Knowledge graph fine-grained access control method and system based on user behavior dynamic attributes

Abstract

The application discloses a kind of knowledge graph fine-grained access control method and control system based on user behavior dynamic attribute, belongs to knowledge graph access technical field, design user dynamic attribute is used to depict user's interest preference and proficiency neighborhood and access behavior etc., and give out how relevant dynamic attribute accepts user behavior and completes the modification of dynamic attribute value.Afterwards, the user type in the system is designed, and the conversion relationship between the user type is given.Finally, combined with user dynamic attribute and user role type, design dynamic authorization strategy applied to the multidimensional field knowledge graph system jointly constituted by multiple field graphs, design the node type and node level in the multidimensional graph system that each type of user can access.And in order to let dynamic authorization strategy adapt to graph update, real-time acquisition of the level information of node in multiple graphs, realize the dynamic access control to the resources in graph.

Description

Technical Field

[0001] This invention relates to the field of knowledge graph technology, specifically to a fine-grained access control method and system for knowledge graph databases based on dynamic attributes of user behavior. Background Technology

[0002] Knowledge graphs are essentially semantic networks based on graphs, typically containing entities, attributes, and relationships. They represent a novel knowledge management model, enhancing data visualization and offering practical benefits in promoting knowledge-based development across various sectors of the national economy. In terms of storage media, graph databases offer significant advantages over relational databases in both storage and retrieval: their flexible design patterns better adapt to the data model of knowledge graphs; and their index-based and graph traversal-based query methods allow for faster retrieval of relevant entities and relationships. Therefore, an increasing number of developers are choosing graph databases for storing their knowledge graphs. Simultaneously, access control methods are an indispensable component of a robust knowledge graph system. These methods protect sensitive data within the knowledge graph and restrict user access to and modification permissions for nodes and relationships, ensuring data security and system stability.

[0003] Currently, access control for graph databases and knowledge graphs is relatively limited. Some achievements include: process-based access control methods, such as coarse-grained access control for the enterprise version of Neo4j graph database, and resource-based access control methods, such as relation-based and attribute-based access control methods. However, when knowledge graph systems are applied to specific scenarios, a new requirement arises: how to generate dynamic attributes based on user behavior to enrich the permission management of knowledge graph systems and enhance the security of access control. Furthermore, how to implement dynamic authorization access control methods for different fine-grained resources in a knowledge graph based on dynamic attributes of user behavior is also an issue that needs to be considered in the development of knowledge graph systems.

[0004] In response to the practical need for knowledge graph access control, some feasible research and implementation methods have been developed. However, these methods still have some limitations in terms of dynamic authorization strategies based on user behavior and fine-grained access control of the graph.

[0005] First, current knowledge graph access control methods do not incorporate user behavior. By defining dynamic attributes for users and modifying these attributes based on user behavior, it is impossible to characterize users' interests and areas of expertise.

[0006] Secondly, there is a lack of targeted access control for fine-grained resources categorized and classified. In knowledge graphs with ontology structures, stricter access control strategies should be adopted for more detailed ontology concepts far from the root concept and their connected nodes. This is not mentioned in most knowledge graph access control methods. Furthermore, for knowledge graph systems with hierarchical classification of nodes, existing access control authorization strategies lack dynamism. Most existing authorization strategies are static authorizations based on attributes and relationships. Once the resource's hierarchy in the graph changes, the authorization strategy does not change accordingly. Summary of the Invention

[0007] To address the shortcomings of existing technologies and solve the aforementioned technical problems, this application provides a method and system for fine-grained access control of knowledge graphs based on dynamic attributes of user behavior. The method and system of this application can combine dynamic attributes of user behavior to implement targeted real-time dynamic authorization strategies for various fine-grained resources for each user. It can be applied to knowledge graph systems with graph databases as storage media to achieve fine-grained access control of their resources.

[0008] The design concept of this application is:

[0009] First, taking a knowledge graph with seven types of nodes as an example, we design a storage mode for the knowledge graph composed of seven types of nodes in a graph database, provide the relationships between different types of nodes, and explain several fine-grained partitioning methods of the graph under this node relationship structure.

[0010] Secondly, design user dynamic attributes to characterize users' preferences, strengths, and frequent visits, and explain how these dynamic attributes accept user behavior and modify their values.

[0011] Next, design the user types in the system and provide the conversion relationships between user types.

[0012] Finally, by combining user dynamic attributes and user role types, a dynamic authorization strategy for read and write functions is designed to obtain the node types and node levels that each type of user can access. Furthermore, to adapt the dynamic authorization strategy to graph updates, real-time node hierarchy information is obtained to achieve dynamic access control over resources in the graph.

[0013] Based on the above technical ideas and objectives, the specific solution proposed in this application is as follows:

[0014] The first aspect of this invention provides a fine-grained access control method for knowledge graphs based on dynamic attributes of user behavior, which mainly includes the following four steps:

[0015] S1: Define the storage mode of the knowledge graph and perform fine-grained partitioning of the knowledge graph data;

[0016] S2: Set and modify user dynamic attributes;

[0017] S3: Design user role types and the transitions between user roles;

[0018] S4: Based on the knowledge graph data after fine-grained partitioning, and according to the user's dynamic attributes and user role type, design dynamic authorization strategies for read and write functions to obtain the knowledge graph node types and node levels accessed by each type of user.

[0019] As an implementable solution of the present invention, the fine-grained partitioning of the knowledge graph data in step S1 is selected from one of the following methods: partitioning based on graph database node type, partitioning based on concept level, and partitioning based on relationship across levels and types.

[0020] As an implementable solution of the present invention, the specific method for setting and modifying the user's dynamic attributes in step S2 is as follows:

[0021] Attribute name Storage content Meaning Preferred concept Multiple concepts of a certain level Indicate the user's preferred sub-field Contribution to the graph Positive number The user's contribution to the graph's maintenance Importance Positive number The user's potential influence on the future development of the graph Node type preference Three or more node types The three types of nodes that the user views the most

[0022] Upon initial login, users will select multiple domain concepts they are proficient in or prefer within their subject area, choosing up to three from multiple data dimensions to initialize their proficient concepts and node type preference attributes. During system use, users have a limited number of opportunities to modify their proficient domains in the maintenance and management module. The system will also calculate users' recent preferences and contribution values ​​based on their dynamic behavior to update their proficient domains. Internal maintenance users can also request corresponding proficient concepts from the administrator before initiating modifications to the graph.

[0023] When a user contributes to the maintenance of a knowledge graph within a specific domain, the contribution depth (NodeLevel) and the contribution quantity (ContriQuantity) are calculated within the subdomain of the knowledge graph to which the user's contribution belongs, resulting in a contribution value (ContriValue). This value is then added to the user's graph contribution value attribute. The system periodically accumulates and sorts the user's current contribution values ​​for each subdomain, recalculates the user's areas of expertise, and implements dynamic access control authorization within the system.

[0024] The user importance attribute is calculated using both contribution weight and identity weight, and is used to characterize the credibility of a user's future modifications to the graph. The user identity weight depends on the user type, with expert users having a higher identity weight than ordinary users; the contribution weight is obtained by normalizing the system's contribution to all users, and this weight decreases as the time a user has not made a contribution increases.

[0025] Modification of node type preference attributes is calculated based on users' dynamic access behavior. When a user accesses a node of a certain type in the multi-dimensional graph to view its specific information, the system records the frequency and time of the user's access to that node type and updates the user's preference value for that node type. When recent accesses reach a certain number or a certain time period, the system calculates the user's preference attributes. All user access behaviors are weighted uniformly according to a time window to increase the weight of recent access behaviors. The top three node types with the highest access preference values ​​for each user will be used as the user's current node type preference attribute.

[0026] As an implementable solution of the present invention, the specific method for designing user role types and the conversion between user roles in step S3 is as follows:

[0027] Initial role type Condition Agent Role type after transition Ordinary user Premium member Automatic VIP user Ordinary / VIP user Apply for graph maintenance qualification Administrator Internal graph maintenance user Ordinary / VIP user Attribute "contribution value" meets the standard Automatic Internal graph maintenance user Ordinary / VIP user Apply for field expert qualification Administrator Internal expert user

[0028] Regular users who wish to view deeper nodes can upgrade to VIP users by purchasing a membership. Both regular and VIP users can either apply to the administrator for graph maintenance qualifications; upon approval, they will be upgraded to internal maintenance users with higher modification privileges; or they can submit contributions to the graph for modification and maintenance. Adoption of these contributions will increase the user's contribution value attribute. When the contribution value attribute meets a threshold, the system will automatically upgrade the user to an internal maintenance user. The granting of expert user status requires administrator approval, who will then issue the expert user designation.

[0029] As an implementable solution of the present invention, the authorization strategy in step S4 is to generate a dynamic authorization file for each user terminal and a graph node hierarchy file for the administrator terminal, and assign corresponding values ​​to each level to dynamically adjust the user attributes and user types required to access a certain level node in the graph.

[0030] As one implementable embodiment of the present invention, the authorization strategy in step S4 includes permission policies for four user types.

[0031] A dynamic authorization strategy is implemented by combining dynamic attributes and user role types. Instead of authorizing individual nodes, authorization is granted at the node level and type. The authorization strategy is ultimately generated as a file for each user, allowing administrators to manually adjust the authorization policy for a specific user if dynamic authorization fails to meet their needs.

[0032] Firstly, since this access control method can be applied to knowledge graphs in various fields, to facilitate use by different knowledge graph systems, this invention, for the administrator side, uses a knowledge graph node hierarchy file to dynamically adjust the user attributes and user types required to access a certain level of node in the knowledge graph. A total of X values ​​are stored, explained in detail below:

[0033] The first value stores the lowest node level, free_all, which is accessible to all users for free. For example, if it is set to 3, then points at or below level 3 are accessible to all users, and the sub-concepts stored in the "Expert Concepts" attribute will also be level 3 nodes, which facilitates access control for nodes at more detailed levels below them.

[0034] The second numerical value stores the impact of the attributes "Expertise Concepts" and "Node Type Preferences" on the authorization strategies for different role types, stored as two values: skill_all and skill_nodelabel. For ordinary users, once a node is obtained under an "Expertise Concept," the deepest level they can query is free_all + skill_all, encompassing all types of nodes. Deeper levels of nodes allow access to all types of nodes specified in "Node Type Preferences" at the free_all + skill_nodelabel level. Regarding modification permissions, ordinary users can submit modification suggestions for all accessible nodes, but these suggestions require administrator approval and cannot be directly modified.

[0035] The third value stores the difference in node depth between VIP users and regular users, specifically vip_levelplus. For example, if free_all is level 3 and vip_levelplus is 2, then regular users can access nodes at levels 3 or lower, while VIP users can access nodes at levels 5 or lower.

[0036] The fourth value stores the difference in node depth between internal graph maintenance users and ordinary users, specifically internal_levelplus. For example, if free_all is 3 and internal_levelplus is 3, then nodes at levels 3 or lower are accessible to ordinary users, while nodes at levels 6 or lower are accessible to internal graph maintenance users.

[0037] Specifically:

[0038] 1) Regular users

[0039] Query permissions: Query all types of nodes up to the free_all level. For subdomains under the dynamic attribute "proficiency concept", query all types of nodes up to the free_all+skill_all level. For subdomains under "node type preference", query all types of nodes up to the free_all+skill_nodelabel level.

[0040] Modification permissions: You can submit modification suggestions for all queried nodes, but they require approval.

[0041] 2) VIP users

[0042] Query permissions: Query all type nodes up to the free_all+vip_levelplus level. For subdomains under the dynamic attribute "proficiency concept", query all type nodes up to the free_all+skill_all+vip_levelplus level, and all type nodes in "node type preference" up to the free_all+skill_nodelabel+vip_levelplus level.

[0043] Modification permissions: You can submit modification suggestions for all queried nodes, but they require approval.

[0044] 3) Internal map maintenance users

[0045] Query permissions: Query all type nodes up to the free_all+internal_levelplus level. For subdomains under the dynamic attribute "skill_all+skill_all+internal_levelplus", query all type nodes up to the free_all+skill_nodelabel+internal_levelplus level, and all type nodes in "node type preference" up to the free_all+skill_nodelabel+internal_levelplus level. If the "importance" attribute is above the threshold, all type nodes under this sub-concept are accessible.

[0046] Modification permissions: Modifications can be submitted for all query nodes, pending approval;

[0047] 4) Internal map maintenance users and administrator users

[0048] Query permissions: All nodes

[0049] Modify permissions: All nodes.

[0050] Each time a user sends a resource request, the system retrieves the user's authorization policy file and, for nodes in the database, obtains their hierarchical structure in real time. The allowed hierarchical structure in the policy file is compared with the node's hierarchical structure to control whether a node can be viewed or modified. Furthermore, because the node's hierarchical structure is dynamically determined rather than fixed, it changes accordingly when knowledge in the knowledge graph is updated, adapting to the access control implemented through the authorization policy.

[0051] In addition, for nodes that meet the access conditions, in order to help users better understand other related information of the obtained node, nodes from other dimensions of the same level as well as nodes from nearby levels are returned to the user. This allows the user to understand the architecture of the knowledge graph in which the queried node is located, thus making it easier for the user to use.

[0052] A second aspect of the present invention provides a fine-grained access control system based on knowledge graphs of dynamic user behavior attributes, the system comprising:

[0053] The knowledge graph storage module is used for;

[0054] The graph data fine-grained partitioning module is used to partition graph data by node type, concept level, or across levels and types based on relationships.

[0055] The user dynamic attribute maintenance module is used to set and modify various dynamic attributes of users.

[0056] The user role classification and conversion module is used to automatically or by administrators convert user roles according to set conditions.

[0057] The dynamic authorization module is used to design dynamic authorization strategies for read and write functions based on user dynamic attributes and user role types, and to obtain the knowledge graph node types and node levels accessed by each type of user.

[0058] In summary, the present invention has the following main beneficial effects:

[0059] This knowledge graph database access control method designs access control for seven node types: domain concepts, academic, engineering, technology, products, patents, and standards. It utilizes the domain concept structure to assign hierarchy to all nodes in the graph, facilitating authorization control across the entire hierarchical level in the authorization policy. Furthermore, by acquiring user behavior data, it assigns four dynamic attributes to users, better describing their interests and expertise in the sub-domains of the graph, and more effectively characterizing their contributions and importance to graph maintenance.

[0060] In addition, this application also designs five user identities, which, together with dynamic attributes, are used to design dynamic authorization strategies for node levels and node types in the knowledge graph. Based on the dynamic authorization strategy, the node level is obtained in real time, realizing more targeted access control for knowledge update scenarios and enhancing the security of the knowledge graph system. Attached Figure Description

[0061] Figure 1 This is an example diagram illustrating the domain concept system of the present invention.

[0062] Figure 2This is an example diagram showing the relationships between different types of nodes in a knowledge graph.

[0063] Figure 3 This is a system block diagram of the present invention. Detailed Implementation

[0064] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Note: Unless otherwise specified, the experimental methods in the following embodiments are conventional methods. Unless otherwise specified, the raw materials, reagents, consumables, etc. in the following embodiments are commercially available products.

[0065] Example: Taking seven node types—domain concepts, academic, engineering, technology, product, patent, and standard—as examples, this article details the control method for accessing domain knowledge graphs containing data of these seven node types.

[0066] I. Design the storage of knowledge graphs in a graph database;

[0067] The knowledge graph involved in this invention is a domain knowledge graph containing seven types of node data: domain concepts, academic, engineering, technology, products, patents, and standards. Among them, domain concepts, as an important component of the knowledge graph, not only include various sub-domains of concepts within the domain, but also the parent-child relationships between concepts. A complete domain concept system not only facilitates viewing the knowledge structure of the domain, but also allows for more precise acquisition of finer-grained information.

[0068] The other five data types are represented as node types in the graph, each named after its type. Each type of node not only adheres to the triplet design of the knowledge graph, exhibiting relationships with each other, but also requires connection to domain concept entities via different relational edges to construct triples. Below are tables and diagrams illustrating the relationships between various entities (stored as edges in the graph database).

[0069] Table 1. Relationships between different types of nodes in the knowledge graph.

[0070] Head entity type Relation name Tail entity type Domain concept Concept subdivision Domain concept Domain concept Academic work related to the concept Academics Domain concept Technology related to the concept Technology Domain concept Product related to the concept Product Domain concept Patent related to the concept Patent Domain concept Standard related to the concept Standard Product Product meets the standard Standard Product Product based on technology Technology Product Product involves a patent Patent Academics Academics involve standardization Standard Technology Technology meets the standard Standard Patent Patent involves technology Technology Engineering Engineering based on technology Technology Engineering Engineering meets the standard Standard

[0071] 2. Perform fine-grained resource segmentation on the knowledge graph;

[0072] The knowledge graph of this invention is stored in a graph database, and therefore the following methods are used to achieve fine-grained partitioning of the knowledge graph data.

[0073] 1. Based on the division of node types in graph databases, the knowledge graph designed in this invention is also composed of seven types of nodes. Different types of nodes are stored in the graph database with different node labels. Therefore, it is possible to divide the knowledge by node type, which makes it easier for users to view knowledge in a certain dimension, such as viewing product lists or academic information.

[0074] 2. Based on the division of concept hierarchy, in addition to concept nodes, other types of nodes in the knowledge graph must be connected to concept nodes. Therefore, nodes can be divided by the hierarchy of concept nodes in the concept system. The domain is regarded as a level zero node. As the concept is further subdivided, the hierarchy of sub-concept nodes is continuously added: for example, first and second level nodes are concepts or subdomains with a larger scope within the domain, while nodes with a larger number of levels are detailed methods under a certain subdomain, etc.

[0075] 3. Relationship-based cross-level and cross-type partitioning: This partitioning is based on actual needs. When a user queries a node of a certain type at a certain level, the advantages of graph databases in relational queries are utilized to retrieve connected nodes of other node types at the same or different levels, making it easier for the user to obtain more comprehensive information in a single query.

[0076] III. Setting and Modifying User Dynamic Attributes

[0077] This graph allows users to modify its content, thus necessitating stricter access control. To better characterize users, this invention assigns four dynamic attributes: user's expertise in concepts, user's contribution to the graph, user's importance within the graph, and node type preference.

[0078] It is worth noting that these four dynamic user attributes in this application objectively exist in this field. First, for users of multi-dimensional knowledge graphs in a subject area, different users engage in different subfields of scientific research. Ordinary users and even experts may be highly proficient in a specific subfield within a broad subject area, resulting in research achievements or product development. This attribute is an objective attribute of the user in their research field. Second, when users search for and view various types of knowledge in the corresponding subject knowledge graph, they usually have their own insights and offer suggestions for modification. This is a spontaneous and proactive behavior of users in the subject knowledge graph system, and these behaviors objectively exist and should be partially absorbed and adopted after evaluation. Third, the user's authority in their own subject area and the opinions they offer in updating and maintaining the graph determine the user's importance in the graph system, that is, their authority. This attribute objectively exists and dynamically changes based on the user's own behavior. Finally, in the process of researching subject knowledge and developing products, users may have long-term areas of interest and preferences, and may also experience short-term research and interest shifts in specific fields and types within a certain period of time. This attribute belongs to the objectively existing dynamic interest attribute of users. In summary, all four dynamic attributes mentioned above are based on the user's own attributes and access behavior, rather than being subjectively set. Details of each attribute are as follows: (See reference...) Figure 3 As shown,

[0079] 1. The "User's Expertise" attribute indicates which sub-domains a user is proficient in. For regular users, this is recorded when they select their areas of expertise upon initial login. For internal users with graph maintenance capabilities, this attribute can be added upon request from the administrator when submitting modification suggestions for corresponding sub-domains in the graph.

[0080] 2. User graph contribution attribute: This attribute records the maintenance contributions a user has made to the graph in their area of ​​expertise. The value of this attribute is automatically modified each time a user's graph modification suggestion is adopted.

[0081] 3. The user's importance attribute in the graph represents the user's potential influence on the graph's future development. It is calculated by combining the user's contribution and user identity to determine the user's importance in graph maintenance. The user identity weight depends on the user type; expert users will have a higher identity weight. The contribution weight is calculated based on the user's recent contributions, and this weight will decrease as the time since the user has not made any contributions increases.

[0082] 4. Node Type Preference Attribute: This attribute represents the types of nodes that users frequently search for and view. It stores several values ​​from seven node types. Users select their areas of expertise upon initial login, which are then recorded. Subsequently, based on user search keywords and click behavior, the most frequently viewed node types are statistically analyzed, such as product, technology, or academic.

[0083] Below is a table showing the meanings and storage value types of the four user dynamic attributes.

[0084] Table 2. Meaning and Stored Values ​​of Dynamic Attributes

[0085] Attribute name Storage content Meaning Preferred concept Multiple concepts of a certain level Indicate the user's preferred sub-field Contribution to the graph Positive number The user's contribution to the graph's maintenance Importance Positive number The user's potential influence on the future development of the graph Node type preference Three or more node types The three types of nodes that the user views the most

[0086] Upon initial login, users will select multiple domain concepts they are proficient in or prefer within their subject area, choosing up to three from multiple data dimensions to initialize their proficient concepts and node type preference attributes. During system use, users can modify their proficient domains in the maintenance and management module. The system will also calculate users' recent preferences and contribution values ​​based on their dynamic behavior to update their proficient domains. Internal maintenance users can also request corresponding proficient concepts from the administrator before initiating modifications to the graph.

[0087] When a user contributes to the maintenance of a knowledge graph within a specific domain, the contribution depth (NodeLevel) and the contribution quantity (ContriQuantity) are calculated within the subdomain of the knowledge graph to which the user's contribution belongs, resulting in a current contribution value (ContriValue). This value is then added to the user's graph contribution value attribute. Past contribution values ​​are multiplied by a time weighting factor for decay. The system periodically accumulates and sorts the user's current contribution values ​​for each subdomain, recalculates the user's areas of expertise, and implements dynamic access control authorization within the system.

[0088] The user importance attribute is calculated using both contribution weight and identity weight, and is used to characterize the credibility of a user's future modifications to the graph. The user identity weight depends on the user type, with expert users having a higher identity weight than ordinary users; the contribution weight is obtained by normalizing the system's contribution to all users, and this weight decreases as the time a user has not made a contribution increases.

[0089] Modification of node type preference attributes is calculated based on users' dynamic access behavior. When a user accesses a node of a certain type in the multi-dimensional graph to view its specific information, the system records the frequency and time of the user's access to that node type and updates the user's preference value for that node type. When recent accesses reach a certain number or a certain time period, the system calculates the user's preference attributes. All user access behaviors are weighted uniformly according to a time window to increase the weight of recent access behaviors. The top three node types with the highest access preference values ​​for each user will be used as the user's current node type preference attribute.

[0090] IV. User role classification and role switching rules;

[0091] To ensure that user dynamic attributes, combined with their roles, jointly influence dynamic authorization results, this invention categorizes users into: ordinary users, paid VIP users, internal graph maintenance users, internal expert users, and administrator users. The conversion relationships between these roles are shown below.

[0092] Table 3 User Type Conversion

[0093] Initial role type Condition Agent Role type after transition Ordinary user Premium member Automatic VIP user Ordinary / VIP user Apply for graph maintenance qualification Administrator Internal graph maintenance user Ordinary / VIP user Attribute "contribution value" meets the standard Automatic Internal graph maintenance user Ordinary / VIP user Apply for field expert qualification Administrator Internal expert user

[0094] Regular users who wish to view deeper nodes can upgrade to VIP users by purchasing a membership. Both regular and VIP users can either apply to the administrator for graph maintenance qualifications; upon approval, they will be upgraded to internal maintenance users with higher modification privileges; or they can submit contributions to the graph for modification and maintenance. Adoption of these contributions will increase the user's contribution value attribute. When the contribution value attribute meets a threshold, the system will automatically upgrade the user to an internal maintenance user. The granting of expert user status requires administrator approval, who will then issue the expert user designation.

[0095] V. Implement dynamic authorization strategies based on user role classification and dynamic attributes.

[0096] Based on the rules governing the influence of dynamic attributes and node hierarchy outlined in this document, the following section describes a dynamic authorization strategy that combines dynamic attributes and user types:

[0097] 1. Regular users

[0098] Query permissions: You can query all types of nodes up to the free_all level. For subdomains under the dynamic attribute "Expertise Concept", you can query all types of nodes up to the free_all+skill_all level. For subdomains under "Node Type Preference", you can query all types of nodes up to the free_all+skill_nodelabel level.

[0099] Modification permissions: You can submit modification suggestions for all queryable nodes, but they require approval.

[0100] 2. VIP users

[0101] Query permissions: You can query all type nodes up to the free_all+vip_levelplus level. For subdomains under the dynamic attribute "skill_all+vip_levelplus", you can query all type nodes up to the free_all+skill_nodelabel+vip_levelplus level, as well as all type nodes in "node type preference" up to the free_all+skill_nodelabel+vip_levelplus level.

[0102] Modification permissions: You can submit modification suggestions for all queryable nodes, but they require approval.

[0103] 3. Internal map maintenance users

[0104] Query permissions: Allows querying all type nodes up to the `free_all+internal_levelplus` level. For subdomains under the dynamic attribute "Skill Concept", allows querying all type nodes up to the `free_all+skill_all+internal_levelplus` level, as well as all type nodes in the "Node Type Preference" category up to the `free_all+skill_nodelabel+internal_levelplus` level. If the "Importance" attribute is above a threshold, all type nodes under that sub-concept are accessible.

[0105] Modification permissions: Modifications can be submitted for all queryable nodes, pending approval.

[0106] 4. Internal map maintenance users & administrator users

[0107] Query permissions: All nodes

[0108] Modify permissions: All nodes

[0109] S106: Implement access control based on authorization policies;

[0110] Each time a user sends a resource request, the system retrieves the user's authorization policy file and, for nodes in the database, obtains their hierarchical structure in real time. The allowed hierarchical structure in the policy file is compared with the node's hierarchical structure to control whether a node can be viewed or modified. Furthermore, because the node's hierarchical structure is dynamically determined rather than fixed, it changes accordingly when knowledge in the knowledge graph is updated, adapting to the access control implemented through the authorization policy.

[0111] In addition, for nodes that meet the access conditions, in order to help users better understand other related information of the obtained node, nodes from other dimensions of the same level as well as nodes from nearby levels are returned to the user. This allows the user to understand the architecture of the knowledge graph in which the queried node is located, thus making it easier for the user to use.

[0112] The overall architecture design of this invention is described in detail below.

[0113] This invention is implemented using Python, Neo4j, and JavaScript. Python, through the Neo4j package, uses Cypher language strings and RESTful APIs to manipulate the Neo4j database, a knowledge storage medium, enabling CRUD operations on graph database entities and relationships. This is a commonly used technique in many other knowledge graph projects. When capturing user behavior and uploading it to the server, the front-end and back-end use JSON format for data interaction. Ajax-POST requests are used to call relevant back-end APIs to transmit and process user identity information and node behavior uploaded from the front-end, enabling dynamic attribute settings based on user behavior. The following sections describe the initialization of dynamic user attributes, how the front-end visualizes the knowledge graph, and the specific database operation steps for the back-end to construct the knowledge graph.

[0114] 1. Initialization of dynamic attributes

[0115] When a user creates an account, the user type is first initialized to a regular user, and the four user attributes are initialized as follows:

[0116] User's preferred concepts: The system first reads the free_all hierarchy stored in the Config.json hierarchy file, indicating that all types of nodes in this hierarchy can be accessed by all users. The system will then retrieve all concept class nodes in this hierarchy and display them to the user for selection. To prevent users from not carefully selecting during their first login, regular users are given one opportunity to modify their selections, while VIP users are given an additional opportunity.

[0117] User contribution and importance to the knowledge graph are initialized to 0. They will be changed later when user identity types are improved or when users contribute to the maintenance of the knowledge graph.

[0118] User node type preference: The seven dimensions of the knowledge graph are displayed to the user, allowing them to select up to three to roughly describe their role. For example, users more interested in academic topics are more likely to be researchers, while those more interested in product topics are more likely to be company employees. This attribute can be modified automatically based on frequently accessed content, without requiring manual selection by the user.

[0119] 2. Methods for modifying dynamic attributes

[0120] The method for dynamically modifying attributes based on user behavior requires the server to return the resource's UID to the frontend when the user retrieves the resource. The frontend then uses JavaScript's `onclick` event handler to upload both the user's ID and the node's UID to the server for recording user behavior. When the user clicks a button and triggers a JavaScript function, the `document.getElementById()` method is used to extract the user input received within the component. This input is temporarily stored as a variable within the function, and an Ajax-POST interaction framework is called. The `url` field contains the URL from the corresponding Flask framework on the backend, and the `data` field uploads the previously retrieved input. On the backend, differentiating results are returned based on the success or failure of the operation, and the result is assigned to the `res` variable in the callback function `function(res)`.

[0121]

[0122]

[0123] This method enables data interaction between the front-end and back-end. The following sections will introduce the front-end and back-end interaction methods and attribute modification methods for the four types of dynamic attributes.

[0124] 2.1 Methods for modifying user-favored concepts

[0125] There are two modification methods. For regular users and VIP users, the main approach is to assign the user a concept attribute based on their contribution value and the relevant sub-domain. A prerequisite is that the user has uploaded relevant modifications to the knowledge graph in a specific domain. The algorithm flow is as follows:

[0126] AcceptGraphChange(userid,nodes,relations) / / Administrator confirms the change is valid

[0127] freeall_concepts = GetFatherConceptofChange(nodes,relations) / / Based on the nodes and relationships of the user's suggested changes, find the parent nodes in the free_all hierarchy that represent the user's expertise in this area.

[0128] ChangeContributeValue(userid, freeall_concepts) / / Modifies the user's contribution value in this subdomain.

[0129] Maxk_concepts = GetMostSkilledinConcepts(userid) / / Recalculate the user's most skilled sub-domains based on their existing contribution values ​​in each sub-domain.

[0130] ChangeUserSkilledinConcepts(userid,Maxk_concepts)

[0131] For internal graph maintenance users, since this role type not only needs to be able to access more content in the graph, but may also need to propose modifications in many subdomains, internal graph maintenance users can apply to the administrator for their preferred concept attributes. After the administrator approves, they can continue to maintain the subdomain.

[0132] 2.2 Method for Modifying Contribution Value

[0133] Modifying the contribution value of the graph depends primarily on the level of the modified content within the graph. The larger the scope of the modification and the closer the level is to the root node, the more deeply the user understands that sub-domain within the graph, and thus a higher contribution value should be assigned. The specific process is as follows:

[0134] TopNode = GetTopConcept(nodes,relations) / / Get the node closest to the root from the modified content.

[0135] NodeLevel = GetLevelofNode(TopNode) / / Get the depth of this node, used to measure its contribution value.

[0136] ExtraValue = CalculateValuebyLevel(NodeLevel, nodes) / / This function comprehensively measures a user's contribution based on the node's depth and the number of nodes modified. The closer to the root node and the more nodes modified, the higher the contribution value.

[0137] ChangeUserContributionValue(userid, ExtraValue) / / Modify user contribution value

[0138] RecordLastModifyTime(userid) / / Refreshes the time since the user last made a contribution.

[0139] 2.3 Method for Modifying User Importance

[0140] This attribute is calculated by combining a user's contribution and their identity. The user identity weight depends on the user type; expert users will have a higher identity weight. The contribution weight is calculated based on the user's recent contributions, and this weight decreases as the time since the user last contributed decreases. The specific process is as follows:

[0141] Timestamp = GetLastModifyTime(userid) / / Get the time when the user last made a contribution

[0142] Contribution = GetContributionValue(userid) / / Get the user's current contribution value

[0143] Tmp = CalculatebyTimestamp(Timestamp, Contribution) / / Calculate the weight of the current contribution value on the importance value based on time reduction.

[0144] UserType = GetTypeofUser(userid) / / Get the user's identity, used to calculate the final importance.

[0145] Importance = CalculateUserImportance(UserType, Tmp) / / User identity weight affects the importance of the user

[0146] This calculation method multiplies user identity weights by recent contribution values. Users who have made more recent contributions are more important, and the more the user type leans towards expert, the higher the importance. However, even multiplying user type by the user's recent contribution value cannot improve the final result for users who have not made any recent contributions. Therefore, it can better measure the importance of different types of users to the knowledge graph.

[0147] 2.4 Method for Modifying Node Type Preferences

[0148] Modifying this attribute records the access frequency of the seven types of nodes. Whenever a user accesses a certain type of node to view its specific information, this access record records that node type, and the node attribute under the user is incremented by 1. The overall process is as follows:

[0149] Label=GetNodeLabelofNode(node)

[0150] ChangeNodeFrequency(userid,Label)

[0151] Maxk_nodelabels=GetMostFrequentLabel(userid)

[0152] ChangeMostFrequentLabel(userid,Maxk_nodelabels)

[0153] 3. Fine-grained partitioning method for knowledge graphs

[0154] This invention presents three fine-grained partitioning methods: partitioning based on graph database node types, partitioning based on concept levels, and cross-level, cross-type partitioning based on relationships. The following section will introduce these three graph partitioning methods from the perspective of operating the Neo4j graph database. Neo4j uses Cypher statements, a declarative graph query language that supports Chinese characters, allowing for expressive and efficient querying and updating of graphs. In this invention, the main operations performed on the knowledge graph in the graph database include modification and querying. The following section will elaborate on how the backend implements these functions using Cypher statements.

[0155] In Cypher statements, nodes can be described using the model (variable name: entity type name {attribute name: attribute value}), and nodes are added using the CREATE keyword. When adding a node, the database automatically adds an integer identifier ID to it for unique identification, without requiring the user to specify it separately. The Cypher statement for querying all conceptual entities is shown below.

[0156] MATCH(n: concept) RETURN n;

[0157] The following describes how to write Cypher statements for each of the three fine-grained partitioning methods:

[0158] 3.1 Partitioning of Node Types Based on Graph Database

[0159] The knowledge graph designed in this invention is also composed of seven types of nodes. Different types of nodes are stored in the graph database with different node labels. Therefore, it can be divided by node type, making it convenient for users to view knowledge in a certain dimension, such as viewing product lists or academic information.

[0160] Its Cypher statement is MATCH(n: node type) RETURN n;

[0161] 3.2 Concept-based division

[0162] Besides concept nodes, all other types of nodes in the knowledge graph must be connected to concept nodes. Therefore, nodes can be divided according to their hierarchy within the concept system. The current domain is considered a level zero node, and as concepts become more subdivided, sub-concept nodes are added at various levels. For example, first and second-level nodes represent broader concepts or subdomains within the domain, while nodes with higher levels represent detailed methods within a specific subdomain. For each node, the number of concept nodes between it and the root node is calculated, indicating which level of concept nodes it is connected to. This level value is stored as the node's `level` attribute. Whenever a node's hierarchy changes, its `level` attribute automatically updates. The Cypher statement is as follows:

[0163] NodeLevel = GetLevelofCurrentNode(nodeid) / / Calculate the level of the current node by iterating through nodes of the in-degree concept.

[0164] MATCH(n)WHERE id(n)=nodeid SET n.level=NodeLevel

[0165] Subsequently, when the system targets all types of nodes at a certain level, it can quickly retrieve the information based on the node's level. The Cypher statement is as follows:

[0166] MATCH(n)WHERE n.level=NodeLevel return n

[0167] 3.3 Relationship-based cross-level and cross-type partitioning

[0168] This partitioning approach is based on practical needs. When a user queries a node of a certain type at a certain level, it leverages the advantages of graph databases in relational queries to retrieve connected nodes of other node types at the same or different levels, allowing the user to obtain more comprehensive information in a single query. In graph databases, this partitioning method involves retrieving connected nodes from the database, determining if they conform to the current authorization policy, and if so, returning all of them. Its Cypher statement is as follows:

[0169] MATCH(o)-[r]->(s)WHERE id(s)=nodeid return o / / Returns all in-degrees of the queried node

[0170] MATCH(o)-[r]->(s)WHERE id(o)=nodeid return s / / Returns all out-degrees of the queried node

[0171] This method allows you to obtain all nodes connected to the queried node, including their ID information. If you want to further expand the node connections to obtain surrounding nodes, simply change the nodeid above to the ID of the new node.

[0172] 4. Dynamic authorization strategy based on dynamic attributes and user identity

[0173] This invention generates a dynamic authorization file for each user, storing the deepest node depth that the user can query in each subdomain. The authorization policy file is stored on the server and can be modified by the administrator to enable manual authorization when dynamic automatic authorization is ineffective. When a user wants to access different fine-grained resources in the system, the system first reads the user's authorization policy file and uses the matching relationship between the authorization policy and the requested resource hierarchy to implement access control for the knowledge graph database resources. The method for generating a separate authorization policy file for each user is as follows:

[0174]

[0175]

[0176] 3. Access control and front-end rendering methods based on dynamic authorization strategies

[0177] When a user wants to access resources in the system, the system first reads the user's authorization policy file. Then, it performs access control on the relevant nodes in the access or query results according to the level attribute. Nodes that meet the level conditions will eventually be returned. The following is a general access control process:

[0178] AuthPolicy = GetUserAuthPolicy(userid) / / Read the user's authorization policy

[0179] Nodes,relations = GetNodesAndRelations(userid,request) / / Get node relationships according to requirements

[0180] for node in nodes: / / Retain nodes that satisfy the authorization policy

[0181] TopNode = GetTopNode(node) / / Due to different authorization strategies in different subdomains, first obtain the parent node of its subdomain.

[0182] Nodelevel, NodeType = GetNodeinfo(node) / / Get the hierarchy and type information of the current result node.

[0183] AllowNodeLevelsandTypes = GetAllowLevelofCurrentTopNode(TopNode) / / Get the authorization policy for this subdomain, specifying which node types and levels are allowed to access.

[0184] if! isAllowed(Nodelevel,NodeType,AllowNodeLevelsandTypes):

[0185] ConcealNodeinfo(node) / / This modifies the node information so that the frontend understands that it cannot be viewed due to insufficient permissions, rather than simply stating that there is no node here.

[0186] ConcealRelationsofNodes(relations,nodes) / / This also applies to relationships containing hidden nodes.

[0187] return relations,nodes

[0188] For front-end knowledge graph visualization, if a user wants to view a dot-line graph or a tree diagram, the data needs to be returned in the corresponding JSON format. For example, in a tree diagram, the `children` field of the parent node needs to include child nodes, while a dot-line graph needs to indicate the indices of related nodes. The front-end visualization method used in this invention is described below: The front-end receives JSON data and uses the d3js force-directed graph library. First, an SVG canvas is added. Then, elements are added according to the required points and lines, and the relationships between point and line coordinates are established to ensure a tight connection between points and edges on the graph. In addition, elements such as node names and relationship names on edges also need to be added to the canvas in the form of elements. The main implementation method is as follows:

[0189] svgarea = GetElementandAddSVG(elementid) / / Get the element by its id

[0190] Simulation = d3.forcesimulation() / / d3js simulation of force guidance

[0191] link = createlinkinsvg(linkdata) / / Since the elements drawn first will be placed at the bottom, draw the edges first.

[0192] linktest = createlinktest(linkdata) / / Draw the text on the edge, i.e., the relation name

[0193] node = createnodeinsvg(nodedata) / / Draw the node

[0194] Nodetest = createnodetest(nodedata) / / Draw the node name

[0195] Createnodeclick(nodedata) / / Sets the function triggered when a node is clicked, such as viewing node information or displaying node attributes.

[0196] 4. System-specific log recording and knowledge graph version release methods for the Neo4j database.

[0197] In the system's main directory, there are two files: / Logs and / Releases. In these two folders, the strings obtained by SHA256 encoding different domain names are used as new folders and stored in these two directories. The collision resistance of SHA256 makes it easy to distinguish version releases and log information of different domains.

[0198] Version 6.1 released

[0199] When a user clicks "Publish Version" on the front end, the following are all the operations that the system backend program will perform to implement the version release:

[0200] WriteBasicInfo(releasefile) / / Writes information such as the date and version number to the file.

[0201] nodesinfo = GetAllNodesofDomain(domainname) / / Use session.run(Cypher-match statement) to get all nodes in this domain.

[0202] WriteNodeToFile(nodesinfo, releasefile) / / Writes all node information, including node name, ID, attributes, etc., to the file.

[0203] relationinfo = GetAllRelationofDomain(domainname) / / Use session.run(Cypher-match statement) to get all relations in this domain.

[0204] WriteRelationToFile(relationinfo, releasefile) / / Writes all relation information, including relation name and attributes, to the file.

[0205] 6.2 Log Recording

[0206] Whenever a user makes any modifications to the knowledge graph, the system will leave a record, mainly recording the following: timestamp, operation type (create / delete / update / query), operator, and the node and relationship content modified. The system backend logs data as follows:

[0207] def Setlog(Node,Relation,logfile):

[0208] WriteBasicInfo(logfile) / / Writes header information such as date and modifier to the file.

[0209] WriteNodeToFile(nodesinfo, logfile) / / Writes the node names and attributes to a file.

[0210] WriteRelationToFile(relationinfo, logfile) / / Writes the relation and attributes to a file.

[0211] By storing the knowledge graph modification log in files, the system also displays all previously performed operations on the knowledge graph to the user on the front end. This allows users to view the modification process and perform other operations, such as undoing changes. When undoing a change, a function with the opposite function is set based on the operation function used when the knowledge graph was stored, using the data stored in the log to complete the undo.

[0212] DeleteNode(node) / / Adds a node The opposite function of CreateNode()

[0213] DeleteRelation(relation) / / Adds a relationship. The opposite function of CreateRelation().

[0214] SetAttributes(Node, oldvalue, newvalue) / / This still uses the original attribute setting function, but when undoing, it reassigns the original attribute value to the node attribute.

[0215] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A fine-grained access control method based on knowledge graphs with dynamic attributes of user behavior, characterized in that: Includes the following steps: S1: Define the storage mode of the knowledge graph and perform fine-grained partitioning of the knowledge graph data; S2: Set and modify user dynamic attributes; S3: Design user role types and the transitions between user roles; S4: Based on the knowledge graph data after fine-grained partitioning, and according to the user's dynamic attributes and user role type, design a dynamic authorization strategy for reading and writing functions to obtain the knowledge graph node type and node level accessed by each type of user; The specific methods for setting and modifying user dynamic attributes in step S2 include: S21: When a user logs in for the first time, the user will select multiple domain concepts that they are good at or have a preference for in the subject area, and select up to three from multiple dimensions of data to initialize the good concepts and node type preference attributes. The system will calculate the user's recent preferences and contribution values ​​based on the user's dynamic behavior to update their good domains. S22: When a user makes a maintenance contribution to the knowledge graph within the domain, the contribution depth NodeLevel and the contribution quantity ContriQuantity are calculated to obtain the contribution value ContriValue, which is then added to the graph contribution value attribute. The system periodically accumulates and sorts the user's current contribution values ​​to each subdomain, recalculates the user's expertise in concepts, and implements dynamic access control authorization in the system. S23: The user importance attribute is calculated by combining contribution weight and identity weight, and is used to characterize the credibility of the user's future modifications to the graph; S24: Modification of node type preference attributes is calculated based on the user's dynamic access behavior. The system records the frequency and time of the user's access to this node type and updates the user's preference value for this type of node.

2. The fine-grained access control method for knowledge graphs based on dynamic attributes of user behavior according to claim 1, characterized in that, In step S1, the fine-grained partitioning of the knowledge graph data is selected from one of the following methods: partitioning based on multiple multi-dimensional graph node types in the graph database, partitioning based on domain concept levels, and partitioning based on relationships across levels and types.

3. The fine-grained access control method for knowledge graphs based on dynamic attributes of user behavior according to claim 1, characterized in that, The specific method for designing user role types and the conversion between user roles in step S3 is as follows: Regular users can upgrade to VIP users by recharging their membership to view deeper levels of nodes; Regular users and VIP users can apply to the administrator for map maintenance privileges. Once approved by the administrator, the user will be upgraded to an internal maintenance user with higher modification permissions. Alternatively, users can submit modifications and maintenance contributions to the graph. Once adopted, the user's contribution value attribute will be increased. When the contribution value attribute meets the threshold, the system will automatically upgrade the user to an internal maintenance user. The granting of expert user status requires administrator approval, and the administrator will then issue the expert user status.

4. The fine-grained access control method for knowledge graphs based on dynamic attributes of user behavior according to claim 1, characterized in that, The authorization strategy in step S4 is to generate a user authorization strategy file for each user terminal and a graph node hierarchy file for the administrator terminal, assigning corresponding values ​​to each level to dynamically adjust the user attributes and user types required to access a certain level node in the graph.

5. The fine-grained access control method for knowledge graphs based on dynamic attributes of user behavior according to claim 4, characterized in that, The authorization policy in step S4 includes permission policies for four user types, specifically: 1) Regular users Query permissions: Query all type nodes up to the free_all level. For subdomains under the dynamic attribute "proficiency concept", query all type nodes up to the free_all+skill_all level. For type nodes under "node type preference" in other subdomains, query the preference type nodes up to the free_all+skill_nodelabel level. Modification permissions: You can submit modification suggestions for all queried nodes, but they require approval. 2) VIP users Query permissions: Query all type nodes up to the free_all+vip_levelplus level. For subdomains under the dynamic attribute "proficiency concept", query all type nodes up to the free_all+skill_all+vip_levelplus level, and all type nodes in "node type preference" up to the free_all+skill_nodelabel+vip_levelplus level. Modification permissions: You can submit modification suggestions for all queried nodes, but they require approval. 3) Internal map maintenance users Query permissions: Query all type nodes up to the free_all+internal_levelplus level. For subdomains under the dynamic attribute "skill_all+internal_levelplus", query all type nodes up to the free_all+skill_nodelabel+internal_levelplus level, and all type nodes in "node type preference" up to the free_all+skill_nodelabel+internal_levelplus level. If the "importance" attribute is above the threshold, all type nodes under all sub-concepts are accessible. Modification permissions: Modifications can be submitted for all query nodes, pending approval; 4) Internal map maintenance users and administrator users Query permissions: All nodes Modify permissions: All nodes.

6. A fine-grained access control system based on a knowledge graph of dynamic user behavior attributes, characterized in that: The system includes: The knowledge graph storage module is used to define the schema of the knowledge graph and to achieve well-structured knowledge storage by constraining the nodes and relationships in the knowledge graph. The graph data fine-grained partitioning module is used to partition graph data by node type, concept level, or cross-level and cross-type based on relationships. The user dynamic attribute maintenance module is used to set and modify various dynamic attributes of users. The user role classification and conversion module is used to automatically or by administrators convert user roles according to set conditions. The dynamic authorization module is used to design dynamic authorization strategies for read and write functions based on user dynamic attributes and user role types, and to obtain the knowledge graph node types and node levels accessed by each type of user. The specific methods for setting and modifying user dynamic attributes include: S21: When a user logs in for the first time, the user will select multiple domain concepts that they are good at or have a preference for in the subject area, and select up to three from multiple dimensions of data to initialize the good concepts and node type preference attributes. The system will calculate the user's recent preferences and contribution values ​​based on the user's dynamic behavior to update their good domains. S22: When a user makes a maintenance contribution to the knowledge graph within the domain, the contribution depth NodeLevel and the contribution quantity ContriQuantity are calculated to obtain the contribution value ContriValue, which is then added to the graph contribution value attribute. The system periodically accumulates and sorts the user's current contribution values ​​to each subdomain, recalculates the user's expertise in concepts, and implements dynamic access control authorization in the system. S23: The user importance attribute is calculated by combining contribution weight and identity weight, and is used to characterize the credibility of the user's future modifications to the graph; S24: Modification of node type preference attributes is calculated based on the user's dynamic access behavior. The system records the frequency and time of the user's access to this node type and updates the user's preference value for this type of node.

Images