valid. For example, when the original report contains age bucketing statistics, only the 5-year interval bucketing rule is allowed to be used to recalculate the interval count in the reproduction stage, and access to the original age data is prohibited.

[0108] As a preferred embodiment, the scheme of the present application is implemented as follows: after a data processing task is completed, an independent log unit is generated, which contains a task request summary, a capability version identifier, a strategy inline rewrite rule summary, a minimum permission access token summary, a rewrite summary fingerprint, minimum proof information, and a report fingerprint. The fields in the log unit are processed by format normalization, uniformly converted to JSON-LD format, and redundant spaces are removed. The irreversible digest check value of the current log unit is calculated using the SHA-256 algorithm on the normalized content to generate a 64-bit hexadecimal string. The irreversible digest check value of the previous log unit is sequentially spliced with the current calculation result to form a connection check field, and a UTC time label provided by a trusted time stamp service is attached. The chain audit log is stored in a distributed file using an append-only write mode, and data solidification is achieved through a three-replica synchronization strategy, and after writing, modification or deletion is prohibited. When performing reproduction verification, the target log unit is located according to the report fingerprint, and all connection check fields from the initial unit to the target unit are checked level by level to ensure the integrity and integrity of the chain structure. After the check is passed, the strategy inline rewrite rule summary and the minimum proof information are extracted, and the summary of the original sanitized result is recalculated based on the alternative query template and the structured mode template to generate a verification fingerprint. Finally, the verification fingerprint is compared with the report fingerprint, and if they are completely identical, it is determined that the reproduction is valid.

[0109] Through the above technical scheme, the present application realizes the tamper-proofing and traceability of the audit log, and ensures the data integrity through the chain structure and multiple replica solidification. The reproduction verification process verifies the consistency of the report generation logic without exposing the original data through the minimum playback mechanism, solving the problem of incomplete audit evidence chain and low verification credibility in cross-source scenarios. The scheme further strengthens the transparency of the entire data processing cycle and provides verifiable technical support for compliance review.

[0110] In the above embodiments, the capability profile is consistently bound with the capability version identification, the inline-overwrite rule and the overwrite summary fingerprint, and the minimum permission access token before execution, and is compared item by item according to the time range, data range and operator range of the token in the controlled execution environment, and the query that does not meet the data minimization principle is automatically degraded to an alternative query that only returns statistical information and outputs minimization proof information, and the original result is de-identified, filtered and aggregated according to the privacy and compliance shaping rules, only allowing reading from the buffer of the purified result under the constraint of the structured mode template to generate a report and calculate a report fingerprint, and finally writing the result into a chain audit log and supporting report reproduction verification based on the log, realizing pre-verified control and minimum access of cross-source access, reducing the risk of unauthorized access and leakage, avoiding policy bypass and permission drift, and eliminating secondary leakage on the report side, and reducing the running period overhead and detailed data movement by compiling phase forced rewriting and read-only purification channel, and improving the compliance pass rate, audit efficiency and report credibility in the heterogeneous database and agent cooperation scene.

[0111] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application and not to limit it, although the present application has been described in detail with reference to the above embodiments, those skilled in the art should understand that: the specific embodiments of the present application can still be modified or replaced by the equivalent, without departing from the spirit and scope of the present application, any modification or equivalent replacement should be covered within the protection scope of the claims of the present application.

Claims

1. A method for secure access to and report generation of heterogeneous databases based on MCP and intelligent agents, characterized in that, include: Receive task requests and obtain task context, synchronize capability declarations from multiple database adapters according to MCP, perform normalization processing to generate capability graphs and determine capability version identifiers; Semantically map the organization's access policy, data hierarchical constraints, and the capability graph to obtain policy-inline rewriting rules and rewrite summary fingerprints. A minimum access token is issued based on the task context, the rewrite digest fingerprint, and the capability version identifier. The minimum access token includes a time range, a data range, and an operator range. The minimum access token is bound to the tool server identifier. The cross-source query is generated based on the intelligent agent and is forcibly rewritten according to the inline rewriting rules of the strategy during the compilation stage. When it is determined that the data minimization principle is not met or the rewriting fails, the cross-source query is converted into an alternative query that only returns statistical information and generates minimization proof information. In a controlled execution environment, verify the consistency of the least privilege access token, the rewrite digest fingerprint, and the capability version identifier. If they are consistent, grant restricted access to the heterogeneous database and obtain the original results. The original results are processed according to privacy and compliance shaping rules to obtain cleaned results. Reports are generated only by reading from the buffer of the cleaned results under the constraints of the structured pattern template, and the report fingerprint is calculated at the same time. The task request, capability version identifier, policy inline rewrite rule, least privilege access token, rewrite digest fingerprint, minimal proof information, and report fingerprint are written into a chained audit log. The audit log is then fixed, and the report reproduction is verified based on the audit log.

2. The method for secure access to and report generation of heterogeneous databases based on MCP and intelligent agents according to claim 1, characterized in that, When receiving a task request and obtaining the task context, synchronizing capability claims from multiple database adapters based on the MCP, performing normalization processing to generate a capability map, and determining the capability version identifier, the process includes: Verify the identity of the database adapter and establish a controlled communication channel; The capability declarations are received according to the unified glossary and structured parsing is performed to extract data source identifiers, resource scopes, field lists, available operations, parameter restrictions, data classifications, and geographic boundaries. Duplicate or conflicting entries are resolved according to a preset priority to form a consistent result; Based on sensitivity labeling of fields and operations, establish data source nodes, resource nodes, field nodes, operation nodes and constraint relationships in the capability graph; A complete snapshot of the generated capability map is taken and a summary check value is calculated. The effective time and the source list are combined to determine a unique capability version identifier.

3. The method for secure access to and report generation of heterogeneous databases based on MCP and intelligent agents according to claim 2, characterized in that, When semantically mapping organizational access policies, data hierarchical constraints, and the capability graph to obtain policy-inline rewriting rules and rewrite summary fingerprints, the process includes: Establish a unified mapping relationship between terminology and fields, and classify policy items according to column set, row filtering, operation category, geographical boundary and data quota; Based on sensitivity annotations, mandatory aggregations, bucket intervals, minimum sample thresholds, and time windows are generated and aligned with the resource range and available operations in the capability map to form a rewrite rule chain. The structured query statements to be executed are syntactically normalized and their order merged. Forced rewriting is completed during the compilation stage according to the rewriting rule chain to obtain the rewritten product. Based on the rewritten product and the capability version identifier, a unique rewritten digest fingerprint is generated using an irreversible digest algorithm; when rule conflicts cannot satisfy the data minimization principle, an alternative query template containing only counts and distributions is output and minimization proof information is generated.

4. The method for secure access to and report generation of heterogeneous databases based on MCP and intelligent agents according to claim 3, characterized in that, When issuing a least privilege access token based on the task context, the rewritten digest fingerprint, and the capability version identifier, the following is included: Analyze the task's time requirements, data usage scope, and operational requirements to determine the time range, data range, and operator range; Based on the rewritten digest fingerprint extraction column set, row filtering and aggregation requirements, and write them into the token restriction field; write the capability version identifier into the token consistency field; generate a digest verification value; Issue a token to the tool server and bind it to the tool server's identifier; The failure conditions are set, including expiration failure, quota exhaustion failure, and revocation failure, and the token restriction field, token consistency field, and digest verification value are saved in the issuance registration.

5. The method for secure access and report generation of heterogeneous databases based on MCP and intelligent agents according to claim 4, characterized in that, Before each execution, the least privilege access token is checked for consistency with the token digest verification value, the token consistency field, the rewritten digest fingerprint, and the capability version identifier. Only if they are consistent can the execution continue. During execution, the time range, data range, and operator range are compared and cumulatively counted item by item. When any limit is exceeded or the quota is exhausted, the access is terminated and the reason for the downgrade is recorded. If the minimization principle cannot be met, execution is rejected and the verification record and quota consumption record are written to the audit log.

6. The method for secure access to and report generation of heterogeneous databases based on MCP and intelligent agents according to claim 5, characterized in that, When forced rewriting is performed during the compilation phase according to the inline rewriting rules of the aforementioned strategy, it includes: The cross-source query is subjected to syntax normalization and dependency parsing to determine the column set, row filtering, join relationship, and operation sequence. Using the inline rewrite rules of the strategy as a sequential rule chain, column-level filtering, row-level filtering, sensitive field masking, mandatory aggregation, bucketing grouping, sampling upper limit, and time window are inserted in sequence. Cross-source joins are restricted, and joins exceeding the allowed limits are replaced with aggregation results. High-risk operations are replaced, and the replaced operations and reasons are recorded in the rewrite record. If the rewritten query still contains resources or operations inconsistent with the capability version identifier, it is prohibited from entering the execution phase.

7. The method for secure access and report generation of heterogeneous databases based on MCP and intelligent agents according to claim 6, characterized in that, When a cross-source query is converted into an alternative query that only returns statistical information and minimum proof information is generated when it is determined that the query does not comply with the data minimization principle or the rewrite fails, the following steps are taken: The system minimizes the number of columns, the proportion of sensitive fields, the row coverage, and the time span based on preset thresholds. If any of these indicators are not met, a downgrade is triggered. The original query is converted into an alternative query template that only contains counts, distributions, or the first few items, and the grouping criteria and time window are fixed. Generate the minimal proof information, which includes a list of removed fields, a list of restricted operations, trigger threshold entries, an identifier of the alternative query template used, and a reason for downgrading. The minimized proof information and the rewritten digest fingerprint are registered before entering the execution phase.

8. The method for secure access and report generation of heterogeneous databases based on MCP and intelligent agents according to claim 7, characterized in that, Verifying the consistency of the least privilege access token, the rewrite digest fingerprint, and the capability version identifier in a controlled execution environment includes: Establish an isolated execution session and collect the tool server identifier, capability version identifier, least privilege access token, and rewrite digest fingerprint; The validity of the least privilege access token is checked, including the time range, revocation status, and quota consumption status. Consistency is compared, including whether the consistency field of the token is consistent with the capability version identifier, whether the normalized representation of the query to be executed is consistent with the rewritten digest fingerprint, and whether the tool server identifier bound to the token is consistent with the current tool server identifier. If they match, restricted access is enabled, and the tokens are compared and executed item by item according to their time range, data range, and operator range.

9. The method for secure access and report generation of heterogeneous databases based on MCP and intelligent agents according to claim 8, characterized in that, The process of processing the original results according to privacy and compliance shaping rules and generating a report under the constraints of a structured schema template includes: Establish an integer shaping rule set, which includes de-identification, column-level preservation, row-level filtering, regional boundaries, minimum sample threshold, bucketing and aggregation, statistical perturbation, sensitive word replacement, privacy budget deduction, and over-limit rejection conditions; The original results are shaped in a fixed order, including de-identification, compliance filtering, aggregation and binning, statistical perturbation and threshold testing, and results that do not meet the minimum sample threshold are pruned. Error labels and credibility descriptions are generated to obtain the cleaned-up results and record the privacy budget consumption. Write the purification results into a buffer within the execution session; The report generator performs field name, value range, unit caliber, and chart type validation on the read request under the constraints of the structured schema template. If the validation passes, the report is generated only from the buffer of the purification results. The generated report, the corresponding purification result summary, and the structured schema template are used to calculate an irreversible summary validation value as the report fingerprint.

10. The method for secure access and report generation of heterogeneous databases based on MCP and intelligent agents according to claim 9, characterized in that, When writing to the chained audit log and using it for reproduction verification, the following is included: To generate a log unit for each processing step, the task request digest, capability version identifier, policy inline rewrite rule digest, least privilege access token digest, rewrite digest fingerprint, minimal proof information, and report fingerprint are formatted and standardized. The irreversible digest verification value of the current log unit is calculated. The irreversible digest verification value of the previous log unit is sequentially concatenated with the current log unit's irreversible digest verification value to generate a connection verification field, which is then written to the chained audit log along with a trusted timestamp. The chained audit log employs an append-only, non-modifiable storage strategy and is persisted through multiple copies after writing. During reproduction verification, the target log unit is located based on the report fingerprint or the task request. The continuity of the connection verification field from the starting log unit to the target log unit is verified. If the verification passes, a minimal replay is performed based on the policy inline rewrite rule digest and the minimal proof information. Only the summary of the cleaned-up result is recalculated using the alternative query template and the structured pattern template to generate a verification fingerprint for comparison. If the verification fingerprint matches the report fingerprint, the reproduction is considered successful; otherwise, the reproduction result is rejected.

Images