Distributed network architecture and method for realizing ABAC attribute mining based on edge computing under the architecture

Abstract

The application belongs to the technical field of network data processing, and particularly relates to a distributed network architecture and a method for realizing ABAC attribute mining based on edge computing under the architecture, wherein devices in the network are divided into three layers of terminal devices, edge nodes and network centers according to functions, attribute mining and storage tasks in the three-layer distributed network are downgraded to the edge nodes close to the data side, the network center provides attribute query services, and an attribute mining model is directly deployed on the edge nodes, so that automatic attribute mining on massive data in a distributed environment is realized, computing and storage resources and the like of the devices in the network are fully utilized, network burdens caused by massive data transmission can be avoided, the speed of processing data and the response efficiency of the system are improved, and the application can be well applied to attribute-based access control system scenarios. The application can meet the demand of attribute mining of massive entity access control in an ABAC system under an open and distributed big data environment, and improve network data security.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of network data processing, and particularly relates to a distributed network architecture and a method for realizing ABAC attribute mining based on edge computing under the architecture. BACKGROUND

[0002] The era of big data has arrived, and a series of new computing technologies such as cloud computing, Internet of Things, edge computing and artificial intelligence are emerging. Massive, diverse, heterogeneous and unstructured data are the main characteristics of data generation. According to the prediction of the consulting agency IDC, the global data volume will increase from 33 ZB in 2018 to 175 ZB in 2025, of which the main growth source is unstructured data such as text, pictures and videos generated by edge devices and Internet of Things sensors. With the exponential increase in data volume, mining the potential value in the data has far-reaching social and economic benefits, but in the process of collecting, storing, processing and circulating the massive data, there are many risks such as data leakage and data misuse. According to IDC statistics and forecasts, the data that needs to be protected globally will increase from 56% in 2018 to 66% in 2025, accounting for two-thirds of the global data volume. Access control technology, as one of the key technologies for data security protection, ensures that only legitimate users can perform legitimate operations to obtain access to data resources according to the pre-set access control policy. After the development of BLP and Biba models, discretionary access control (DAC), mandatory access control (MAC) and role-based access control (RBAC), the current attribute-based access control (ABAC) is the main research direction of access control technology. ABAC allows access control based on the inherent attributes of user subjects and resource objects, and has the characteristics of dynamic flexibility, strong scalability, fine granularity and automatic decision-making, which is an ideal solution to meet the security protection needs of complex systems with a large number of users and massive data in the big data environment. Attributes are the core concept of ABAC. In the access control system of the big data environment, it is necessary to accurately determine whether the user can perform a specific operation on the resource, and the accurate and complete description of the attribute set of massive subjects and objects is the basis. The current research of ABAC is still in its infancy, and most of the difficulties encountered in the research are due to the characteristics of massive, distributed and dynamic open data in the big data environment.

[0003] Deep learning technology is the main development direction of artificial intelligence at present. With the continuous development of deep neural network model, large data set and high-performance hardware, it has become the preferred solution for processing complex big data and the main method for attribute mining of massive data access control. However, due to the large size of deep neural network model, the requirement for storage resources and computing resources is high when performing computing tasks. There are two solutions to solve the problem of applying deep neural network to process data in a distributed environment: 1. Moving data: design a high-performance hardware computing center, transfer massive data to the large deep neural network in the computing center for data mining calculation. 2. Moving calculation: deploy deep learning network model directly on terminal device or near terminal, perform calculation task in the place where data is generated and stored. The scheme of moving data needs to build a high-performance computing center at a very high cost, and faces problems such as high communication overhead, delay and data privacy. The scheme of moving calculation has certain performance requirements for the computing and storage of terminal hardware devices. When selecting deep neural network for migration computing task, the terminal devices generally have low performance, which cannot meet the demand in running space and computing performance. SUMMARY

[0004] Therefore, the application provides a distributed network architecture and an ABAC attribute mining method based on edge computing under the architecture, which can meet the demand of ABAC attribute mining of massive entities in an open and distributed big data environment, and improve network data security.

[0005] According to the design scheme provided by the application, a distributed network architecture is provided, which includes: a bottom layer for generating access control object resource data, an intermediate layer for computing and storing, and a network center for providing query service for calling by upper layer application. The intermediate layer is composed of edge nodes adjacent to the terminal devices of the bottom layer, and each edge node completes the functions of access control attribute mining and data storage, and the edge node stores and transmits attribute data in the form of mapping relationship between object resource identifier and corresponding attribute set; the network center provides query service in the form of cloud computing, and uses a unified interface for calling by upper layer application of access control system.

[0006] As the distributed network architecture in the application, further, each edge node of the intermediate layer is divided into a computing node for access control attribute mining and a storage node for data storage, and the storage node stores the mapping relationship between the access control object resource identifier and the corresponding attribute set mined by the computing node, for attribute query and calling service of the network center.

[0007] As the distributed network architecture in the application, further, the same device of the intermediate layer is a computing node and / or a storage node.

[0008] Furthermore, the present invention also provides a method for realizing ABAC attribute mining based on edge computing under a distributed network architecture. An attribute mining model is deployed on the edge nodes of the aforementioned distributed network architecture, and the attribute mining model is used to obtain the access control attributes of each entity in the attribute access control system to achieve secure access control of network data. The attribute mining model adopts a neural network model that has been trained and optimized using dataset samples.

[0009] As a method for ABAC attribute mining based on edge computing under a distributed network architecture, the neural network model in the edge node is further trained and optimized by knowledge distillation. The deep neural network is used as the teacher model and the shallow neural network is used as the student model. Through iterative training of the teacher model and the student model, the student model learns the attribute mining ability of the teacher model.

[0010] As a method for ABAC attribute mining based on edge computing under a distributed network architecture, the dataset samples are further divided into Sample 1 and Sample 2, with Sample 1 being larger than Sample 2. In the training and optimization of the neural network model, Sample 1 is used to pre-train the teacher model, and the probability distribution of the teacher model's prediction of the samples is set as a soft label, while the true results of the samples are set as hard labels. Sample 2 is used to train and optimize both the teacher model and the student model simultaneously, so that the output of the student model tends to the soft label, and the predicted probability distribution of the student model samples is constrained by the hard label.

[0011] As a method for ABAC attribute mining based on edge computing under a distributed network architecture, this invention further involves adding a temperature T parameter to the softmax function during neural network model training and optimization to obtain the softmax-T function, expressed as: in, 'o' represents the probability distribution output, and 'o' represents the input of the function. The softmax-T function is used to make the model output smoother and the output probability distribution conforms to the preset information conditions, where conforming to the preset information conditions means satisfying the preset amount of information carried.

[0012] As a method for ABAC attribute mining based on edge computing under a distributed network architecture, this invention further utilizes the softmax-T function to smooth the model output. Specifically, for the teacher model output, the softmax-T function is used to obtain soft labels s containing hidden knowledge from the teacher model. i In the student model, the soft prediction sp, which characterizes the predictive ability of the student model, is obtained using both the softmax-T function and the ordinary softmax function. i and hard prediction hp iThe actual sample labels are used as hard labels h in one-hot encoding. i .

[0013] As a method for ABAC attribute mining based on edge computing under a distributed network architecture, the objective loss function for training optimization is further expressed as: Loss total =KL(s) i ,sp i )×λ×T 2 +CE(h i ,hp i )×(1-λ), where T represents the temperature parameter and λ represents the harmonic parameter between relative entropy KL and cross entropy.

[0014] The beneficial effects of this invention are:

[0015] This invention divides network devices into three layers based on their functions: terminal devices, edge nodes, and network center. In this three-layer distributed network architecture, attribute mining and storage tasks are devolved to edge nodes closer to the data. The network center provides attribute query services and uses attribute mining models directly deployed on edge nodes. This enables automated attribute mining of massive amounts of data in a distributed environment, making full use of the computing and storage resources of network devices. It avoids the network burden caused by large amounts of data transmission, improves the speed and response efficiency of system data processing, and is well-suited for application scenarios of attribute-based access control systems. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the distributed network architecture based on edge computing in the embodiment;

[0017] Figure 2 This is a schematic diagram illustrating the training and optimization of the attribute mining model in the embodiment. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer and more understandable, the invention will be further described in detail below with reference to the accompanying drawings and technical solutions.

[0019] To address the challenge of attribute mining on massive distributed data, this invention provides a distributed network architecture comprising: a bottom layer for generating access control object resource data, an intermediate layer for computation and storage, and a network center for providing query services for upper-layer applications. The intermediate layer consists of edge nodes adjacent to the bottom-layer terminal devices, each edge node performing access control attribute mining and data storage functions. The edge nodes store and transmit attribute data using a mapping relationship between object resource identifiers and corresponding attribute sets. The network center provides query services in the form of cloud computing and utilizes a unified interface for upper-layer applications of the access control system to call.

[0020] The core concept of edge computing is to move computing and services closer to the terminal devices and the side where data is generated, in order to solve the problem of excessive communication consumption when computing distributed data. In this embodiment, based on the need for mining massive entity access control attributes in an ABAC system under an open and distributed big data environment, the core idea of ​​edge computing—mobile computing—is used to establish edge nodes near the location where the computing data is generated. Storage and computing tasks are then offloaded to the terminal side that generates and consumes the data. This fully utilizes the computing and storage resources of devices in the network, avoids the network burden caused by large-scale data transmission, and improves the system's data processing speed and response efficiency.

[0021] See Figure 1 As shown, the bottom layer consists of numerous IoT sensors and terminal devices, whose data constitutes the primary resource object in the access control system. The middle layer comprises edge nodes, physically located close to the terminals, possessing certain computing and storage capabilities. These are divided into storage nodes and computing nodes based on their functions. Computing nodes deploy neural network models for access control attribute mining, while storage nodes store both the data and the mined attribute data (the same device can function as both a storage node and a computing node). The network's core provides attribute query services via cloud computing, offering a unified interface for upper-layer applications within the access control system to access.

[0022] Furthermore, in the distributed network architecture of this embodiment, each edge node of the middle layer is functionally divided into computing nodes for access control attribute mining and storage nodes for data storage. The storage nodes store the mapping relationship between the access control object resource identifiers mined by the computing nodes and the corresponding attribute sets, so as to provide attribute query and calling services for the network center.

[0023] Based on a three-layer distributed network architecture, the computational task of mining access control attributes of object resources is moved to edge nodes closer to the data. Attributes mined in the distributed network, including the mapping relationship between object resource identifiers and corresponding attribute sets, are stored on nearby storage nodes and managed by a central management center. When using attributes, the transmitted data is the mapping relationship between the object resource identifier and the attribute set, rather than the original object resource data. This significantly reduces network bandwidth costs and avoids network congestion caused by an excessive number of resource objects or large files. The distributed architecture fully utilizes the computing and storage capabilities of edge devices, avoiding the high costs of building high-performance computing centers. Because the transmitted data consists of processed attribute sets and resource attribute mapping relationships, the privacy risks associated with the original data during transmission and storage processing at the computing center are mitigated to some extent, thus improving security.

[0024] To address the challenges of attribute mining on massive distributed data and the limitations of terminal device performance when using deep neural networks for attribute mining tasks, this invention further provides a method for ABAC attribute mining based on edge computing within the aforementioned distributed network architecture. This method deploys an attribute mining model on the edge nodes of the distributed network architecture and uses this model to obtain access control attributes of each entity in the attribute access control system, thereby achieving secure access control of network data. The attribute mining model employs a neural network model trained and optimized using dataset samples. By leveraging the computing and storage capabilities of the edge nodes in the distributed network architecture, high-quality attributes can be effectively and automatically mined using neural network models in a distributed big data environment, providing a foundation for efficient policy generation and decision-making in the ABAC system.

[0025] Furthermore, in this embodiment, the neural network model in the edge node is trained and optimized using knowledge distillation. The deep neural network is used as the teacher model, and the shallow neural network is used as the student model. Through iterative training of the teacher model and the student model, the student model learns the attribute mining ability of the teacher model.

[0026] Large, complex attribute mining models can be trained using knowledge distillation to transfer their attribute mining capabilities to a smaller, more deployable model. This lightweight approach to attribute mining models based on knowledge distillation enables easy deployment on edge nodes with average performance.

[0027] Furthermore, in this embodiment, the dataset samples are divided into Sample 1 and Sample 2, with Sample 1 being larger than Sample 2. In the training and optimization of the neural network model, Sample 1 is used to pre-train the teacher model, and the probability distribution of the teacher model's prediction of the samples is set as a soft label, while the true results of the samples are set as hard labels. Sample 2 is used to simultaneously train and optimize the teacher model and the student model, so that the output of the student model tends to the soft label, and the hard label is used to constrain the predicted probability distribution of the student model's samples.

[0028] In knowledge distillation, a large, complex attribute mining model is first trained on a large dataset. Once this large model can generalize and predict data well, its predictive power is transferred to a smaller network. The goal is to speed up deployment and save resources. The large network model is called the teacher model, and the small network model is called the student model. The requirements for models using knowledge distillation are as follows: 1) There are no strict structural requirements between the teacher and student models; the models can be selected based on actual deployment needs. 2) Knowledge distillation is suitable for classification models using softmax. 3) With a pre-trained teacher network, the training data required for the student model is relatively small, and the training time for the student model is also short.

[0029] Knowledge distillation essentially transfers the generalization ability of the attribute mining model. A model with good generalization ability can correctly predict unseen samples. Knowledge distillation refers to the probability distribution of the teacher model's predictions as soft labels (Soft Targets) and the true results of the samples as hard labels (Hard Targets). During training, the student model's output is made as close as possible to the soft labels, and the hard labels constrain the student model's predictions. Specifically, the concept of temperature T is introduced into the original softmax function, resulting in a new softmax-T function as shown in Equation 1, which makes the model output a smoother probability distribution carrying more information.

[0030]

[0031] In the above formula, vector o represents the model's predicted Logits, which serves as the input to the softmax-T function. The output probability is represented by the hyperparameter T, which represents the temperature. When T = 1, it is the usual softmax function; as T approaches 0, the output probability vector becomes more one-hot; as T approaches infinity, the probabilities in the output probability vector become closer together. By increasing the temperature T, we make the output of the teacher model smoother and carry more information, thus obtaining soft labels for the student model's learning.

[0032] A deep neural network-based attribute mining model is used as the teacher model, while a smaller, shallow neural network is selected as the student model. Through iterative training of the teacher-student model, the shallow model learns the attribute mining capabilities of the deep model. The knowledge distillation process of the teacher-student model is as follows: Figure 2 The specific distillation steps can be designed as follows:

[0033] 1) The output of the trained teacher model is passed through a "high-temperature" softmax-T function to obtain soft labels si containing the hidden knowledge in the teacher model. In the student model, the softmax-T function and the ordinary softmax function are used respectively to obtain soft predictions spi and hard predictions hpi, representing the predictive ability of the student model. The actual label distribution of the training data is represented as hard labels hi in one-hot encoding.

[0034] 2) Construct the loss function of knowledge distillation as shown in the following formula (2) to realize the information transfer from the teacher model to the student model.

[0035] Loss total =KL(s) i ,sp i )×λ×T 2 +CE(h i ,hp i )×(1-λ) (2)

[0036] The relative entropy function (KL) is commonly used to measure the difference between two probabilities. KL loss measures the difference between the soft label output by the teacher model and the soft prediction output by the student model, serving as the distillation loss. The cross entropy function (CE) is commonly used to calculate the difference between predicted and true probabilities. CE loss calculates the difference between the hard prediction hpi of the student model and the hard label hi representing the actual class, serving as the student model's prediction loss. λ, as a harmonic parameter, changes the proportion of KL and CE in the total loss; the weighted sum of the two losses is the final Total Loss.

[0037] In this embodiment, the teacher-student training process based on knowledge distillation can transfer the attribute mining capability of a deep hybrid neural network model for massive data to a shallow neural network, resulting in a lightweight access control attribute mining model that can be distributed and deployed on edge devices. This solves the problems of excessive communication consumption and massive entity access control attribute mining when computing distributed data.

[0038] Unless otherwise specifically stated, the relative steps, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention.

[0039] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for ABAC attribute mining based on edge computing under a distributed network architecture, characterized in that, An attribute mining model is deployed on the edge nodes of a distributed network architecture to obtain the access control attributes of each entity in the attribute access control system, thereby achieving secure access control of network data. The attribute mining model employs a neural network model trained and optimized using dataset samples. The neural network models in the edge nodes are trained and optimized using knowledge distillation, with a deep neural network serving as the teacher model and a shallow neural network as the student model. Through iterative training between the teacher and student models, the student model learns the attribute mining capabilities of the teacher model. The distributed network architecture includes: a bottom layer for generating access control object resource data, an intermediate layer for computation and storage, and a layer for... The network center provides query services for use by upper-layer applications. The middle layer consists of edge nodes adjacent to the lowest-level terminal devices. Each edge node performs access control attribute mining and data storage functions, and stores and transmits attribute data using a mapping relationship between object resource identifiers and corresponding attribute sets. The network center provides query services in the form of cloud computing and uses a unified interface for upper-layer applications of the access control system to call. The edge nodes of the middle layer are functionally divided into computing nodes for access control attribute mining and storage nodes for data storage. The storage nodes store the mapping relationship between access control object resource identifiers and corresponding attribute sets mined by the computing nodes for attribute query and calling services of the network center.

2. The method for ABAC attribute mining based on edge computing under a distributed network architecture according to claim 1, characterized in that, The dataset samples are divided into Sample 1 and Sample 2, with Sample 1 being larger than Sample 2. In the training and optimization of neural network models, a sample pair is used to pre-train the teacher model. The probability distribution of the teacher model's prediction of the samples is set as a soft label, and the actual results of the samples are set as hard labels. A sample pair is used to train and optimize both the teacher model and the student model simultaneously, so that the output of the student model tends to the soft label, and the predicted probability distribution of the student model samples is constrained by the hard label.

3. The method for ABAC attribute mining based on edge computing under a distributed network architecture according to claim 1 or 2, characterized in that, In the training and optimization of neural network models, adding the temperature parameter T to the softmax function yields the softmax-T function, expressed as: in, 'o' represents the probability distribution output, and 'o' represents the input of the function. The softmax-T function is used to make the model output smoother and the output probability distribution conforms to the preset information conditions, where conforming to the preset information conditions means satisfying the preset amount of information carried.

4. The method for ABAC attribute mining based on edge computing under a distributed network architecture according to claim 3, characterized in that, The softmax-T function is used to smooth the model output. Specifically, for the teacher model output, the softmax-T function is used to obtain soft labels s that contain the hidden knowledge within the teacher model. i In the student model, the soft prediction sp, which characterizes the predictive ability of the student model, is obtained using both the softmax-T function and the ordinary softmax function. i and hard prediction hp i The actual sample labels are used as hard labels h in one-hot encoding. i .

5. The method for ABAC attribute mining based on edge computing under a distributed network architecture according to claim 4, characterized in that, The objective loss function for training optimization is expressed as: Loss total =KL(s) i ,sp i )×λ×T 2 +CE(h i ,hp i )×(1-λ), where T represents the temperature parameter and λ represents the harmonic parameter between relative entropy KL and cross entropy.

6. The method for ABAC attribute mining based on edge computing under a distributed network architecture according to claim 1, characterized in that, The same device in the middle layer is a compute node and / or a storage node.

7. An electronic device, characterized in that, include: The processor, communication interface, memory, and communication bus are connected, with the processor, communication interface, and memory communicating with each other via the communication bus. Memory, used to store computer programs; A processor is configured to execute a program stored in memory and, when the program is executed, implement the steps of the method described in any one of claims 1 to 6.

Images