An access control policy intelligent generation management method

Abstract

The present application relates to the technical field of control strategy generation, and discloses an intelligent generation management method of access control strategy, which comprises the following steps: collecting user access behavior history data for vectorization processing; extracting attribute vectors in the user access behavior vectors, and performing attribute vector screening by using a recursive elimination method; performing attribute entropy value calculation on the attribute vectors, and constructing a strategy generation tree according to the calculated attribute entropy values; and intelligently generating an access control strategy based on the strategy generation tree. In the present application, attribute vectors with greater importance are screened out as an access control strategy generation attribute set, and a strategy generation tree is constructed. In the process of generating an access control strategy, the user identity attribute is taken as a starting point for upward traversal, and the strategy step with the minimum entropy value is selected, so as to reduce the user's confusion caused by the strategy step, until the access control content is reached. On the basis of ensuring the accuracy of the generated strategy, the generated access control strategy is more concise.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of access control policy generation, in particular to an access control policy intelligent generation management method. BACKGROUND

[0002] Access control policy can guide access control activity implementation according to inherent attributes of users and resources, has advantages of dynamic flexibility, strong expansibility, fine granularity, automatic decision and the like, and is an ideal scheme for meeting complex system security protection requirements of large data cloud environment with a large number of users and massive data resources. Among them, access control policy formulation is the core of realizing effective control of user access behavior, and how to accurately configure a set of optimized rules from a large number of user, resource, attribute and attribute value allocation sets to generate access control policy is a key problem to be solved for implementing security protection in large data cloud environment. In view of the problem, the present application provides an access control policy intelligent generation management method to realize automatic generation management of access control policy in large data cloud environment. SUMMARY

[0003] Therefore, the present application provides an access control policy intelligent generation management method, which aims to: 1) according to the extracted identity attribute vector representing user attributes and the resource attribute vector representing a plurality of access behavior operation nodes, a base classifier is constructed by filtering one attribute vector each time, the base classifier is used to predict the user access behavior vector, and the prediction classification accuracy rate of the access control feedback result after deleting the attribute vector is obtained, wherein the lower the accuracy rate, the greater the influence of the attribute vector on the base classifier, that is, the more obvious the influence on the access control feedback result, and the greater the importance of the attribute vector, and the attribute vector with greater importance is obtained by screening as an access control policy generation attribute set, and a strategy generation tree is constructed based on the access control policy generation attribute set, so that the generated access control policy is more concise on the basis of ensuring the accuracy of the generated policy; 2) attribute entropy values of the attribute vectors in the access control policy generation attribute set are calculated, a strategy generation tree is constructed according to the calculated attribute entropy values, the attribute entropy values are used as weights of different node connections, the greater the attribute entropy value, the greater the difference between the prefix and suffix nodes associated with the node, the greater the probability of conflict between the generated access control operation nodes, and the more the types of access control content associated, so that the generated access control policy is too bulky and more confusing, therefore, the strategy generation tree is constructed with access control content as a root node, access control policy as a node, and identity attribute as a leaf node, and in the access control policy generation process, the leaf node is taken as a starting point for upward traversal, the path with the smallest weight is selected until the root node is reached, thereby reducing the confusion of the generated policy to users.

[0004] To achieve the above object, the application provides an intelligent generation management method of access control strategy, comprising the following steps:

[0005] S1: collecting user access behavior history data and performing vectorization processing to obtain user access behavior vectors;

[0006] S2: extracting attribute vectors in the user access behavior vectors, taking access control feedback results as labels of the attribute vectors, performing attribute vector screening by using a recursive elimination method, and obtaining an access control strategy generation attribute set;

[0007] S3: performing attribute entropy value calculation on the attribute vectors in the access control strategy generation attribute set, and constructing a strategy generation tree according to the calculated attribute entropy values;

[0008] S4: intelligently generating an access control strategy based on the strategy generation tree.

[0009] As a further improved method of the application:

[0010] Optionally, the step S1 of collecting user access behavior history data comprises:

[0011] collecting user access behavior history data of N users, wherein the user access behavior history data of the nth user is in the form of:

[0012] x n =(ID n ,w n ,L n )

[0013] ID n =(age n ,sex n ,post n )

[0014] w n =(w n (1),w n (2),...,w n (j),...,w n (num n ))

[0015] L n =(S n ,sgn n )

[0016] wherein:

[0017] x n represents the user access behavior history data of the nth user, n∈[1,N];

[0018] IDn represents the identity attribute of the nth user, including age age n , gender sex n and position level post n ;

[0019] w n = (w n (1), w n (2),..., w n (j),..., w n (num n )) represents the access behavior path of the nth user, w n (j) represents the jth access behavior operation node in the access behavior path w n , and num n represents the total number of access behavior operation nodes in the access behavior path w n ;

[0020] L n represents the access control result of the nth user, S n represents the access control content of the nth user, and sgn n =

[0021] {0,1} represents the system feedback to the access control content S n , sgn n = 0 indicates that the operation fails and the access control is prohibited, and sgn n = 1 indicates that the operation succeeds and the access control is allowed.

[0022] Optionally, the vectorization processing of the user access behavior history data in the S1 step comprises:

[0023] The user access behavior history data is vectorized, and the vectorization processing procedure is as follows:

[0024] S11: The age in the user identity attribute is encoded and represented by binary coding, the gender in the user identity attribute is encoded and represented by {0,1}, 0 represents female and 1 represents male, and the position level in the user identity attribute is encoded and represented by one-hot method, to obtain a user identity attribute vector;

[0025] Wherein the identity attribute vector of the nth user is: v(ID n ) = (v(age n ), v(sex n ), v(post n )), and v(·) represents the encoding representation of the identity attribute;

[0026] S12: all access behavior operation nodes are encoded using the one-hot method, wherein the one-hot encoding result of the access behavior operation node of the nth user access behavior path is: wherein is the one-hot encoding result of w n (num n ), and c n is the one-hot encoding result of the nth user access behavior path.

[0027] S13: the one-hot encoding result of the user access behavior path is encoded using the attention mechanism of the Transformer model, wherein the attention encoding processing formula of c n is:

[0028] C n = Q n ·[ReLU(V n ·A n )]

[0029] Q n = W Q ·c n , V n = W V ·c n , A n = W A ·c n

[0030] wherein:

[0031] W Q , W V , and W A represent the weight matrix in the Transformer model;

[0032] C n represents the attention encoding processing vector of c n , C n = [C n (1), C n (2),..., C n (j),..., C n (num n )], and C n (j) is the attention encoding result of the access behavior operation node w n (j) of the nth user.

[0033] Optionally, in the S2 step, the access control feedback result is taken as the label of the attribute vector, and the attribute vector is screened using the recursive elimination method, comprising:

[0034] extracting an attribute vector in the user access behavior vector, the extracted attribute vector including an identity attribute vector, a one-hot encoding representation of different access behavior operation nodes, and an attention encoding processing vector of a user access behavior path, and taking an access control feedback result as a label of the attribute vector, wherein an attribute vector extraction result of an nth user is:

[0035] (v(ID n ),c n ,C n ,sgn n )

[0036] using a recursive elimination method to perform attribute vector screening, wherein the attribute screening process is:

[0037] S21: arranging the identity attribute vector, the binary encoding representation of the access behavior operation nodes, and the one-hot encoding representation to obtain M1 binary encoding representations of ages, M2 binary encoding representations of genders, M3 one-hot encoding representations of position levels, and M4 one-hot encoding representations of access behavior operation nodes;

[0038] S22: taking the M1 binary encoding representations of ages, the M2 binary encoding representations of genders, and the M3 one-hot encoding representations of position levels as three types of features f1, f2, and f3 respectively, wherein f1 represents an age feature, f2 represents a gender feature, and f3 represents a position level feature, and taking each of the M4 access behavior operation nodes as a feature wherein represents the M4th access behavior operation node feature;

[0039] S23: dividing the attribute vectors of the N users and the access control feedback results collected into a data set B and a data set D, wherein the data set B includes the attribute vectors of the N users and the access control feedback results, and the data set D includes the attribute vectors of the N users and the access control feedback results, and the attribute vector of each user in each data set is a spliced vector of an identity attribute vector and an attention encoding processing vector of a user access behavior path;

[0040] S24: for each feature f i , deleting the part describing the feature f i from the attribute vectors in the data set B and the data set D, and retaining the other parts to obtain a data set B i and a data set D i , wherein i ∈ [1, 3 + M4], the initial value of i is 1, the data set B i is a processed result of the data set B, and the data set D i is a processed result of the data set D;

[0041] S25: training the base classifier g i with the attribute vector of the feature f i and the access control feedback result in the dataset B i , wherein the input of the base classifier g i is the splicing vector, the splicing vector is the splicing result of the identity attribute vector of the feature f i and the attention encoding processing vector corresponding to the user access behavior path, and the output is the classification result {0, 1}, 0 corresponds to operation failure, access control is prohibited, and 1 corresponds to operation success, access control is allowed;

[0042] wherein the structure of the base classifier is a support vector machine model, and the training objective function F(g i ) of the base classifier g i is:

[0043]

[0044]

[0045] wherein:

[0046] represents the access control feedback result of the kth user in the dataset B i , and represents the splicing vector of the kth user in the dataset B i ;

[0047] q i represents the linear weight of the hyperplane constructed in the base classifier g i , and b i represents the bias;

[0048] S26: taking the splicing vector of the feature f i part in the dataset D i as the input value of the base classifier g i , wherein the splicing vector is the splicing result of the identity attribute vector of the feature f i and the attention encoding processing vector corresponding to the user access behavior path, and combining the output result of the base classifier g i and the access control feedback result, the classification accuracy of the base classifier g i is calculated, and the calculation result of (1-classification accuracy) of the base classifier g i is taken as the importance of the feature f i ;

[0049] let i = i + 1, return to step S24, until i = 3 + M4;

[0050] S27: select M features with the highest importance as attribute vectors of the screening result, and form an access control policy generation attribute set {r m m , where r s represents the mth attribute vector in the access control policy generation attribute set; if the access control policy generation attribute set does not exist the attribute vector of the identity attribute, select the feature with the highest importance among the features f1, f2, f3 as the Mth feature in the access control policy generation attribute set.

[0051] Optionally, the attribute entropy value calculation of the attribute vector in the access control policy generation attribute set in the S3 step comprises:

[0052] The attribute entropy value calculation of the attribute vector in the access control policy generation attribute set comprises:

[0053] For any attribute vector r s of a non-identity attribute, the prefix attribute vector r s of r s′ is obtained by traversing the user access behavior path of the N users, where r s corresponding access behavior operation node w(s) and r s′ corresponding access behavior operation node w(s') exist in the form of (w(s'), w(s)) in the user access behavior path of the N users, and r s′ is in the access control policy generation attribute set, then r s′ For the attribute entropy value μ(r s , r s′ ) of r s , the following formula is used:

[0054]

[0055] Wherein:

[0056] P(r s′ ) represents the frequency of the access behavior operation node corresponding to r s′ in the user access behavior path of the N users;

[0057] count1(r s′ ) represents the number of suffix attribute vectors of the access behavior operation node corresponding to r s′ in the user access behavior path of the N users, and count2(r s ) represents the number of prefix attribute vectors of the access behavior operation node corresponding to r s in the user access behavior path of the N users, where the attribute vectors belong to the access control policy generation attribute set.

[0058] Optionally, the strategy generation tree constructed based on the attribute entropy value in step S3 includes:

[0059] A policy generation tree is constructed based on the attribute entropy values. The construction process of the policy generation tree is as follows:

[0060] S31: Using the access control content as the root node, construct T policy spanning trees, where T represents the number of access control content types. For the t-th policy spanning tree, its root node is root(t), t∈[1,T], and the root node is the first level of the policy spanning tree.

[0061] S32: Traverse the valid user access behavior paths of N users to obtain the prefix attribute vector of the root node root(t), and take the access behavior operation node corresponding to the prefix attribute vector as the second-level child node of the policy generation tree, where the valid user access behavior path represents the path where the access control feedback result is 1.

[0062] S33: For the U-th level child node of the strategy spanning tree, traverse the user access behavior paths of N users to obtain the prefix attribute vector of the U-th level child node, and take the access behavior operation node corresponding to the prefix attribute vector as the U+1 level child node of the strategy spanning tree. Connect the U-th level child node with the access behavior operation node corresponding to the prefix attribute vector. The weight of the connecting line segment is the attribute entropy value of the prefix attribute vector with respect to the attribute vector corresponding to the U-th level child node, where the minimum value of U is 3.

[0063] S34: Let U = U+1, repeat step S34 until the prefix attribute vector cannot be obtained through traversal, and use the identity attribute vector in the access control policy generation attribute set as the leaf node, connect it with the last layer child node, and the weight of the connecting line segment is: 1 - the frequency of the last layer child node in the user access behavior path of N users, and set the threshold th of the leaf node. When the identity attribute of the user to be accessed meets the threshold, the access control policy is generated. The threshold th of the leaf node means that in the user access behavior data of the collected N users, the system feedback of the user with identity attribute th is 1 for this type of access control content.

[0064] Optionally, step S4 utilizes a policy spanning tree to intelligently generate access control policies, including:

[0065] Obtain the user identity attributes and access control content type of the user to be accessed, and generate access control policies using a policy spanning tree. The access control policy generation process is as follows:

[0066] Select the policy generation tree corresponding to the access control content type of the user to be accessed, and determine whether the user identity attribute meets the threshold of the leaf node of the policy generation tree. If it does, proceed to step S42; otherwise, stop the generation of access control policy.

[0067] Starting from a leaf node, the lowest weight connection segment is selected sequentially to reach the next level child node, and the child node is used as the policy step of the access control policy, until the root node is reached and the complete access control policy is obtained.

[0068] To address the above problems, the present invention provides an electronic device, the electronic device comprising:

[0069] Memory, storing at least one instruction;

[0070] Communication interfaces enable communication between electronic devices; and

[0071] The processor executes the instructions stored in the memory to implement the intelligent generation and management method for access control policies described above.

[0072] To address the aforementioned problems, the present invention also provides a computer-readable storage medium storing at least one instruction, which is executed by a processor in an electronic device to implement the aforementioned intelligent generation and management method for access control policies.

[0073] Compared with existing technologies, this invention proposes an intelligent generation and management method for access control policies, which has the following advantages:

[0074] First, this scheme proposes a filtering method based on the importance of attribute vectors. A recursive elimination method is used for attribute vector filtering. The attribute filtering process is as follows: The binary encoding representations and one-hot encoding representations of identity attribute vectors, access behavior operation nodes, and other data are processed to obtain M1 binary encoding representations of age, M2 binary encoding representations of gender, M3 one-hot encoding representations of job level, and M4 one-hot encoding representations of access behavior operation nodes. The binary encoding representations of M1 age, M2 gender, and M3 job level are respectively used as features f1, f2, and f3, where f1 represents age, f2 represents gender, and f3 represents job level. Each of the M4 access behavior operation nodes is also used as a feature. in This represents the characteristics of the operation node for the M4th access behavior; the attribute vectors of the collected N users and the access control feedback results are divided into dataset B and dataset D, where dataset B contains... The dataset D contains the attribute vectors of named users and access control feedback results. The attribute vectors of each user and the access control feedback results are used. The attribute vector of each user in the dataset is a concatenated vector of the identity attribute vector and the attention encoding vector of the user's access behavior path. For feature f... i Remove the feature f from the attribute vectors of datasets B and D. i Take part of it, keep the rest, and get dataset B. i and dataset D i Where i∈[1,3+M4], and the initial value of i is 1, dataset B i The processed result of dataset B, dataset D i The result after processing dataset D; using dataset B i The attribute vectors and access control feedback results in the training process are used to obtain the deleted feature f. i base classifier g i The base classifier g i The input is a concatenated vector, where the concatenated vector is the vector after removing features f. i The concatenation of the identity attribute vector and the attention encoding processing vector corresponding to the user access behavior path results in a classification result {0,1}, where 0 corresponds to operation failure (access control prohibited) and 1 corresponds to operation success (access control allowed). The dataset D is then processed. i Remove feature f from the middle i The concatenated vectors of the parts are used as the base classifier g. i The input value, where the concatenated vector is the feature f removed. i The concatenation result of the identity attribute vector and the attention encoding processing vector corresponding to the user access behavior path, combined with the base classifier g i The base classifier g is calculated from the output results and access control feedback results. i The classification accuracy will be determined by the base classifier g. i The result of (1 - classification accuracy) is used as feature f i The importance of each feature is considered; the M features with the highest importance are selected as the attribute vector filtering results, and the selected results are used to form the access control policy generation attribute set {r}. m |m∈[1,M]}, where r mThis represents the m-th attribute vector in the access control policy generation attribute set. If the constructed access control policy generation attribute set does not contain an attribute vector representing the identity attribute, then the feature with the highest importance among features f1, f2, and f3 is selected as the M-th feature in the access control policy generation attribute set. This scheme constructs a base classifier by filtering one attribute vector at a time based on the extracted identity attribute vector representing user attributes and resource attribute vectors representing multiple access behavior operation nodes. The base classifier is used to predict user access behavior vectors, obtaining the prediction classification accuracy of the access control feedback result after deleting the attribute vector. A lower accuracy indicates a greater impact of the attribute vector on the base classifier, meaning a more significant impact on the access control feedback result, and thus a greater importance for the attribute vector. The more important attribute vectors are selected as the access control policy generation attribute set, and a policy generation tree is constructed based on this set. This ensures the accuracy of the generated policies while making the generated access control policies more concise.

[0075] Meanwhile, this scheme proposes a strategy spanning tree construction method, wherein the construction process of the strategy spanning tree is as follows: Using access control content as the root node, T strategy spanning trees are constructed, where T represents the number of access control content types. For the t-th strategy spanning tree, its root node is root(t), t∈[1,T], and the root node is the first level of the strategy spanning tree; Traversing the effective user access behavior paths of N users, the prefix attribute vector of the root node root(t) is obtained, and the access behavior operation node corresponding to the prefix attribute vector is taken as the second-level child node of the strategy spanning tree, where the effective user access behavior path represents the path where the access control feedback result is 1; For the U-th level child node of the strategy spanning tree, in the user access of N users... The prefix attribute vector of the U-th level child node is obtained by traversing the behavior path. The access behavior operation node corresponding to the prefix attribute vector is taken as the U+1-th level child node of the policy generation tree. The U-th level child node is connected to the access behavior operation node corresponding to the prefix attribute vector. The weight of the connecting line segment is the attribute entropy value of the prefix attribute vector with respect to the attribute vector corresponding to the U-th level child node, where the minimum value of U is 3. Let U = U+1, and repeat the previous step until the prefix attribute vector can no longer be obtained by traversing. The identity attribute vector in the access control policy generation attribute set is taken as the leaf node and connected to the last level child node. The weight of the connecting line segment is: 1 - the frequency of the last level child node in the user access behavior path of N users. This solution calculates the attribute entropy value of the attribute vectors in the attribute set for generating access control policies. A policy generation tree is constructed based on the calculated attribute entropy value, using it as the weight for connecting different nodes. A larger attribute entropy value indicates a greater difference between the prefix and suffix nodes associated with a node, leading to a higher probability of conflicts between access control operation nodes and a greater number of associated access control content types. This results in overly complex and misleading access control policies. Therefore, the policy generation tree is constructed with access control content as the root node, access control policies as nodes, and identity attributes as leaf nodes. During access control policy generation, the tree traverses upwards from the leaf nodes, selecting the path with the lowest weight until the root node is reached, thereby reducing the misleading nature of the generated policies for users. Attached Figure Description

[0076] Figure 1 This is a flowchart illustrating an intelligent generation and management method for access control policies according to an embodiment of the present invention.

[0077] Figure 2 This is a schematic diagram of the structure of an electronic device that implements an intelligent generation and management method for access control policies, according to an embodiment of the present invention.

[0078] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0079] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0080] This application provides an intelligent generation and management method for access control policies. The executing entity of this intelligent generation and management method includes, but is not limited to, at least one of the following electronic devices that can be configured to execute the method provided in this application: a server, a terminal, etc. In other words, the intelligent generation and management method for access control policies can be executed by software or hardware installed on a terminal device or a server device, and the software can be a blockchain platform. The server includes, but is not limited to, a single server, a server cluster, a cloud server, or a cloud server cluster.

[0081] Example 1:

[0082] S1: Collect historical data of user access behavior and perform vectorization to obtain user access behavior vectors.

[0083] The S1 step involves collecting historical user access behavior data, including:

[0084] Collect historical access behavior data from N users, where the historical access behavior data of the nth user is in the following format:

[0085] x n =(ID) n ,w n ,L n )

[0086] ID n =(age n sex n ,post n )

[0087] w n =(w n (1),w n (2),...,w n (j),...,w n (num n ))

[0088] L n =(S n ,sgn n )

[0089] in:

[0090] x n This represents the historical access behavior data of the nth user, where n∈[1,N];

[0091] IDn This represents the identity attributes of the nth user, including age. n Sex n and job level post n ;

[0092] w n =(w n (1),w n (2),...,w n (j),...,w n (num n )) represents the access behavior path of the nth user, w n (j) represents the access behavior path w n The j-th access behavior operation node in the num n Indicates the access behavior path w n The total number of nodes involved in the access behavior;

[0093] L n S represents the access control result for the nth user. n sgn represents the access control content for the nth user. n =

[0094] {0,1} indicates that the access control content S is... n System feedback, sgn n =0 indicates operation failure, access control is disabled, sgn n =1 indicates that the operation was successful and access control was allowed.

[0095] The vectorization process for historical user access behavior data in step S1 includes:

[0096] The historical user access behavior data is vectorized, and the vectorization process is as follows:

[0097] S11: Use binary encoding to encode the age in the user identity attribute, use {0,1} to encode the gender in the user identity attribute, where 0 represents female and 1 represents male, and use the one-hot encoding method to encode the job level in the user identity attribute, thus obtaining the user identity attribute vector.

[0098] The identity attribute vector of the nth user is: v(ID) n )=(v(age n ),v(sex n ),v(post n v(·) represents the encoding of identity attributes;

[0099] S12: Encode all access behavior operation nodes using the one-hot encoding method. The one-hot encoding representation of the access behavior operation node for the nth user's access behavior path is as follows: in For w n (num n The one-hot encoding of c represents the result. n The result of the one-hot encoding representation of the access behavior path of the nth user;

[0100] S13: The one-hot encoding representation of the user access behavior path is encoded using the Transformer model, incorporating an attention mechanism, where c n The attention encoding processing formula is:

[0101] C n =Q n ·[ReLU(V n ·A n )]

[0102] Q n =W Q ·c n V n =W V ·c n A n =W A ·c n

[0103] in:

[0104] W Q W V W A This represents the weight matrix in the Transformer model;

[0105] C n c n Attention encoding processing vector, C n =[C n (1),C n (2),...,C n (j),...,C n (num n )], C n (j) is the access behavior operation node w n (j) The attention encoding result of the nth user.

[0106] S2: Extract the attribute vectors from the user access behavior vectors, use the access control feedback results as labels for the attribute vectors, and use a recursive elimination method to filter the attribute vectors to obtain the access control policy generation attribute set.

[0107] In step S2, the access control feedback result is used as a label for the attribute vector, and the attribute vector is filtered using a recursive elimination method, including:

[0108] Attribute vectors are extracted from user access behavior vectors. These extracted attribute vectors include identity attribute vectors, one-hot encoded representations of different access behavior operation nodes, and attention-encoded processing vectors of the user access behavior path. Access control feedback results are used as labels for the attribute vectors. The attribute vector extraction result for the nth user is as follows:

[0109] (v(ID n ),c n C n ,sgn n )

[0110] The attribute vector filtering is performed using a recursive elimination method, and the attribute filtering process is as follows:

[0111] S21: Organize the binary encoding representations and one-hot encoding representations of identity attribute vectors, access behavior operation nodes, and obtain M1 binary encoding representations of age, M2 binary encoding representations of gender, M3 one-hot encoding representations of job level, and M4 one-hot encoding representations of access behavior operation nodes.

[0112] S22: The binary encoding representations of M1 types of age, M2 types of gender, and M3 types of job level are respectively treated as features f1, f2, and f3, where f1 represents the age feature, f2 represents the gender feature, and f3 represents the job level feature. Each of the M4 types of access behavior operation nodes is also treated as a feature. in This represents the characteristics of the operation node for the M4th type of access behavior;

[0113] S23: Divide the collected attribute vectors of N users and access control feedback results into dataset B and dataset D, where dataset B contains... The dataset D contains the attribute vectors of named users and access control feedback results. The attribute vectors of each user and the access control feedback results are as follows: the attribute vector of each user in the dataset is a concatenated vector of the identity attribute vector and the attention encoding processing vector of the user access behavior path.

[0114] S24: For feature f i Remove the feature f from the attribute vectors of datasets B and D. i Take part of it, keep the rest, and get dataset B. i and dataset D iWhere i∈[1,3+M4], and the initial value of i is 1, dataset B i The processed result of dataset B, dataset D i This is the result of processing dataset D;

[0115] S25: Using dataset B i The attribute vectors and access control feedback results in the training process are used to obtain the deleted feature f. i base classifier g i The base classifier g i The input is a concatenated vector, where the concatenated vector is the vector after removing features f. i The concatenation result of the identity attribute vector and the attention encoding processing vector corresponding to the user access behavior path is output as the classification result {0,1}, where 0 corresponds to operation failure and access control is prohibited, and 1 corresponds to operation success and access control is allowed.

[0116] The base classifier is structured as a support vector machine model, and the base classifier g... i The training objective function F(g) i )for:

[0117]

[0118]

[0119] in:

[0120] Represents dataset B i The access control feedback result for the k-th user. Represents dataset B i The concatenated vector of the k-th user;

[0121] q i Represents the base classifier g i The linear weights of the hyperplane constructed in the middle, b i Indicates the bias amount;

[0122] S26: Transfer dataset D i Remove feature f from the middle i The concatenated vectors of the parts are used as the base classifier g. i The input value, where the concatenated vector is the feature f removed. i The concatenation result of the identity attribute vector and the attention encoding processing vector corresponding to the user access behavior path, combined with the base classifier g u The base classifier g is calculated from the output results and access control feedback results. i The classification accuracy will be determined by the base classifier g. i The result of (1 - classification accuracy) is used as feature f iThe degree of importance;

[0123] Let i = i + 1, return to step S24, until i = 3 + M4;

[0124] S27: Select the M features with the highest importance as the attribute vector filtering results, and use the selected results to form an access control policy to generate the attribute set {r}. m |m∈[1,M]}, where r m This represents the m-th attribute vector in the access control policy generation attribute set. If the constructed access control policy generation attribute set does not contain an attribute vector for the identity attribute, then the feature with the highest importance among features f1, f2, and f3 is selected as the M-th feature in the access control policy generation attribute set.

[0125] S3: Calculate the attribute entropy value of the attribute vector in the attribute set of access control policy generation, and construct the policy generation tree based on the calculated attribute entropy value.

[0126] Step S3 involves calculating the attribute entropy value of the attribute vector in the attribute set generated by the access control policy, including:

[0127] The attribute entropy value is calculated for the attribute vectors in the attribute set generated by the access control policy. The calculation process for the attribute entropy value is as follows:

[0128] For any attribute vector r that is not an identity attribute s r is obtained by traversing the user access behavior paths of N users. s prefix attribute vector r s′ , where r s The corresponding access behavior operation nodes w(s) and r s′ The corresponding access behavior operation node w(s) ′ In the user access behavior paths of N users, (w(s) ′ The form ),w(s)) existed before, r s′ In the access control policy generation attribute set, then r s′ For r s The attribute entropy value μ(r) s′ ,r S )for:

[0129]

[0130] in:

[0131] P(r s′ ) represents r s′ The frequency of the corresponding access behavior operation node appearing in the user access behavior paths of N users;

[0132] count1(rs′ ) represents r s′ The number of suffix attribute vector types of the corresponding access behavior operation node in the user access behavior paths of N users, count2(r s ) represents r s The number of prefix attribute vector types in the user access behavior paths of N users corresponding to the access behavior operation node, where all attribute vectors belong to the access control policy generation attribute set.

[0133] Step S3, which involves constructing a strategy-generated tree based on the attribute entropy value, includes:

[0134] A policy generation tree is constructed based on the attribute entropy values. The construction process of the policy generation tree is as follows:

[0135] S31: Using the access control content as the root node, construct T policy spanning trees, where T represents the number of access control content types. For the t-th policy spanning tree, its root node is root(t), t∈[1,T], and the root node is the first level of the policy spanning tree.

[0136] S32: Traverse the valid user access behavior paths of N users to obtain the prefix attribute vector of the root node root(t), and take the access behavior operation node corresponding to the prefix attribute vector as the second-level child node of the policy generation tree, where the valid user access behavior path represents the path where the access control feedback result is 1.

[0137] S33: For the U-th level child node of the strategy spanning tree, traverse the user access behavior paths of N users to obtain the prefix attribute vector of the U-th level child node, and take the access behavior operation node corresponding to the prefix attribute vector as the U+1 level child node of the strategy spanning tree. Connect the U-th level child node with the access behavior operation node corresponding to the prefix attribute vector. The weight of the connecting line segment is the attribute entropy value of the prefix attribute vector with respect to the attribute vector corresponding to the U-th level child node, where the minimum value of U is 3.

[0138] S34: Let U = U+1, repeat step S34 until the prefix attribute vector cannot be obtained through traversal, and use the identity attribute vector in the access control policy generation attribute set as the leaf node, connect it with the last layer child node, and the weight of the connecting line segment is: 1 - the frequency of the last layer child node in the user access behavior path of N users, and set the threshold th of the leaf node. When the identity attribute of the user to be accessed meets the threshold, the access control policy is generated. The threshold th of the leaf node means that in the user access behavior data of the collected N users, the system feedback of the user with identity attribute th is 1 for this type of access control content.

[0139] S4: Intelligent generation of access control policies based on policy spanning tree.

[0140] The S4 step utilizes a policy spanning tree to intelligently generate access control policies, including:

[0141] Obtain the user identity attributes and access control content type of the user to be accessed, and generate access control policies using a policy spanning tree. The access control policy generation process is as follows:

[0142] Select the policy generation tree corresponding to the access control content type of the user to be accessed, and determine whether the user identity attribute meets the threshold of the leaf node of the policy generation tree. If it does, proceed to step S42; otherwise, stop the generation of access control policy.

[0143] Starting from a leaf node, the lowest weight connection segment is selected sequentially to reach the next level child node, and the child node is used as the policy step of the access control policy, until the root node is reached and the complete access control policy is obtained.

[0144] Example 2:

[0145] like Figure 2 The diagram shown is a structural schematic of an electronic device that implements an intelligent generation and management method for access control policies according to an embodiment of the present invention.

[0146] The electronic device 1 may include a processor 10, a memory 11, a communication interface 13 and a bus, and may also include a computer program, such as program 12, stored in the memory 11 and executable on the processor 10.

[0147] The memory 11 includes at least one type of readable storage medium, such as flash memory, portable hard drive, multimedia card, card-type memory (e.g., SD or DX memory), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 11 can be an internal storage unit of the electronic device 1, such as a portable hard drive. In other embodiments, the memory 11 can be an external storage device of the electronic device 1, such as a plug-in portable hard drive, Smart Media Card (SMC), Secure Digital (SD) card, Flash Card, etc., equipped on the electronic device 1. Furthermore, the memory 11 can include both internal and external storage units of the electronic device 1. The memory 11 can be used not only to store application software and various types of data installed on the electronic device 1, such as the code of program 12, but also to temporarily store data that has been output or will be output.

[0148] In some embodiments, the processor 10 may be composed of integrated circuits, such as a single packaged integrated circuit or multiple integrated circuits with the same or different functions, including combinations of one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and various control chips. The processor 10 is the control unit of the electronic device, connecting various components of the entire electronic device through various interfaces and lines. It executes programs or modules stored in the memory 11 (such as the program 12 for intelligent generation and management of access control policies) and calls data stored in the memory 11 to perform various functions of the electronic device 1 and process data.

[0149] The communication interface 13 may include a wired interface and / or a wireless interface (such as a Wi-Fi interface, a Bluetooth interface, etc.), which is typically used to establish communication connections between the electronic device 1 and other electronic devices, and to enable communication between internal components of the electronic device.

[0150] The bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This bus can be divided into an address bus, a data bus, a control bus, etc. The bus is configured to enable communication between the memory 11 and at least one processor 10, etc.

[0151] Figure 2 Only electronic devices with components are shown; it will be understood by those skilled in the art that... Figure 2 The structure shown does not constitute a limitation on the electronic device 1, and may include fewer or more components than shown, or combine certain components, or have different component arrangements.

[0152] For example, although not shown, the electronic device 1 may also include a power supply (such as a battery) to power various components. Preferably, the power supply can be logically connected to the at least one processor 10 through a power management device, thereby enabling functions such as charging management, discharging management, and power consumption management. The power supply may also include one or more DC or AC power supplies, recharging devices, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components. The electronic device 1 may also include various sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be described in detail here.

[0153] Optionally, the electronic device 1 may further include a user interface, which may be a display, an input unit (such as a keyboard), or a standard wired or wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an OLED (Organic Light-Emitting Diode) touchscreen. The display may also be appropriately referred to as a screen or display unit, used to display information processed in the electronic device 1 and to display a visual user interface.

[0154] It should be understood that the embodiments described are for illustrative purposes only and are not limited to this structure in the scope of the patent application.

[0155] The program 12 stored in the memory 11 of the electronic device 1 is a combination of multiple instructions, which, when run in the processor 10, can achieve the following:

[0156] Collect historical user access behavior data and perform vectorization to obtain user access behavior vectors;

[0157] Extract the attribute vectors from the user access behavior vectors, use the access control feedback results as labels for the attribute vectors, and use a recursive elimination method to filter the attribute vectors to obtain the access control policy generation attribute set.

[0158] Calculate the attribute entropy value of the attribute vector in the attribute set of access control policy generation, and construct the policy generation tree based on the calculated attribute entropy value;

[0159] Intelligent generation of access control policies based on policy spanning tree.

[0160] Specifically, the processor 10's implementation method for the above instructions can be found in [reference needed]. Figures 1 to 2 The descriptions of the relevant steps in the corresponding embodiments are not repeated here.

[0161] It should be noted that the sequence numbers of the above embodiments of the present invention are merely for descriptive purposes and do not represent the superiority or inferiority of the embodiments. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, apparatus, article, or method that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, apparatus, article, or method. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, apparatus, article, or method that includes that element.

[0162] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0163] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A method for intelligent generation and management of access control policies, characterized in that, The method includes: S1: Collect historical data of user access behavior and perform vectorization to obtain user access behavior vectors; S2: Extract the attribute vectors from the user access behavior vectors, use the access control feedback results as labels for the attribute vectors, and use the recursive elimination method to filter the attribute vectors to obtain the access control policy generation attribute set. S3: Calculate the attribute entropy value of the attribute vector in the attribute set of access control policy generation, and construct the policy generation tree based on the calculated attribute entropy value; The process of constructing the strategy spanning tree is as follows: S31: Using the access control content as the root node, construct T policy spanning trees, where T represents the number of access control content types. For the t-th policy spanning tree, its root node is... , The root node is the first level of the strategy spanning tree; S32: Obtain the root node by traversing the valid user access behavior paths of N users. The prefix attribute vector is used, and the access behavior operation node corresponding to the prefix attribute vector is used as the second-level child node of the policy generation tree. The effective user access behavior path represents the path where the access control feedback result is 1. S33: For the U-th level child node of the strategy spanning tree, traverse the user access behavior paths of N users to obtain the prefix attribute vector of the U-th level child node, and take the access behavior operation node corresponding to the prefix attribute vector as the U+1 level child node of the strategy spanning tree. Connect the U-th level child node with the access behavior operation node corresponding to the prefix attribute vector. The weight of the connecting line segment is the attribute entropy value of the prefix attribute vector with respect to the attribute vector corresponding to the U-th level child node, where the minimum value of U is 3. S34: Let U = U + 1, repeat step S33 until it is impossible to traverse and obtain the prefix attribute vector. Then, take the identity attribute vector in the access control policy generation attribute set as the leaf node and connect it with the last layer child node. The weight of the connecting line segment is: 1 - the frequency of the last layer child node in the user access behavior path of N users. Set the threshold th of the leaf node. When the identity attribute of the user to be accessed meets the threshold, the access control policy is generated. S4: Intelligent generation of access control policies based on policy spanning tree.

2. The intelligent generation and management method for access control policies as described in claim 1, characterized in that, The S1 step involves collecting historical user access behavior data, including: Collect historical access behavior data from N users, where the historical access behavior data of the nth user is in the following format: in: This represents the historical access behavior data of the nth user. ; This represents the identity attributes of the nth user, including age. ,gender and job level ; This represents the access behavior path of the nth user. Indicates the access behavior path The j-th access behavior operation node in the process, Indicates the access behavior path The total number of nodes involved in the access behavior; This indicates the access control result for the nth user. This represents the access control content for the nth user. Indicates access control content The system feedback, This indicates that the operation failed and access control was denied. This indicates that the operation was successful and access control is enabled.

3. The intelligent generation and management method for access control policies as described in claim 2, characterized in that, The vectorization process for historical user access behavior data in step S1 includes: The historical user access behavior data is vectorized, and the vectorization process is as follows: S11: Use binary encoding to encode and represent the age in the user's identity attribute. The gender in the user identity attribute is encoded and represented, where 0 represents female and 1 represents male. The job level in the user identity attribute is encoded and represented using the one-hot encoding method, resulting in a user identity attribute vector. S12: Encode all access behavior operation nodes using the one-hot encoding method. The one-hot encoding representation of the access behavior operation node for the nth user's access behavior path is as follows: ,in for The one-hot encoding represents the result. The result of the one-hot encoding representation of the access behavior path of the nth user; S13: The one-hot encoding representation of the user access behavior path is processed using the Transformer model, incorporating an attention mechanism for encoding. The attention encoding processing formula is: in: This represents the weight matrix in the Transformer model; express Attention encoding processing vectors, , Access behavior operation node The attention encoding result for the nth user.

4. The intelligent generation and management method for access control policies as described in claim 1, characterized in that, In step S2, the access control feedback result is used as a label for the attribute vector, and the attribute vector is filtered using a recursive elimination method, including: Extract attribute vectors from user access behavior vectors. The extracted attribute vectors include identity attribute vectors, one-hot encoded representations of different access behavior operation nodes, and attention encoding processing vectors of user access behavior paths. Access control feedback results are used as labels for attribute vectors. The attribute vector filtering is performed using a recursive elimination method, and the attribute filtering process is as follows: S21: The binary encoding representation and one-hot encoding representation of the identity attribute vector and access behavior operation node are organized to obtain... Binary encoding representation of age Binary representation of sex One-hot encoding representation of job level and One-hot encoding representation of the access behavior operation node; S22: Will Binary encoding representation of age Binary encoding representation of sex and The one-hot encoding of each job level is represented as a feature. ,in Indicates age characteristics, Indicates gender characteristics, Indicate job level characteristics, and Each access behavior operation node in the access behavior operation node is considered as a feature. ,in Indicates the first Characteristics of access behavior operation nodes; S23: Divide the collected attribute vectors of N users and access control feedback results into dataset B and dataset D, where dataset B contains... The dataset D contains the attribute vectors of named users and access control feedback results. The attribute vectors of each user and the access control feedback results are as follows: the attribute vector of each user in the dataset is a concatenated vector of the identity attribute vector and the attention encoding processing vector of the user access behavior path. S24: For features Remove the descriptive features from the attribute vectors of datasets B and D. Take one part, keep the other parts, and get the dataset. and dataset ,in , The initial value is 1, and the dataset This is the processed result of dataset B. This is the result of processing dataset D; S25: Utilizing the dataset The attribute vectors and access control feedback results in the training process are used to obtain the deleted features. base classifier The base classifier The input is a concatenated vector, where the concatenated vector is the vector with features removed. The concatenation of the identity attribute vector and the attention encoding vector corresponding to the user access behavior path is output as the classification result. 0 indicates that the operation failed and access control is prohibited, while 1 indicates that the operation succeeded and access control is allowed. The base classifier is structured as a support vector machine model. training objective function for: in: Represents the dataset The access control feedback result for the k-th user. Represents the dataset The concatenated vector of the k-th user; Representation base classifier The linear weights of the hyperplane constructed in the process, Indicates the bias amount; S26: Transfer the dataset Remove features Partially concatenated vectors are used as base classifiers The input values, where the concatenated vector is the feature-removed vector. The concatenation result of the identity attribute vector and the attention encoding processing vector corresponding to the user access behavior path, combined with the base classifier. The base classifier is calculated from the output results and access control feedback results. The classification accuracy will be determined by the base classifier. The result of (1 - classification accuracy) is used as a feature. The degree of importance; make Return to step S24 until... ; S27: Select the M features with the highest importance as the attribute vector filtering results, and use the selected results to form the access control policy to generate the attribute set. ,in This represents the m-th attribute vector in the access control policy generation attribute set; if the constructed access control policy generation attribute set does not contain an attribute vector for the identity attribute, then a feature is selected. The feature with the highest importance is selected as the Mth feature in the set of attributes generated by the access control policy.

5. The intelligent generation and management method for access control policies as described in claim 4, characterized in that, Step S3 involves calculating the attribute entropy value of the attribute vector in the attribute set generated by the access control policy, including: The attribute entropy value is calculated for the attribute vectors in the attribute set generated by the access control policy. The calculation process for the attribute entropy value is as follows: For any attribute vector that is not an identity attribute By traversing the user access behavior paths of N users, we can obtain... prefix attribute vector ,in Corresponding access behavior operation node and Corresponding access behavior operation node In the user access behavior paths of N users It existed in that form. In the access control policy generation attribute set, then for attribute entropy value for: in: express The frequency of the corresponding access behavior operation node appearing in the user access behavior paths of N users; express The number of suffix attribute vector types corresponding to the access behavior operation node in the user access behavior paths of N users. express The number of prefix attribute vector types of the corresponding access behavior operation node in the user access behavior path of N users.

6. The intelligent generation and management method for access control policies as described in claim 1, characterized in that, The S4 step utilizes a policy spanning tree to intelligently generate access control policies, including: Obtain the user identity attributes and access control content type of the user to be accessed, and generate access control policies using a policy spanning tree. The access control policy generation process is as follows: S41: Select the policy generation tree corresponding to the access control content type of the user to be accessed, and determine whether the user identity attribute meets the threshold of the leaf node of the policy generation tree. If it does, proceed to step S42; otherwise, stop the generation of access control policy. S42: Starting from the leaf node, select the connecting segments with the lowest weights to reach the next level child node, and use the child nodes as the policy steps of the access control policy, until the root node is reached and the complete access control policy is obtained.

Images