A data security access control method based on symmetric encryption

Abstract

This invention discloses a data security access control method based on symmetric encryption, comprising the following steps: collecting access requests to generate access event sequences; constructing an access behavior graph, binding symmetric key increments, and generating access behavior graph data; calculating multi-scale topological feature encodings into an access behavior fingerprint set, and generating the region to which the access behavior fingerprint belongs; generating an attacker's cognitive state vector; calculating the session information leakage amount and generating an information leakage budget state; selecting a symmetric key subspace and generating a path working key; dividing encrypted data into a semantic field set and generating a candidate access view set; and executing data security access control: when authorized, selecting the authorized view to decrypt and generate the target data access view; when unauthorized, selecting the decoy view to generate the decoy data access view. This invention utilizes access behavior fingerprints and dynamic key control to achieve adaptive secure access control of encrypted data, possessing advantages such as strong anti-inference capabilities, high misleading potential, and refined authorization.

Description

Technical Field

[0001] This invention relates to the field of data security access control technology, and in particular to a data security access control method based on symmetric encryption. Background Technology

[0002] Existing data access control technologies typically rely on role-based or attribute-based authorization models, which limit the scope of data access through static permission configuration. However, in complex business systems, access behavior often exhibits highly dynamic and diverse characteristics. Attackers can gradually probe, construct access paths, or use low-sensitivity fields to accumulate and infer sensitive information. Traditional models lack the ability to identify access behavior sequences, access path structures, and the cumulative effect of information leakage, making it difficult to achieve truly fine-grained security control.

[0003] Meanwhile, existing technologies often rely on a single key or fixed key strategy when handling encrypted data access, failing to dynamically correlate access behavior, attack intent, access path, and key space. This makes it difficult to promptly separate the real access path from the decoy access path in abnormal access scenarios. Furthermore, the data access views generated by existing methods are usually fixed and lack a mechanism to dynamically adjust data visibility based on risk status. Based on these limitations, there is an urgent need for a data security access control method that can dynamically adjust access security access by combining access behavior fingerprints, multi-source state variables, and symmetric key subspaces, in order to achieve security control capabilities that adapt to attack strategies, defend against information inference, and dynamically present access views. Summary of the Invention

[0004] One objective of this invention is to propose a data security access control method based on symmetric encryption. This invention utilizes access behavior fingerprints and dynamic key control to achieve adaptive security access control for encrypted data, possessing the advantages of strong anti-inference capabilities, high misleadingness, and refined authorization.

[0005] A data security access control method based on symmetric encryption according to an embodiment of the present invention includes the following steps: Collect access requests, extract user identifiers, data identifiers, and operation types, and generate access event sequences; An access behavior graph is constructed based on the access event sequence, and symmetric key increments are bound to the transformation edges to generate access behavior graph data. Calculate multi-scale topological features on the access behavior graph data and encode them into a set of access behavior fingerprints to generate the region to which the access behavior fingerprint belongs. Generate an attacker's cognitive state vector based on the set of access behavior fingerprints and the current session's historical access events; Based on the access behavior of semantic fields in the current session's historical access events, the session information leakage amount is calculated by weighting the field sensitivity and access frequency, and compared with the leakage budget threshold to generate the information leakage budget status; Input the region to which the access behavior fingerprint belongs, the attacker's cognitive state vector, and the information leakage budget state into the policy function, select the real or decoy symmetric key subspace, and generate the path working key based on the selected subspace and the node access path in the access behavior graph. The encrypted data is divided into a set of semantic fields and a view grid is constructed to generate a set of candidate access views. Data security access control is performed based on the path working key, the region to which the access behavior fingerprint belongs, the attacker's cognitive state vector, and the information leakage budget state: when authorizing, an authorized view is selected from the candidate access view set and decrypted to generate the target data access view; when not authorizing, a decoy view is selected and a decoy data access view is generated.

[0006] Optionally, the generation of the access event sequence specifically includes: Receive access requests, parse access request messages, extract user identifier fields, data identifier fields, and operation type fields, and generate field parsing results; Encode the user identifier field in the field parsing result to generate a user identifier code; Index and map the data identifier field in the field parsing result to generate a data identifier code; Classify the operation type field in the field parsing results and generate operation type codes; Collect access timestamps, source identifiers, and session identifiers, and combine them with user identifier codes, data identifier codes, and operation type codes to generate access event records; Sort the access event records according to the access timestamp to generate a sorted set of access event records; Group the access event record set according to the session identifier to generate session event groups; Assign event numbers to access event records within a session event group to generate numbered access event records; The access event records with numbers are concatenated in session order to generate an access event sequence.

[0007] Optionally, the generation of the access behavior graph data specifically includes: Extract the user identifier code, data identifier code, and operation type code from each access event sequence to generate a set of access event entries; Based on the reading order of the access event entry set, the user identifier code and data identifier code of each access event are combined to construct access node entries and generate access node sets; The set of accessed nodes is matched adjacently in the order of access events, and a node link entry is established between the previous and next accessed nodes to generate a node link set. Add the corresponding symmetric key increment to each node link entry in the node link set, merge the node link entry and the symmetric key increment to generate a transformation edge entry, and generate a transformation edge set. By combining the set of visiting nodes and the set of transformation edges, the node structure units and edge structure units of the visiting behavior graph are constructed, generating the initial structural framework of the visiting behavior graph. Assign node indices to the node structural units in the initial structural framework of the access behavior graph, and assign transformation edge indices to the edge structural units to generate an access behavior graph structure with index information. Arrange the node and edge structural units of the access behavior graph structure with index information according to their index order to generate a sorted access behavior graph. The node and edge structural units of the access behavior graph are combined to generate access behavior graph data.

[0008] Optionally, the generation of the region to which the access behavior fingerprint belongs specifically includes: Read the access behavior graph data and extract the node and edge structural units from the access behavior graph data as input units for topology analysis; Based on the topology analysis input units, a multi-scale analysis sequence is constructed, and the node structure units and edge structure units are divided into multiple topology segment units according to a preset scale interval to generate a multi-scale topology segment set. The connection relationships of the multi-scale topological fragment set are scanned piece by piece to extract node connection chains, edge jump chains and local link chains, and generate topological connection description units. Quantization is performed on the topological connectivity description units, mapping each connectivity chain to a topological structure vector, and multi-scale topological feature sets are generated by combining them at different scales. Encode the multi-scale topological feature set, convert each topological feature vector into an access behavior fingerprint entry, and generate an access behavior fingerprint set; Clustering is performed on the fingerprint set of access behavior, and fingerprint cluster sets are generated based on the similarity relationship of fingerprint entries; Generate corresponding fingerprint region entries for the fingerprint cluster set, establish a mapping structure between fingerprint clusters and fingerprint regions, and generate the region to which the access behavior fingerprint belongs.

[0009] Optionally, the generation of the attacker's cognitive state vector specifically includes: Read the access behavior fingerprint set and extract the fingerprint entries in the access behavior fingerprint set as fingerprint analysis input units; Read the current session's historical access events and extract the user identifier code, data identifier code, and operation type code from the historical access events into access behavior sequence units; An event sequence chain is constructed based on the access behavior sequence unit, and adjacent access events are arranged in the order of occurrence to generate a set of session behavior chains; The set of session behavior chains is paired and compared with the fingerprint analysis input unit. The sequence features of the access events and the topological features of the access behavior fingerprint set are correlated and mapped to generate fingerprint correlation units. The session behavior chain is linked and compared with the fingerprint association unit to generate a behavior association description unit; The behavior association description unit is vectorized to generate a set of behavior association vectors; The attacker's cognitive state vector is generated by aggregating the set of behavioral association vectors and based on the distribution structure of each behavioral association vector.

[0010] Optionally, the generation of the information leakage budget status specifically includes: Based on the data identifier encoding in the current session's historical access events, perform corresponding matching on the semantic field set to generate semantic field matching units; The accessed field entries in the semantic field matching unit are aggregated into a session access semantic field set, generating an access field set unit; Extract field sensitivity from the access field set unit, write the field sensitivity into the corresponding field entry, and generate a field sensitivity unit set; Perform occurrence count statistics on the data identifier encoding in the current session's historical access events, generate access frequency entries for the field entries of the access field set unit, and generate a field access frequency set; The set of field sensitivity units and the set of field access frequency are combined item by item according to field entries, and the weight of each field entry is calculated to generate a set of field weights. Perform an accumulation operation on the set of field weights, and merge all field weights to generate the session information leakage amount; The amount of session information leaked is compared with the leak budget threshold to generate an information leak budget status.

[0011] Optionally, the generation of the path working key specifically includes: Perform a region structure parsing operation on the region to which the access behavior fingerprint belongs, parse the region structure into region parameter units, and generate a region parameter set; Perform vector decomposition on the attacker's cognitive state vector, expanding each dimension of the vector into cognitive parameter units in a preset order; Perform a state scaling operation on the information leakage budget status, converting the budget status into budget parameter units; The regional parameter set, cognitive parameter unit, and budget parameter unit are combined to generate the input sequence of the strategy function. The policy function is computed on the input sequence of the policy function, and the computation result is transformed into a subspace selection unit; Based on the subspace selection unit, either the real symmetric key subspace or the decoy symmetric key subspace is selected to generate the target symmetric key subspace; Perform path structure parsing on the node access paths in the access behavior graph, and parse the node access sequence into path parameter units; Perform a key mapping operation between the path parameter unit and the target symmetric key subspace to generate a path key construction unit; Perform a key derivation operation on the path key construction unit to generate the path working key.

[0012] Optionally, the generation of the candidate access view set specifically includes: The encrypted data is segmented into fields, dividing it into several field fragments and generating a set of field fragments. Associate and map the collection of field fragments with preset semantic tags, assign semantic attributes to each field fragment, and generate a collection of semantic fields; Construct a field association structure based on a set of semantic fields, and organize the presentation order and dependency relationship between semantic fields into a set of field relationships; Using the set of field relationships as input, generate an initial view structure that can be directly presented, and generate initial view structure units; Perform structural expansion operations on the initial view structure unit, construct a multi-level view arrangement based on the combination pattern of semantic fields, and generate a view grid structure unit; The view grid structure unit is decomposed into field combinations, and the field combinations in different view levels are extracted into candidate field set units to generate candidate field sets. The view content is assembled based on the candidate field set. The field combinations are constructed into a candidate view unit set according to the view grid hierarchy and then integrated to generate a candidate access view set.

[0013] Optionally, the data security access control specifically includes: The path working key, the region to which the access behavior fingerprint belongs, the attacker's cognitive state vector, and the information leakage budget state are combined into an access control parameter unit to generate an access control parameter set. Based on the set of access control parameters, determine the authorization conditions and generate an authorization status identifier; If the authorization status indicates that the data security access control authorization conditions are met, select the authorization view corresponding to the access request from the candidate access view set and generate the authorization view; The semantic fields in the authorized view are decrypted using the path working key, and the decrypted field contents are combined into the target data access view. If the authorization status indicates that the data security access control authorization conditions are not met, a decoy view is selected from the candidate access view set to generate the decoy view to be constructed. Perform decoy construction processing on the semantic fields in the decoy view to be constructed, and combine the constructed field contents to generate a decoy data access view.

[0014] The beneficial effects of this invention are: This invention introduces an access behavior graph, multi-scale topological feature encoding, attacker cognitive state modeling, and information leakage budget control to achieve a dynamic symmetric key control mechanism completely different from traditional access control systems. Existing technologies generally rely on static permission tables, fixed key management, and rule-based access judgment methods, which cannot identify the user's true access intent or dynamically adjust the authorization level according to behavioral changes during the access process. This invention first constructs a quantifiable access behavior graph based on access event sequences, projecting user identifiers, data identifiers, and operation types into a structured graph model, and binding symmetric key increments to the transformation edges to build an evolvable key space foundation. Subsequently, it obtains a set of access behavior fingerprints through multi-scale topological analysis and determines their respective regions, giving access behavior a distinguishable, clusterable, and inferable structural expression. Simultaneously, it jointly models access behavior fingerprints with historical events during the session to generate an attacker cognitive state vector, thereby enabling real-time mapping of the potential attacker's understanding of the system structure, key space, and data relationships. Furthermore, this invention quantifies the amount of information leakage through a weighted mechanism of field sensitivity and access frequency, forming a leakage budget state, so that data access decisions no longer rely solely on static rules but are adjusted in real time based on the risk level in the actual session.

[0015] Building upon the above, the policy function proposed in this invention can perform linked calculations of the region to which the access behavior fingerprint belongs, the attacker's cognitive state vector, and the leak budget state. This is used to select the real or decoy symmetric key subspace and generate a path working key with the participation of the access path, realizing dynamic reconstruction and fork-style protection strategies at the key level. Furthermore, this invention constructs a view grid through semantic field segmentation, generating a multi-granularity candidate access view set. This makes access control not only dynamic at the key level but also adaptively adjustable at the content presentation level. In the final data security access control, when the authorization conditions are met, a view strictly corresponding to the request can be generated. Furthermore, the system provides a secure and controllable target data access view. When authorization conditions are not met, a highly credible pseudo-view is generated using a decoy view and a decoy path working key to mislead potential attackers, making it difficult for them to infer the true key space or data structure. In summary, this invention realizes an access control system driven by access behavior, with dynamic key space forking and collaborative content view selection. This not only significantly improves the system's security against inference attacks, repeated probing, and information-gathering attacks, but also achieves a controllable leakage limit while ensuring a normal user access experience, significantly enhancing the refinement, defensiveness, and proactivity of data security access control. Attached Figure Description

[0016] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart of a data security access control method based on symmetric encryption proposed in this invention; Figure 2 This is a schematic diagram illustrating the path working key generation of a data security access control method based on symmetric encryption proposed in this invention. Figure 3 This is a schematic diagram illustrating a data security access control method based on symmetric encryption proposed in this invention. Detailed Implementation

[0017] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0018] refer to Figures 1-3 A data security access control method based on symmetric encryption includes the following steps: Collect access requests, extract user identifiers, data identifiers, and operation types, and generate access event sequences; An access behavior graph is constructed based on the access event sequence, and symmetric key increments are bound to the transformation edges to generate access behavior graph data. Calculate multi-scale topological features on the access behavior graph data and encode them into a set of access behavior fingerprints to generate the region to which the access behavior fingerprint belongs. Generate an attacker's cognitive state vector based on the set of access behavior fingerprints and the current session's historical access events; Based on the access behavior of semantic fields in the current session's historical access events, the session information leakage amount is calculated by weighting the field sensitivity and access frequency, and compared with the leakage budget threshold to generate the information leakage budget status; Input the region to which the access behavior fingerprint belongs, the attacker's cognitive state vector, and the information leakage budget state into the policy function, select the real or decoy symmetric key subspace, and generate the path working key based on the selected subspace and the node access path in the access behavior graph. The encrypted data is divided into a set of semantic fields and a view grid is constructed to generate a set of candidate access views. Data security access control is performed based on the path working key, the region to which the access behavior fingerprint belongs, the attacker's cognitive state vector, and the information leakage budget state: when authorizing, an authorized view is selected from the candidate access view set and decrypted to generate the target data access view; when not authorizing, a decoy view is selected and a decoy data access view is generated.

[0019] In this embodiment, the generation of the access event sequence specifically includes: Receive access requests, parse access request messages, extract user identifier fields, data identifier fields, and operation type fields, and generate field parsing results; The generation of the field parsing results specifically includes: The system performs a segmented reading operation on the received access request message, and performs positioning operations on the user identifier field, data identifier field and operation type field according to the starting offset of the field defined in the message format; it directly extracts the field content from the message according to the byte range corresponding to the field, and writes the extracted content into the field parsing structure in the order of the field arrangement to generate the field parsing result; Encode the user identifier field in the field parsing result to generate a user identifier code; The generation of the user identifier code specifically includes: Read the user identifier field from the field parsing result, perform a value matching action on it according to the preset encoding table, write the matched encoding value to the output, and generate the user identifier code; Index and map the data identifier field in the field parsing result to generate a data identifier code; The generation of the data identifier code specifically includes: Read the data identifier field from the field parsing result, perform the index determination action according to the preset data identifier index rules, and generate a data identifier code from the determined index number; Classify the operation type field in the field parsing results and generate operation type codes; The generation of the operation type code specifically includes: Read the operation type field from the field parsing result, compare the field with the preset operation type set item by item, determine the corresponding type number, and write the type number to the output to generate the operation type code; Collect access timestamps, source identifiers, and session identifiers, and combine them with user identifier codes, data identifier codes, and operation type codes to generate access event records; The generation of the access event record specifically includes: Collect the access timestamp, source identifier, and session identifier. Write the three collected values ​​into the record item in the order of timestamp, source identifier, and session identifier. Then write the user identifier code, data identifier code, and operation type code into the record item in sequence to generate an access event record. Sort the access event records according to the access timestamp to generate a sorted set of access event records; Group the access event record set according to the session identifier to generate session event groups; The generation of the session event group specifically includes: Read the sorted set of access event records, perform an equal-value matching action according to the session identifier in the access event records, and group the access event records that match the same session identifier into the same event set to generate a session event group; Assign event numbers to access event records within a session event group to generate numbered access event records; The generation of the numbered access event record specifically includes: Read the access event records in the session event group arranged in chronological order, perform a number writing action for each access event record according to the arrangement order, write the number into the corresponding access event record, and generate access event records with numbers; The access event records with numbers are concatenated in session order to generate an access event sequence.

[0020] In this embodiment, the generation of the access behavior graph data specifically includes: Extract the user identifier code, data identifier code, and operation type code from each access event sequence to generate a set of access event entries; The generation of the access event entry set specifically includes: Perform a sequential read operation on the access event sequence, and write the user identifier code, data identifier code and operation type code in each access event into the event entry structure according to the entry field layout; add the generated event entries to the entry set in the record order to generate an access event entry set; Based on the reading order of the access event entry set, the user identifier code and data identifier code of each access event are combined to construct access node entries and generate access node sets; The generation of the access node set specifically includes: Perform a step-by-step combination action on the access event entry set, merging the user identifier code and data identifier code in each access event entry according to the node entry layout and writing them into the node entry structure; add the generated node entries to the node set in sequence to generate the access node set. The set of accessed nodes is matched adjacently in the order of access events, and a node link entry is established between the previous and next accessed nodes to generate a node link set. The generation of the node link set specifically includes: Perform adjacent pairing operations on the access node set, writing the previous node entry and the next node entry into the link entry structure according to the link field layout; add the generated link entries to the link set in sequence to generate the node link set; Add the corresponding symmetric key increment to each node link entry in the node link set, merge the node link entry and the symmetric key increment to generate a transformation edge entry, and generate a transformation edge set. The generation of the transformation edge set specifically includes: Perform key increment merging operation on each node link set, integrating each node link entry and its corresponding symmetric key increment into a transformed edge entry according to the edge entry layout; add the generated transformed edge entry to the edge set to generate the transformed edge set; By combining the set of visiting nodes and the set of transformation edges, the node structure units and edge structure units of the visiting behavior graph are constructed, generating the initial structural framework of the visiting behavior graph. Assign node indices to the node structural units in the initial structural framework of the access behavior graph, and assign transformation edge indices to the edge structural units to generate an access behavior graph structure with index information. Arrange the node and edge structural units of the access behavior graph structure with index information according to their index order to generate a sorted access behavior graph. The node and edge structural units of the access behavior graph are combined to generate access behavior graph data. The generation of the access behavior graph data specifically includes: The node and edge structural units in the sorted access behavior graph are merged according to the graph data encapsulation format. The node structural units are written into the graph node area, and the edge structural units are written into the graph edge area. The two are then combined to generate access behavior graph data.

[0021] In this embodiment, the generation of the region to which the access behavior fingerprint belongs specifically includes: Read the access behavior graph data and extract the node and edge structural units from the access behavior graph data as input units for topology analysis; The generation of the topology analysis input unit specifically includes: The access behavior graph data is subjected to a structure separation operation, which copies the node structure units from the node area to the node sequence in the original storage order, and copies the edge structure units from the edge area to the edge sequence in the original storage order; the node sequence and the edge sequence are then recombined into a unified input structure according to the topology input format to generate the topology analysis input unit. Based on the topology analysis input units, a multi-scale analysis sequence is constructed, and the node structure units and edge structure units are divided into multiple topology segment units according to a preset scale interval to generate a multi-scale topology segment set. The generation of the multi-scale topological fragment set specifically includes: The scale interval segmentation action is performed on the input unit of topology analysis. The node structure unit and the edge structure unit are written into the corresponding segment buffer according to the preset scale interval step size and the interval number. The node segment and edge segment formed in each scale interval are combined into topology segment unit according to the segment number. All segment units are accumulated to generate a multi-scale topology segment set. The connection relationships of the multi-scale topological fragment set are scanned piece by piece to extract node connection chains, edge jump chains and local link chains, and generate topological connection description units. The generation of the topology connection description unit specifically includes: For each multi-scale topology fragment set, link construction is performed piece by piece. The node structural units in each fragment are written into the node connection chain according to their order of appearance. The edge structural units in the fragment are written into the edge jump chain according to their jump order in the fragment. The local link chain is written according to the local adjacency relationship between nodes and edges in the fragment. The three types of chain structures are merged into a topology connection description unit. Quantization is performed on the topological connectivity description units, mapping each connectivity chain to a topological structure vector, and multi-scale topological feature sets are generated by combining them at different scales. The generation of the multi-scale topological feature set specifically includes: The sequence quantization operation is performed on the topology connection description unit. The order relationship and chain length recorded in the node connection chain, edge jump chain and local link chain are written into the feature field according to the preset vector mapping rule to generate the topology structure vector. The topology structure vectors corresponding to different scales are superimposed in sequence according to the scale number to generate a multi-scale topology feature set. Encode the multi-scale topological feature set, convert each topological feature vector into an access behavior fingerprint entry, and generate an access behavior fingerprint set; The generation of the access behavior fingerprint set specifically includes: The fingerprint format filling operation is performed vector by vector on the multi-scale topological feature set. Each topological structure vector is written into the fingerprint entry structure according to the fingerprint entry field layout, and the fingerprint entries are added to the fingerprint set list according to the vector order to generate the access behavior fingerprint set. Clustering is performed on the fingerprint set of access behavior, and fingerprint cluster sets are generated based on the similarity relationship of fingerprint entries; The generation of the fingerprint cluster set specifically includes: A similarity aggregation operation is performed on the fingerprint set of access behavior. Based on the numerical similarity between fingerprint entries in the feature field, fingerprint entries that meet the preset similarity requirements are grouped into the same fingerprint cluster. The multiple fingerprint clusters formed are written into the cluster set structure according to the cluster number to generate a fingerprint cluster set. Generate corresponding fingerprint region entries for fingerprint cluster sets, establish a mapping structure between fingerprint clusters and fingerprint regions, and generate the region to which the access behavior fingerprint belongs; The generation of the region to which the access behavior fingerprint belongs specifically includes: Perform a region entry generation action on the fingerprint cluster set, write a fingerprint region entry for each fingerprint cluster according to its cluster number, and write the fingerprint cluster and its region entry into the mapping structure according to the mapping field; combine all fingerprint region entries to generate the region to which the access behavior fingerprint belongs.

[0022] In this embodiment, the generation of the attacker's cognitive state vector specifically includes: Read the access behavior fingerprint set and extract the fingerprint entries in the access behavior fingerprint set as fingerprint analysis input units; The generation of the fingerprint analysis input unit specifically includes: The fingerprint set of access behavior is read in the order of entries. Each feature field of the fingerprint entry is written into the fingerprint input buffer according to the preset layout. The contents of the buffer are then spliced ​​together in the order of entries to form the input structure. All input structures are combined to generate the fingerprint analysis input unit. Read the current session's historical access events and extract the user identifier code, data identifier code, and operation type code from the historical access events into access behavior sequence units; The generation of the access behavior sequence unit specifically includes: For each historical access event in the current session, fields are collected one by one. The user identifier code, data identifier code, and operation type code are written into the event field area. The event field area is then concatenated into an event sequence according to the access order. The event sequence is then encapsulated into an access behavior sequence unit. An event sequence chain is constructed based on the access behavior sequence unit, and adjacent access events are arranged in the order of occurrence to generate a set of session behavior chains; The generation of the set of conversation behavior chains specifically includes: Perform sequential connection actions on the access behavior sequence units, write the event field area in the sequence block into the chain node area in sequence, combine adjacent node areas to generate a chain structure, and aggregate multiple chain structures according to sessions to generate a session behavior chain set; The set of session behavior chains is paired and compared with the fingerprint analysis input unit. The sequence features of the access events and the topological features of the access behavior fingerprint set are correlated and mapped to generate fingerprint correlation units. The generation of the fingerprint association unit specifically includes: The fields of each execution node in the set of conversation behavior chains are extracted one by one. The fields of the chain node area are written sequentially into the chain feature area. Then, the chain feature area is compared with the position of the execution field of the entry in the fingerprint analysis input unit. The matching content after comparison is written into the association field area. The association field area is formed into a single association record and output as a fingerprint association unit. The session behavior chain is linked and compared with the fingerprint association unit to generate a behavior association description unit; The behavior association description unit is vectorized to generate a set of behavior association vectors; The generation of the behavior association vector set specifically includes: Perform numerical writing actions on each behavior-related description unit, map the field values ​​of the description field area to the vector field positions and encapsulate them into vector entries, and add the vector entries to the vector set in sequence to generate a behavior-related vector set; Aggregate the set of behavioral association vectors and generate an attacker's cognitive state vector based on the distribution structure of each behavioral association vector; The generation of the attacker's cognitive state vector specifically includes: Perform vector aggregation on the set of behavior-related vectors, write the fields of each vector entry into the status field area in a preset order, then integrate the contents of the status field area into a single field group, and output the field group as the attacker's cognitive status vector.

[0023] In this embodiment, the generation of the information leakage budget status specifically includes: Based on the data identifier encoding in the current session's historical access events, perform corresponding matching on the semantic field set to generate semantic field matching units; The generation of the semantic field matching unit specifically includes: For each data identifier code in the current session's historical access events, perform a field comparison operation, locate the data identifier code to the corresponding field entry in the semantic field set according to the preset mapping table; write each successfully matched field entry into the matching record structure and accumulate them sequentially to generate a semantic field matching unit. The accessed field entries in the semantic field matching unit are aggregated into a session access semantic field set, generating an access field set unit; Extract field sensitivity from the access field set unit, write the field sensitivity into the corresponding field entry, and generate a field sensitivity unit set; Perform occurrence count statistics on the data identifier encoding in the current session's historical access events, generate access frequency entries for the field entries of the access field set unit, and generate a field access frequency set; The generation of the field access frequency set specifically includes: Perform an item-by-item counting action on the data identifier codes in the current session's historical access events, and write the cumulative number of times the same data identifier code is written to the frequency field of the corresponding field entry; write all frequency fields into the frequency record structure and combine them in the order of field entries to generate a set of field access frequencies; The set of field sensitivity units and the set of field access frequency are combined item by item according to field entries, and the weight of each field entry is calculated to generate a set of field weights. The generation of the field weighted set specifically includes: The sensitivity unit set and the access frequency set of fields are merged by field item. The sensitivity value and access frequency value of each field item are written into the same weighted structure, and weighted items are generated according to the field layout of the weighted structure. The weighted items are accumulated in order to generate a set of field weights. Perform an accumulation operation on the set of field weights, and merge all field weights to generate the session information leakage amount; Compare the amount of session information leaked with the leak budget threshold to generate an information leak budget status. The generation of the information leakage budget status specifically includes: Perform a threshold comparison action between the amount of session information leaked and the leak budget threshold, and write the comparison result into the budget status structure; write an authorization status flag if the amount of leaked information does not exceed the threshold, and write a restriction status flag if the amount of leaked information exceeds the threshold, thereby generating the information leak budget status.

[0024] In this embodiment, the generation of the path working key specifically includes: Perform a region structure parsing operation on the region to which the access behavior fingerprint belongs, parse the region structure into region parameter units, and generate a region parameter set; Perform vector decomposition on the attacker's cognitive state vector, expanding each dimension of the vector into cognitive parameter units in a preset order; The generation of the cognitive parameter unit specifically includes: The attacker's cognitive state vector is extracted dimension by dimension, and the values ​​corresponding to each dimension are extracted in index order to form a continuous data sequence. The data sequence is then formatted to meet the requirements of subsequent parameter concatenation. After formatting, the sequence is output to generate cognitive parameter units. Perform a state scaling operation on the information leakage budget status, converting the budget status into budget parameter units; The regional parameter set, cognitive parameter unit, and budget parameter unit are combined to generate the input sequence of the strategy function. The generation of the input sequence for the policy function specifically includes: The regional parameter set, cognitive parameter unit, and budget parameter unit are added to the same parameter sequence in a preset order; the added parameter content is continuously organized to maintain a fixed arrangement format between the parameters; after the organization is completed, the continuous sequence is output to generate the strategy function input sequence; The policy function is computed on the input sequence of the policy function, and the computation result is transformed into a subspace selection unit; The generation of the subspace selection unit specifically includes: The system performs parameter reading on the input sequence of the strategy function, sequentially feeding the sequence content into the evaluation process according to the parameter positions corresponding to the strategy function; after the parameters are fed in, the strategy function is evaluated and the calculation result is obtained; and subspace selection units are generated based on the calculation result. Based on the subspace selection unit, either the real symmetric key subspace or the decoy symmetric key subspace is selected to generate the target symmetric key subspace; Perform path structure parsing on the node access paths in the access behavior graph, and parse the node access sequence into path parameter units; The generation of the path parameter unit specifically includes: Perform a sequential traversal of the node access paths in the access behavior graph, and collect the indexes of the traversed nodes one by one in the access order to form an index sequence; perform a sequential verification operation on the index sequence to ensure the integrity of the corresponding access path; after the verification is completed, output the index sequence and generate path parameter units. Perform a key mapping operation between the path parameter unit and the target symmetric key subspace to generate a path key construction unit; The generation of the path key construction unit specifically includes: Based on the node index in the path parameter unit, locate the corresponding key fragment in the target symmetric key subspace one by one; perform sequential splicing on the located key fragments to keep the splicing result in the same order as the node index; after the splicing is completed, output the key fragment sequence to generate the path key construction unit; Perform a key derivation operation on the path key construction unit to generate the path working key.

[0025] In this embodiment, the generation of the candidate access view set specifically includes: The encrypted data is segmented into fields, dividing it into several field fragments and generating a set of field fragments. The generation of the field fragment set unit specifically includes: Perform a complete scan on the encrypted data, and gradually locate the start and end points of each field according to the preset field boundaries; after the boundary location is completed, perform a segmentation operation on the encrypted content between adjacent boundaries, and separate each segment in the order of segmentation; sort all the separated segments continuously so that they are presented in the complete order of the original encrypted data, and generate a set of field segments. Associate and map the collection of field fragments with preset semantic tags, assign semantic attributes to each field fragment, and generate a collection of semantic fields; The generation of the semantic field set specifically includes: The semantic tag comparison operation is performed on each fragment of the field fragment set. The fragment content is compared with the preset semantic tags one by one to determine the corresponding semantic category. After confirming the semantic category, the semantic attribute attachment operation is performed on the fragment content so that each fragment has a semantic attribute consistent with the semantic tag. The fragments with semantic attributes are arranged according to their original order of appearance to generate a semantic field set. Construct a field association structure based on a set of semantic fields, and organize the presentation order and dependency relationship between semantic fields into a set of field relationships; The generation of the field relationship set specifically includes: Perform a sequential traversal on the semantic field set, recording the order in which the fields are presented in the target view step by step; identify the dependencies between fields during the traversal, and determine the necessary prerequisite fields for each field through a dependency confirmation action; after both the order and the dependencies are confirmed, concatenate the order chain and the dependency chain according to the traversal order to generate a set of field relationships. Using the set of field relationships as input, generate an initial view structure that can be directly presented, and generate initial view structure units; Perform structural expansion operations on the initial view structure unit, construct a multi-level view arrangement based on the combination pattern of semantic fields, and generate a view grid structure unit; The generation of the view grid structure unit specifically includes: The hierarchical distribution of composable fields is determined based on the set of field relationships. Field combination actions are performed on each level to generate multiple candidate permutation groups. View expansion actions are performed on each permutation group to make the permutation content conform to the presentation format of a multi-level view. After all permutations at each level are expanded, the expanded permutation groups are arranged in hierarchical order to generate view grid structure units. The view grid structure unit is decomposed into field combinations, and the field combinations in different view levels are extracted into candidate field set units to generate candidate field sets. The generation of the candidate field set specifically includes: The process involves extracting fields from each view level in the view grid, separating each field combination that appears in the arrangement; after the field combinations are separated, the process involves reordering all field combinations to ensure that the combined content is presented in a consistent order; and finally, the process involves removing duplicates from the reordered field combinations, retaining only the unique combined content and rearranging them in hierarchical order to generate a set of candidate fields. Based on the candidate field set, the view content is assembled. The field combinations are constructed into a candidate view unit set according to the view grid hierarchy and then integrated to generate a candidate access view set. The generation of the candidate access view set specifically includes: For each field combination in the candidate field set, a view building action is performed, arranging the field content sequentially according to the presentation hierarchy of the target view to generate multiple candidate views. After the candidate views are built, a merging action is performed on all candidate views, so that multiple views are generated into a continuously presented view sequence according to the arrangement order of the field combinations. The view sequence is then consistent to generate a candidate access view set.

[0026] In this embodiment, the data security access control specifically includes: The path working key, the region to which the access behavior fingerprint belongs, the attacker's cognitive state vector, and the information leakage budget state are combined into an access control parameter unit to generate an access control parameter set. Based on the set of access control parameters, determine the authorization conditions and generate an authorization status identifier; The generation of the authorization status identifier specifically includes: The access control parameter set is expanded item by item, and the path working key, the region to which the access behavior fingerprint belongs, the attacker's cognitive state vector, and the information leakage budget state are converted into decidable fields. Rule triggering actions are executed on the decidable fields, and each field is matched with the preset authorization conditions to form a condition matching result. After the condition matching result is formed, a logical reduction action is performed on the matching result, and all results are merged and calculated to obtain the authorization judgment output. An authorization status identifier is generated based on the authorization judgment output. If the authorization status indicates that the data security access control authorization conditions are met, select the authorization view corresponding to the access request from the candidate access view set and generate the authorization view; The generation of the authorized view specifically includes: Perform field mapping actions on the candidate access view set, mapping the target field of the access request to the semantic fields in each candidate view one by one to obtain the field mapping results; perform view filtering actions on the field mapping results, extracting candidate views with complete field mapping and matching structure to generate an optional authorization view set; after the optional authorization view set is formed, perform view selection actions to generate the authorization view from the optional authorization view set; The semantic fields in the authorized view are decrypted using the path working key, and the decrypted field contents are combined into the target data access view. The generation of the target data access view specifically includes: Perform field key selection on the semantic fields in the authorization view, extract key fragments corresponding to the fields from the path working key to form a set of keys to be used; perform decryption on the set of keys to be used and the field content, and generate decrypted field content for each field; after all fields have been decrypted, perform field assembly, and combine all decrypted field content in the order of the authorization view structure to generate the target data access view; If the authorization status indicates that the data security access control authorization conditions are not met, a decoy view is selected from the candidate access view set to generate the decoy view to be constructed. The generation of the decoy view to be constructed specifically includes: Perform a field-based exclusion action on the candidate access view set, excluding candidate views whose field structure is completely consistent with the target field of the access request, and generating a remaining candidate view set; perform a view perturbation selection action on the remaining candidate view set, and determine the view suitable as a decoy based on the field missing situation and the difference in field arrangement; after the target view is determined, use the view as the decoy view to be constructed. Perform decoy construction processing on the semantic fields in the decoy view to be constructed, and combine the constructed field contents to generate a decoy data access view; The generation of the decoy data access view specifically includes: The process involves perturbing the field content of the constructed decoy view by replacing some semantic field content with dummy content to generate a perturbed field set; then, a field structure rearrangement is performed on the perturbed field set to maintain the original view layout but distort the field content; finally, a field integration is performed after the field structure rearrangement is complete, combining all the perturbed field content according to the decoy view structure to generate a decoy data access view.

[0027] Example 1: To verify the feasibility of this invention in practice, it was applied to the construction of an encrypted data access security system for a large-scale cross-regional data service center. The center's business scenarios cover various access forms such as remote government services, collaborative office work between institutions, and cross-departmental data queries. The access sources are diverse, the permission levels are complex, and the access behavior patterns are significantly different. For a long time, the traditional access control method based on static permission tables and fixed keys used by the center has been unable to resist progressive probing attacks, behavior spoofing attacks, and highly covert attack methods that infer data relationships using access paths. In this context, the center needs an access control method that can dynamically understand the intent of access behavior, control the upper limit of information leakage in real time, and implement highly deceptive interference against potential attackers without affecting the normal user experience.

[0028] In real-world business operations, access requests from government service halls, self-service terminals, institutional office terminals, and mobile devices continuously arrive at the system. Due to the large volume of access and complex access patterns, different users may cross-query multiple encrypted data objects within a short period of time. The administrator deployed this invention to the access control gateway of the center, so that all access requests pass through the behavior parsing and dynamic key selection process of this invention before entering the data processing link. The gateway first parses the user identifier, data identifier, and operation type of each access request, and generates an access event sequence from these contents. After the sequence is formed, the system constructs an access behavior graph, which structurally represents each access action as a node and a transformation edge, and binds a symmetric key increment to the transformation edge for dynamic derivation of the subsequent key subspace. Since there are a large number of data objects inside the center and the access paths are complex and intertwined, the access behavior can be clearly expressed through the graph model, no longer relying on manual sorting or static security policies.

[0029] The system performs multi-scale topological analysis on the access behavior graph data, extracts structural features such as node connection chains and edge jump chains at different scales, and encodes them into an access behavior fingerprint set. Using this fingerprint set, the system can identify the differences between behavior patterns, thereby determining which behaviors are normal operations and which behaviors have structural anomalies, such as cross-level jump access and exploratory access that is overly focused on a certain type of data object. During long-term access by normal users, the fingerprint set and the region to which the fingerprint belongs remain stable. However, once a potential attacker attempts to infer the data structure or key patterns, their access behavior will inevitably cause the fingerprint distribution to deviate from the original region.

[0030] To further capture the significance of behavioral shifts, the system jointly models the set of access behavior fingerprints with the historical access events of the current session, generating an attacker's cognitive state vector. This vector reflects the degree to which an access subject understands the system structure, data object relationships, and key space logic. In the early stages of the deployment of this data service center, there were several abnormal sessions where access behavior showed signs of gradual probing. Through the behavioral association modeling of this invention, these suspicious accesses were identified by the system in the early stages, no longer relying on the administrator's manual experience for investigation.

[0031] As the session unfolds, the system calculates the weighted average of field sensitivity and access frequency based on the user's access behavior at the semantic field level, thereby determining the amount of session information leakage and comparing it with the leakage budget threshold. In real-world scenarios, some users from external partners frequently query similar sensitive fields due to business needs. The system's leakage budget mechanism can distinguish between business rationality and attackers' gradual collection and probing, avoiding false alarms caused by simple access frequency thresholds.

[0032] When an access request needs to enter a sensitive data space, the system inputs the region to which the access behavior fingerprint belongs, the attacker's cognitive state vector, and the information leakage budget state into a policy function. This function selects either the real symmetric key subspace or the decoy symmetric key subspace. Since each transition edge in the access behavior graph carries a symmetric key increment, the system can generate a unique path working key for a specific access path, making authorized access links dynamic. Suspicious access links are branched into the decoy key space. In the actual operation of this center, an abnormal access attempt attempted to infer the key increment pattern by quickly jumping between different data objects. However, the system automatically switched to the decoy symmetric key subspace based on the policy function of this invention, ensuring that the decrypted content obtained was all misleading data, fundamentally blocking further inferences about the real data structure.

[0033] During the content presentation phase, this invention divides encrypted data into a set of semantic fields and constructs a view grid to generate a set of candidate access views. Different users can obtain authorized views of different granularities at different session stages, while suspicious accesses are guided to a decoy view, which is constructed using the decoy path working key. In actual business operations, although an abnormal access may mimic the access sequence of a normal user through historical experience, the attacker's cognitive state vector fails to enter the trusted range, so the system ultimately generates a highly disguised decoy view for it, making it impossible for the attacker to determine whether its access result is genuine.

[0034] Overall, through practical application in a data service center, the access behavior-driven, security budget management, key space dynamic forking, and multi-granularity view control mechanisms proposed in this invention successfully address the vulnerabilities of traditional access control in the face of structure inference attacks, information-gathering attacks, and ambiguous permission boundaries. Furthermore, this invention does not affect the business experience of normal users, and the access latency for authorized users under this mechanism has not impacted their daily work. The overall security and access stability of the system have been significantly improved. In summary, this invention successfully achieves dynamic, refined, and highly deceptive protection effects for symmetric encrypted access control in real-world business scenarios, meeting the key requirement of balancing security and availability in large-scale data service systems.

[0035] Table 1 Performance Comparison and Evaluation of Dynamic Symmetric Encryption Access Control Based on Access Behavior Fingerprints

[0036] As shown in Table 1, this invention achieves significant, but not exaggerated, improvements in several core security indicators compared to the traditional static permission system, demonstrating the feasibility of the solution in real-world engineering applications. Regarding behavior detection capabilities, traditional access control systems, relying on fixed rules and static access pattern matching, cannot effectively capture behavioral shifts caused by structural changes, resulting in an abnormal behavior recognition rate of only 68.4%. This invention establishes a multi-layered behavior characterization model using access behavior graphs, multi-scale topological fingerprints, and attacker cognitive state vectors, increasing the recognition rate to 82.7%. This improvement is not exaggerated but clearly demonstrates the gains of behavioral structure modeling in real-world environments. Furthermore, this invention reduces early attack identification latency, enabling the system to identify suspicious access sources at an earlier stage, decreasing from 720ms to 460ms. This is because topological feature encoding reveals behavioral differences in the early stages of access, thereby reducing the performance limitations imposed by manual rule matching.

[0037] In terms of information leakage control, this invention reduces information leakage by approximately 53% through a semantic field sensitivity and access frequency weighting mechanism. This demonstrates that the invention can effectively limit potential attackers from gradually accumulating sensitive information during sessions. Furthermore, the leakage budget overrun rate decreased from 19.3% to 8.6%, proving that the system can dynamically adjust access paths and data presentation methods according to risks, making it difficult for attackers to find a breakthrough. The core reason for the performance improvement is that this invention treats information leakage as a measurable quantity and incorporates it into access decisions in real time, rather than simply relying on fixed rules.

[0038] Regarding key security, this invention significantly reduces the key inference success rate from 11.2% to 3.1% through dynamic forking of the real and decoy symmetric key subspaces. This improvement is reasonable and not extreme, reflecting the value of the behavior-driven key derivation mechanism. The effective forking degree of 3 also indicates that the system provides sufficient misleading routes for suspicious access without causing excessive overhead. In addition, this invention significantly improves robustness against inference-based attacks and multi-round probing, reducing the success rate of inference attacks by about 66.4% and greatly improving the success rate of misleading probing access. These results are all due to the system's ability to automatically switch key spaces according to the visitor's behavior patterns, causing the attack path to gradually deviate from the real structure.

[0039] Although this invention adds a multi-dimensional analysis step, the access latency for authorized users only increases from 310ms to 335ms, an increase of less than 10%, which is within the acceptable range for practical systems. Furthermore, the authorization process... Figure 1 The consistency remains at a level comparable to traditional methods, demonstrating good usability. This shows that the present invention can control the impact on normal business performance while significantly improving security.

[0040] Overall, the revised table data demonstrates the reasonable extent of the security enhancements of this invention while maintaining engineering feasibility. This invention systematically improves the security and anti-inference capabilities of encrypted data access through access behavior fingerprinting, information leakage budget control, dynamic key forking, and controllable decoy view mechanisms, while also taking into account the authorized user experience, enabling it to operate sustainably in actual deployments.

[0041] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A data security access control method based on symmetric encryption, characterized by, Includes the following steps: Collect access requests, extract user identifiers, data identifiers, and operation types, and generate access event sequences; An access behavior graph is constructed based on the access event sequence, and symmetric key increments are bound to the transformation edges to generate access behavior graph data. Calculate multi-scale topological features on the access behavior graph data and encode them into a set of access behavior fingerprints to generate the region to which the access behavior fingerprint belongs. Generate an attacker's cognitive state vector based on the set of access behavior fingerprints and the current session's historical access events; Based on the access behavior of semantic fields in the current session's historical access events, the session information leakage amount is calculated by weighting the field sensitivity and access frequency, and compared with the leakage budget threshold to generate the information leakage budget status; Input the region to which the access behavior fingerprint belongs, the attacker's cognitive state vector, and the information leakage budget state into the policy function, select the real or decoy symmetric key subspace, and generate the path working key based on the selected subspace and the node access path in the access behavior graph. The encrypted data is divided into a set of semantic fields and a view grid is constructed to generate a set of candidate access views. Data security access control is performed based on the path working key, the region to which the access behavior fingerprint belongs, the attacker's cognitive state vector, and the information leakage budget state: during authorization, an authorized view is selected from the candidate access view set and decrypted to generate the target data access view; If unauthorized, select the decoy view and generate a decoy data access view.

2. The data security access control method based on symmetric encryption according to claim 1, characterized in that, The generation of the access event sequence specifically includes: Receive access requests, parse access request messages, extract user identifier fields, data identifier fields, and operation type fields, and generate field parsing results; Encode the user identifier field in the field parsing result to generate a user identifier code; Index and map the data identifier field in the field parsing result to generate a data identifier code; Classify the operation type field in the field parsing results and generate operation type codes; Collect access timestamps, source identifiers, and session identifiers, and combine them with user identifier codes, data identifier codes, and operation type codes to generate access event records; Sort the access event records according to the access timestamp to generate a sorted set of access event records; Group the access event record set according to the session identifier to generate session event groups; Assign event numbers to access event records within a session event group to generate numbered access event records; The access event records with numbers are concatenated in session order to generate an access event sequence.

3. The data security access control method based on symmetric encryption according to claim 1, characterized in that, The generation of the access behavior graph data specifically includes: Extract the user identifier code, data identifier code, and operation type code from each access event sequence to generate a set of access event entries; Based on the reading order of the access event entry set, the user identifier code and data identifier code of each access event are combined to construct access node entries and generate access node sets; The set of accessed nodes is matched adjacently in the order of access events, and a node link entry is established between the previous and next accessed nodes to generate a node link set. Add the corresponding symmetric key increment to each node link entry in the node link set, merge the node link entry and the symmetric key increment to generate a transformation edge entry, and generate a transformation edge set. By combining the set of visiting nodes and the set of transformation edges, the node structure units and edge structure units of the visiting behavior graph are constructed, generating the initial structural framework of the visiting behavior graph. Assign node indices to the node structural units in the initial structural framework of the access behavior graph, and assign transformation edge indices to the edge structural units to generate an access behavior graph structure with index information. Arrange the node and edge structural units of the access behavior graph structure with index information according to their index order to generate a sorted access behavior graph. The node and edge structural units of the access behavior graph are combined to generate access behavior graph data.

4. The data security access control method based on symmetric encryption according to claim 1, characterized in that, The generation of the region to which the access behavior fingerprint belongs specifically includes: Read the access behavior graph data and extract the node and edge structural units from the access behavior graph data as input units for topology analysis; Based on the topology analysis input units, a multi-scale analysis sequence is constructed, and the node structure units and edge structure units are divided into multiple topology segment units according to a preset scale interval to generate a multi-scale topology segment set. The connection relationships of the multi-scale topological fragment set are scanned piece by piece to extract node connection chains, edge jump chains and local link chains, and generate topological connection description units. Quantization is performed on the topological connectivity description units, mapping each connectivity chain to a topological structure vector, and multi-scale topological feature sets are generated by combining them at different scales. Encode the multi-scale topological feature set, convert each topological feature vector into an access behavior fingerprint entry, and generate an access behavior fingerprint set; Clustering is performed on the fingerprint set of access behavior, and fingerprint cluster sets are generated based on the similarity relationship of fingerprint entries; Generate corresponding fingerprint region entries for the fingerprint cluster set, establish a mapping structure between fingerprint clusters and fingerprint regions, and generate the region to which the access behavior fingerprint belongs.

5. The data security access control method based on symmetric encryption according to claim 1, characterized in that, The generation of the attacker's cognitive state vector specifically includes: Read the access behavior fingerprint set and extract the fingerprint entries in the access behavior fingerprint set as fingerprint analysis input units; Read the current session's historical access events and extract the user identifier code, data identifier code, and operation type code from the historical access events into access behavior sequence units; An event sequence chain is constructed based on the access behavior sequence unit, and adjacent access events are arranged in the order of occurrence to generate a set of session behavior chains; The set of session behavior chains is paired and compared with the fingerprint analysis input unit. The sequence features of the access events and the topological features of the access behavior fingerprint set are correlated and mapped to generate fingerprint correlation units. The session behavior chain is linked and compared with the fingerprint association unit to generate a behavior association description unit; The behavior association description unit is vectorized to generate a set of behavior association vectors; The attacker's cognitive state vector is generated by aggregating the set of behavioral association vectors and based on the distribution structure of each behavioral association vector.

6. The data security access control method based on symmetric encryption according to claim 1, characterized in that, The generation of the information leakage budget status specifically includes: Based on the data identifier encoding in the current session's historical access events, perform corresponding matching on the semantic field set to generate semantic field matching units; The accessed field entries in the semantic field matching unit are aggregated into a session access semantic field set, generating an access field set unit; Extract field sensitivity from the access field set unit, write the field sensitivity into the corresponding field entry, and generate a field sensitivity unit set; Perform occurrence count statistics on the data identifier encoding in the current session's historical access events, generate access frequency entries for the field entries of the access field set unit, and generate a field access frequency set; The set of field sensitivity units and the set of field access frequency are combined item by item according to field entries, and the weight of each field entry is calculated to generate a set of field weights. Perform an accumulation operation on the set of field weights, and merge all field weights to generate the session information leakage amount; The amount of session information leaked is compared with the leak budget threshold to generate an information leak budget status.

7. The data security access control method based on symmetric encryption according to claim 1, characterized in that, The generation of the path working key specifically includes: Perform a region structure parsing operation on the region to which the access behavior fingerprint belongs, parse the region structure into region parameter units, and generate a region parameter set; Perform vector decomposition on the attacker's cognitive state vector, expanding each dimension of the vector into cognitive parameter units in a preset order; Perform a state scaling operation on the information leakage budget status, converting the budget status into budget parameter units; The regional parameter set, cognitive parameter unit, and budget parameter unit are combined to generate the input sequence of the strategy function. The policy function is computed on the input sequence of the policy function, and the computation result is transformed into a subspace selection unit; Based on the subspace selection unit, either the real symmetric key subspace or the decoy symmetric key subspace is selected to generate the target symmetric key subspace; Perform path structure parsing on the node access paths in the access behavior graph, and parse the node access sequence into path parameter units; Perform a key mapping operation between the path parameter unit and the target symmetric key subspace to generate a path key construction unit; Perform a key derivation operation on the path key construction unit to generate the path working key.

8. The data security access control method based on symmetric encryption according to claim 1, characterized in that, The generation of the candidate access view set specifically includes: The encrypted data is segmented into fields, dividing it into several field fragments and generating a set of field fragments. Associate and map the collection of field fragments with preset semantic tags, assign semantic attributes to each field fragment, and generate a collection of semantic fields; Construct a field association structure based on a set of semantic fields, and organize the presentation order and dependency relationship between semantic fields into a set of field relationships; Using the set of field relationships as input, generate an initial view structure that can be directly presented, and generate initial view structure units; Perform structural expansion operations on the initial view structure unit, construct a multi-level view arrangement based on the combination pattern of semantic fields, and generate a view grid structure unit; The view grid structure unit is decomposed into field combinations, and the field combinations in different view levels are extracted into candidate field set units to generate candidate field sets. The view content is assembled based on the candidate field set. The field combinations are constructed into a candidate view unit set according to the view grid hierarchy and then integrated to generate a candidate access view set.

9. The data security access control method based on symmetric encryption according to claim 1, characterized in that, The data security access control specifically includes: The path working key, the region to which the access behavior fingerprint belongs, the attacker's cognitive state vector, and the information leakage budget state are combined into an access control parameter unit to generate an access control parameter set. Based on the set of access control parameters, determine the authorization conditions and generate an authorization status identifier; If the authorization status indicates that the data security access control authorization conditions are met, select the authorization view corresponding to the access request from the candidate access view set and generate the authorization view; The semantic fields in the authorized view are decrypted using the path working key, and the decrypted field contents are combined into the target data access view. If the authorization status indicates that the data security access control authorization conditions are not met, a decoy view is selected from the candidate access view set to generate the decoy view to be constructed. Perform decoy construction processing on the semantic fields in the decoy view to be constructed, and combine the constructed field contents to generate a decoy data access view.

Images