Business data dynamic access control method, device, electronic device and medium

Abstract

The embodiments of the present disclosure disclose a method, device, electronic device and medium for dynamic access control of business data. A specific implementation of the method includes: parsing data request information to obtain parsed data request information; matching user attribute information and user attribute access policy set to obtain a matching result set; generating user access logs; performing abnormal behavior detection on user access logs to obtain abnormal behavior detection results; determining the target user attribute information and encrypted business data that have changed; updating user attribute access policy and encrypted business data set to obtain an updated user attribute access policy set and an updated encrypted business data set; and dynamically performing access control on the updated encrypted business data set and the unupdated encrypted business data set. This implementation can improve the security of business data and the granularity and accuracy of access rights, and realize full-process secure access control from data encryption to access control.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the field of computer technology, and in particular to a method, device, electronic device, and medium for dynamic access control of business data. Background Art

[0002] A data warehouse is a database that classifies and stores data based on differences in data structure. With the development of big data technology, data warehouses have become a storage method for enterprises and individuals to store rapidly growing data. However, the security of data in data warehouses and the secure access of user-end users to data in data warehouses are becoming more and more concerned. For dynamic access control of business data, the method usually adopted is to use symmetric encryption algorithms to perform access control on data request information sent by the user end.

[0003] However, it is found in practice that when the above method is used to dynamically control access to business data, the following technical problems often occur: Since the symmetric encryption algorithm can only realize one-to-one encryption and decryption with business data, different keys are generated for different users, resulting in an increase in the amount of encryption and decryption operations, leading to a waste of computing resources and a heavy computing load on the data warehouse server, as well as increasing the time and complexity of users accessing data in the data warehouse, reducing the user experience.

[0004] In the process of adopting technical solutions to solve the above technical problem 1, the following technical problem 2 is often accompanied: how to control the user end to perform fine-grained access control on the business privacy data stored in the data warehouse. For the above technical problem 2, the conventional solution is generally: define the access rights of business privacy data through static access rules or policies formulated by expert experience, and control the user end's access to business data in the data warehouse through the access rights. However, the above conventional solutions still have the following problems: since the artificially set access control is not real-time and coarse-grained, the accuracy of access control is low, the security of the data stored in the data warehouse is low, and the user experience is low.

[0005] In the process of adopting technical solutions to solve the above-mentioned technical problem one, the following technical problem three is often accompanied: how to accurately identify privacy data from business data sets during data encryption. For the above-mentioned technical problem three, the conventional solution is generally: first, the privacy field name of the privacy data is determined by expert experience, and the privacy similarity between the structured business data set and the privacy field name is determined to obtain a privacy similarity value. Then, the business data set corresponding to at least one privacy similarity value greater than or equal to the preset similarity threshold is determined as privacy data. However, the above-mentioned conventional solution still has the following problems: due to the limitations of the privacy field names determined by expert experience, the coverage is not comprehensive enough, and it is easy to miss and misidentify, resulting in low accuracy in privacy data identification, low security of privacy data, and low stability and security of the data warehouse.

[0006] The above information disclosed in this Background section is only for enhancement of understanding of the background of the present disclosure concept and therefore it may contain information that does not form the prior art that is already known in this country to a person of ordinary skill in the art. Summary of the invention

[0007] The content of this disclosure is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The content of this disclosure is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0008] Some embodiments of the present disclosure propose a method, device, electronic device, and medium for dynamic access control of business data to solve one or more of the technical problems mentioned in the above background technology section.

[0009] In a first aspect, some embodiments of the present disclosure provide a method for dynamic access control of business data, comprising: in response to receiving data request information sent by a user terminal, parsing the data request information to obtain parsed data request information; matching the user attribute information corresponding to the parsed data request information with each user attribute access policy in a user attribute access policy set to obtain a matching result set, wherein the user attribute access policy in the user attribute access policy set is a required policy for user attributes set for the user terminal to access data in a data warehouse; generating a user access log based on the matching result set; performing abnormal behavior detection on the user access log to obtain an abnormal behavior detection result; in response to determining that the abnormal behavior detection result indicates that the user access behavior is normal, determining a target user attribute information set and an encrypted business data set. whether a change occurs, wherein the target user attribute information set and the encrypted business data set are respectively data sets stored in a data warehouse; in response to determining that the target user attribute information set and the encrypted business data set have changed, determining each target user attribute information and each encrypted business data that have changed as a changed user attribute information set and a business change data set; updating the user attribute access policy set corresponding to the changed user attribute information set and the business change data set to obtain an updated user attribute access policy set and an updated encrypted business data set; performing dynamic access control on the updated encrypted business data set and the unupdated encrypted business data set according to the updated user attribute access policy set and the unupdated user attribute access policy set, and sending the user business data set corresponding to the data request information to the user end.

[0010] In a second aspect, some embodiments of the present disclosure provide a business data dynamic access control device, including: a parsing unit, configured to parse the data request information in response to receiving data request information sent by a user terminal, and obtain parsed data request information; a matching unit, configured to match the user attribute information corresponding to the parsed data request information with each user attribute access policy in a user attribute access policy set, and obtain a matching result set, wherein the user attribute access policy in the user attribute access policy set is a required policy for the user attribute of the user terminal accessing data in a data warehouse; a generating unit, configured to generate a user access log according to the matching result set; an abnormal behavior detection unit, configured to perform abnormal behavior detection on the user access log, and obtain an abnormal behavior detection result; a first determining unit, configured to determine the target user attribute information in response to determining that the abnormal behavior detection result indicates that the user access behavior is normal. a determination unit configured to determine, in response to determining that the target user attribute information set and the encrypted business data set have changed, each target user attribute information and each encrypted business data set that has changed as a changed user attribute information set and a business change data set; an updating unit configured to update the user attribute access policy set and the business change data set corresponding to the changed user attribute information set to obtain an updated user attribute access policy set and an updated encrypted business data set; a dynamic access control unit configured to perform dynamic access control on the updated encrypted business data set and the unupdated encrypted business data set according to the updated user attribute access policy set and the unupdated user attribute access policy set, and send the user business data set corresponding to the data request information to the user end.

[0011] In a third aspect, some embodiments of the present disclosure provide an electronic device comprising: one or more processors; a storage device on which one or more programs are stored, and when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation manner in the first aspect.

[0012] In a fourth aspect, some embodiments of the present disclosure provide a computer-readable medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the method described in any implementation manner in the first aspect is implemented.

[0013] The above-mentioned embodiments of the present disclosure have the following beneficial effects: the business data dynamic access control method of some embodiments of the present disclosure can improve the security of business data and the granularity and accuracy of access rights, and realize the full-process security access control from data encryption to access control. Specifically, the waste of computing resources and large computing load of the relevant data warehouse server, as well as the increase in the time and complexity of users accessing data in the data warehouse, reduce the user experience because: since the symmetric encryption algorithm can only realize one-to-one encryption and decryption with business data, different keys are generated for different users, resulting in an increase in the amount of encryption and decryption operations, resulting in a waste of computing resources and large computing load of the data warehouse server, as well as the increase in the time and complexity of users accessing data in the data warehouse, reduce the user experience. Based on this, the business data dynamic access control method of some embodiments of the present disclosure can first, in response to receiving the data request information sent by the user end, parse the above data request information to obtain the parsed data request information. Here, parsing the request information can determine the user identity information, which is convenient for subsequent verification of the identity information of the user end. Secondly, the user attribute information corresponding to the above-mentioned parsed data request information and each user attribute access policy in the user attribute access policy set are matched to obtain a matching result set, wherein the user attribute access policy in the above-mentioned user attribute access policy set is the required policy for the user attribute of the user terminal accessing the data in the data warehouse. Here, the user attribute access policy can be the access policy corresponding to multiple user terminals, which reduces the amount of calculation of the data warehouse server and simplifies the access complexity. The matching process can determine whether the above-mentioned user terminal meets the set access policy to determine whether the subsequent user terminal is qualified to access the business data, which can improve the security of the business data set. Thirdly, based on the above-mentioned matching result set, a user access log is generated. Here, the generated access log can record the access process of the user accessing the business data, which is convenient for data tracing and determining the user access behavior. Next, the above-mentioned user access log is subjected to abnormal behavior detection to obtain the abnormal behavior detection result. Here, the abnormal behavior detection can determine whether the access behavior of the user terminal is abnormal, which is convenient for improving the security of the business data and the security of the data warehouse server. Subsequently, in response to determining that the abnormal behavior detection result indicates that the user access behavior is normal, it is determined whether the target user attribute information set and the encrypted business data set have changed, wherein the target user attribute information set and the encrypted business data set are respectively data sets stored in the data warehouse. Here, it is convenient to subsequently determine the change of the target user attribute information set and the business data set. Afterwards, in response to determining that the target user attribute information set and the encrypted business data set have changed, each target user attribute information and each encrypted business data set that has changed is determined as the changed user attribute information set and the business change data set.Here, it is used to subsequently update the changed user attribute information set and the business change data set, so as to adjust and limit the access rights of the user end in real time, improve the accuracy of the user access rights and the security of the data. Then, the user attribute access policy set corresponding to the above-mentioned changed user attribute information set and the above-mentioned business change data set are updated to obtain the updated user attribute access policy set and the updated encrypted business data set. Here, the access rights of the user end can be updated in real time to adapt to the dynamically changing environment to ensure the stability of the data warehouse server and improve the security of the business data. Finally, according to the above-mentioned updated user attribute access policy set and the unupdated user attribute access policy set, the above-mentioned updated encrypted business data set and the unupdated encrypted business data set are dynamically access controlled, and the user business data set corresponding to the above-mentioned data request information is sent to the above-mentioned user end. Here, the security access control of the whole life cycle from encrypted business data to user end access can be improved, the security of the business data stored in the data warehouse and the real-time of user access can be improved, and the user access efficiency and experience can be improved. It can be concluded that the business data dynamic access control method can improve the security of business data sets by encrypting business data sets based on user attribute information, and grant dynamic user access policies for multiple users to access the same business data, which can reduce the amount of computing on the data warehouse server and reduce the computing load, improve the granularity and accuracy of user access control, and achieve full-process secure access throughout the entire life cycle from business data to user-side access, thereby improving the user's access experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0015] Figure 1 is a flow chart of some embodiments of the method for dynamic access control of business data according to the present disclosure;

[0016] Figure 2 is a schematic diagram of the structure of some embodiments of the business data dynamic access control device according to the present disclosure;

[0017] Figure 3 It is a schematic diagram of the structure of an electronic device suitable for implementing some embodiments of the present disclosure. DETAILED DESCRIPTION

[0018] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0019] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present disclosure can be combined with each other.

[0020] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0021] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0022] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0023] The present disclosure will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0024] Figure 1 The process 100 of some embodiments of the business data dynamic access control method according to the present disclosure is shown. The business data dynamic access control method includes the following steps:

[0025] Step 101, in response to receiving data request information sent by a user terminal, the data request information is parsed to obtain parsed data request information.

[0026] In some embodiments, the execution subject (e.g., electronic device) of the above-mentioned business data dynamic access control method can parse and process the above-mentioned data request information in response to receiving the data request information sent by the user terminal, and obtain the parsed data request information. Among them, the above-mentioned user terminal can be a server that sends data request information. The above-mentioned data request information can be a request information for a user to access data stored on a data warehouse server. The above-mentioned parsed data request information can be information containing user identity information, request content, and request protocol version information. In practice, the above-mentioned execution subject can use a data parser to parse and process the data request information in response to receiving the data request information sent by the user terminal, and obtain the parsed data request information. Among them, the above-mentioned data parser can be a JSON (JavaScript Object Notation, JS object notation) parser.

[0027] Optionally, before the above-mentioned data request information is parsed in response to receiving the data request information from the user terminal to obtain the parsed data request information, the above-mentioned method may further include the following steps:

[0028] The first step is to identify the privacy data of the above-mentioned business data set to obtain a business privacy data set. Among them, the business privacy data in the above-mentioned business privacy data set may be data that may cause harm to individuals or society after data leakage. For example, the above-mentioned business privacy data set may include but is not limited to at least one of the following: user ID number, address, telephone, bank account number, password, email address. In practice, the above-mentioned execution entity may first build a privacy database through expert experience. Then, determine the semantic similarity value set of the above-mentioned business data set and the privacy data set included in the above-mentioned privacy database. Finally, a business data set corresponding to at least one similarity value greater than or equal to the preset similarity threshold is screened out from the above-mentioned semantic similarity value set and determined as a business privacy data set.

[0029] The second step is to perform fine-grained partitioning processing on the above-mentioned business privacy data set to obtain a business privacy data partitioning data set. Among them, the business privacy data partitioning data in the above-mentioned business privacy data partitioning data set can be data obtained by partitioning according to the privacy sensitivity of the business privacy data set. In practice, the above-mentioned execution subject can first determine the business sensitivity of each business privacy data in the above-mentioned business privacy data set through a linear regression model to obtain a business sensitivity set. Among them, the above-mentioned business sensitivity can characterize the degree to which the business data is privacy data. Then, the above-mentioned business privacy data set is subjected to data type classification processing to obtain a business privacy category data set. Finally, the above-mentioned business privacy data set is subjected to fine-grained partitioning processing through the above-mentioned business privacy category data set and the above-mentioned business sensitivity set to obtain a business privacy data partitioning data set.

[0030] The third step is to determine the privacy level information of each business privacy data partition data in the business privacy data partition data set to obtain a privacy level information set. The privacy level information in the privacy level information set may be information representing the level of sensitivity of the business privacy data. In practice, the execution subject may determine the privacy level information of each business privacy data partition data in the business privacy data partition data set by using a hierarchical analysis method to obtain a privacy level information set.

[0031] The fourth step is to generate an attribute privacy encryption key pair. The attribute privacy encryption key pair includes: an attribute privacy encryption private key and an attribute privacy encryption public key. The attribute privacy encryption key pair can be a security access credential, a parameter set for encrypting and decrypting a business privacy data set. The attribute privacy encryption private key can be a parameter for decrypting a business privacy data set. The attribute privacy encryption public key can be a parameter for a user to encrypt and disclose a business privacy data set. In practice, the execution entity can generate an attribute privacy encryption key through DHKE (Diffie-Hellman Key Exchange).

[0032] The fifth step is to perform data encryption processing on each business privacy data partition data in the business privacy data partition data set according to the above-mentioned attribute privacy encryption public key and the above-mentioned privacy level information set to generate encrypted business privacy data, obtain an encrypted business privacy data set, and send the above-mentioned attribute privacy encryption public key to the target user terminal set.

[0033] As an example, the above-mentioned execution entity can use the elliptic curve encryption algorithm to perform data encryption processing on each business privacy data partition data in the above-mentioned business privacy data partition data set according to the above-mentioned attribute privacy encryption private key and the above-mentioned privacy level information set to generate encrypted business privacy data and obtain an encrypted business privacy data set.

[0034] Considering the problems of the above conventional solutions, facing the above technical problem 2: Since the manually set access control is not real-time and coarse-grained, the accuracy of access control is low, the security of data stored in the data warehouse is low, and the user experience is low. Combining the advantages / technical status, we can decide to adopt the following solution.

[0035] In some optional implementations of some embodiments, the fine-grained partitioning of the business privacy data set to obtain the business privacy data partitioned data set may include the following steps:

[0036] The first step is to extract privacy features from the business privacy data set to obtain a privacy data feature vector set. The privacy data feature vectors in the privacy data feature vector set can represent feature information of the business privacy data. The privacy feature extraction can be feature extraction using a convolutional neural network and an attention mechanism network.

[0037] The second step is to partition the storage space according to the business privacy data set and the privacy data feature vector set to obtain a data warehouse partition subspace set. The storage space may be the storage space of the data warehouse server.

[0038] As an example, the execution subject may first determine the privacy classification complexity of the business privacy data set using a classification complexity evaluation model. The classification complexity evaluation algorithm may be a model that performs classification complexity evaluation and outputs a complexity evaluation value based on the structural type, data scale, and data quality of the input business privacy data set. For example, the classification complexity evaluation model may be a convolutional neural network model. Secondly, matrix multiplication is performed on the privacy classification complexity, the privacy data feature vector set, and the data volume to obtain a space partition denominator matrix. The data volume may be the number of business privacy data included in the business privacy data set. Then, the product of the space partition denominator matrix and the privacy moment is determined as the space partition privacy denominator matrix. The privacy moment may be the moment when the data warehouse server stores the business privacy data set for the first time. Finally, the ratio of the space partition privacy denominator matrix to the business privacy data set is determined as the data warehouse partition subspace set.

[0039] The third step is to determine the initialization privacy storage space set of the business privacy data set. The initialization privacy storage space in the initialization privacy storage space set may be the location information of the storage space storing the business data set.

[0040] The fourth step is to perform initial filtering on the business privacy data set according to the above-mentioned initialized privacy storage space set and the above-mentioned data warehouse partition subspace set to obtain a filtered business privacy data set.

[0041] As an example, the execution subject may use an initialization filtering algorithm to perform initial filtering on the business privacy data set according to the initialization privacy storage space set and the data warehouse partition subspace set to obtain a filtered business privacy data set. The initialization filtering algorithm may be expressed as:

[0042]

[0043] Among them, a k Represents the filtered business privacy dataset.k-1 Represents the initialization of the privacy storage space set. k-1 Represents the frequency parameter in the initial filtering of the business privacy dataset. k-1 Represents the analysis statistic value. K represents the subspace set of the data warehouse partition.

[0044] Step 5: Generate a data partition function based on the filtered business privacy data set. The data partition function can be expressed as:

[0045]

[0046] Among them, z k Represents the data partition function. S Indicates the normal state of the privacy data in the corresponding space. k Indicates the data with disturbances. p indicates the matching degree between the business privacy data set and the storage interval value in the data partition function.

[0047] In the sixth step, the business privacy data set is decomposed according to the data partition function to obtain a decomposed business privacy data set.

[0048] As an example, the execution subject may use a decomposition formula to decompose the business privacy data set according to the data partition function to obtain a decomposed business privacy data set. The decomposition formula may be expressed as:

[0049] Tal(b t )=f(b t |z k ×γ t-1 |).

[0050] Among them, Tal(b t ) represents the decomposition formula. b t Represents the probability distribution parameter corresponding to each business privacy data. γ t-1 Represents the spatial information of private data at time t-1.

[0051] Step 7: Generate a privacy data partition reaction function for the business privacy data set based on the decomposed business privacy data set. The privacy data partition reaction function can characterize the stability of fine-grained partitioning of the business privacy data set. The privacy data partition reaction function can be expressed as:

[0052]

[0053] Among them, k r represents the privacy data partition reaction function. W represents the characteristic value of the business privacy data set. r represents the allocation function of the business privacy dataset.r Represents the probability of each business privacy data appearing in the corresponding space. ε r Represents fine-grained parameters of different storage spaces. rh Represents the probability density function of the business privacy dataset.

[0054] Step 8: Solve the privacy data partition reaction function to obtain a privacy data decomposition game factor set. The privacy data decomposition game factors in the privacy data decomposition game factor set can represent the game process of mining business privacy data in the data warehouse. The privacy data decomposition game factor set includes: a first privacy data decomposition game factor and a second privacy data decomposition game factor. The first privacy data decomposition game factor can represent the fine-grained partition adjustment of the business privacy data set. The second privacy data decomposition game factor can represent the adjustment of the storage space of the data warehouse.

[0055] In the ninth step, the business privacy data set is finely divided according to the game factor set decomposed from the privacy data, a business privacy data set is obtained, a token request mechanism is constructed, and fine-grained access control is performed on the business privacy data set according to the token request mechanism. The token request mechanism may be a verification process in which the data warehouse server verifies the token sent by the verification user. The token may represent the identity information of the user.

[0056] As an example, the execution entity may utilize the least squares method to decompose the game factor set according to the privacy data, perform fine-grained division on the business privacy data set, and obtain a business privacy data division data set.

[0057] The above technical solution and its related contents, as an inventive point of the embodiment of the present disclosure, solve the second technical problem mentioned in the background technology: "Since the artificially set access control is not real-time and coarse-grained, the accuracy of access control is low, the security of data stored in the data warehouse is low, and the user experience is low." The factors that lead to the low accuracy of access control, the low security of data stored in the data warehouse, and the low user experience are often as follows: Since the artificially set access control is not real-time and coarse-grained, the accuracy of access control is low, the security of data stored in the data warehouse is low, and the user experience is low. If the above factors are solved, the effect of improving the accuracy of access control, improving the security of data stored in the data warehouse, and improving the user experience can be achieved. In order to achieve this effect, the present disclosure first obtains a storage space set by spatially dividing the storage space of the data warehouse, and initially filters the business privacy data set for each storage space to filter out some non-critical and privacy data that does not require fine-grained division, which can reduce the amount of data for fine-grained division and reduce the division complexity. Then, a data partition function is constructed and used to decompose the business privacy data set, which can effectively divide the business privacy data into fine-grained features and improve the granularity of subsequent access. Finally, by decomposing the generated privacy data partition reaction function, a set of privacy data decomposition game factors is obtained, and the privacy data decomposition game factor set is converted into a data partition problem of the business privacy data set under the least squares criterion, which can improve the accuracy of fine-grained partitioning.

[0058] In some optional implementations of some embodiments, the step of performing privacy data identification on the business data set to obtain the business privacy data set may include the following steps:

[0059] In the first step, at least one business data having an unstructured data structure type is screened out from the business data set to obtain an unstructured business data set.

[0060] In the second step, for each unstructured business data in the above unstructured business data set, the following nonlinear mapping steps are performed:

[0061] Sub-step 1, performing semantic feature extraction processing on the above-mentioned unstructured business data to obtain a business semantic feature vector group. Among them, the business semantic feature vectors in the above-mentioned business semantic feature vector group can represent the semantic features in the unstructured business data. In practice, the above-mentioned execution entity can use the BERT (Bidirectional Encoder Representation from Transformers) model to perform semantic feature extraction processing on the above-mentioned unstructured business data to obtain a business semantic feature vector group.

[0062] Sub-step 2, performing dependency syntactic parsing on the above-mentioned unstructured business data to obtain a business syntactic parsing tree. The above-mentioned business syntactic parsing tree can be a tree that visualizes the syntactic structure of the unstructured business data. The nodes of the above-mentioned business syntactic parsing tree can be business word segments of the unstructured business data. The edges of the above-mentioned business syntactic parsing tree can be the dependency relationship between two adjacent business word segments. For example, the above-mentioned dependency relationship can be but is not limited to at least one of the following: subject-predicate relationship, verb-object relationship.

[0063] Sub-step 3, encode the above-mentioned business semantic feature vector group and the above-mentioned business syntax parse tree to obtain a business structure feature vector group. Among them, the business structure feature vector in the above-mentioned business structure feature vector group can be a feature vector of splicing semantic features and structural features. In practice, the above-mentioned execution subject can use a graph attention network to encode the above-mentioned business semantic feature vector group and the above-mentioned business syntax parse tree to obtain a business structure feature vector group.

[0064] Sub-step 4: performing feature concatenation on the service semantic feature vector group and the service structure feature vector group to obtain a concatenated service feature vector group.

[0065] Sub-step 5: determining the position feature vector of each business word included in the business syntax parse tree to obtain a position feature vector group, wherein the position feature vector in the position feature vector group can represent the position information of the business word.

[0066] Sub-step 6, determining the sentence text feature vector of each sentence included in the unstructured business data, and obtaining a sentence text feature vector group. The sentence text feature vector can represent the sentence information of each business word in different sentences. The above determination can be made using the BERT model.

[0067] Sub-step 7, text embedding is performed on the concatenated business feature vector group, the position feature vector group and the sentence text feature vector group to obtain a business text feature vector group. The text embedding may be an embedding process performed through an embedding layer.

[0068] Sub-step 8: input the above-mentioned business text feature vector group into the self-attention mechanism network to obtain the business text weight feature vector group.

[0069] Sub-step 9, performing nonlinear mapping processing on the above-mentioned business text weight feature vector group to obtain business data label information. The above-mentioned business data label information can be label information for determining whether the unstructured business data is private data. The above-mentioned nonlinear mapping processing can be a nonlinear mapping processing of inputting the above-mentioned business text weight feature vector group into a network layer containing a sigmoid nonlinear activation function.

[0070] The third step is to generate an unstructured privacy dataset as a business privacy dataset based on the obtained business data label information set.

[0071] As an example, the execution subject may filter out at least one unstructured business data corresponding to at least one business tag data information labeled as privacy data from the business data tag information set to obtain an unstructured privacy data set.

[0072] Considering the problems of the above conventional solutions, facing the above technical problem three: due to the limitations of the privacy field names determined by expert experience, the coverage is not comprehensive, and there are easy to be missed and misidentified, resulting in low accuracy of privacy data identification, low security of privacy data, and low stability and security of the data warehouse. Combining the advantages / technical status, we can decide to adopt the following solution.

[0073] In some optional implementations of some embodiments, the step of performing privacy data identification on the business data set to obtain the business privacy data set may further include the following steps:

[0074] The first step is to filter out at least one business data of a structured type from the business data set to obtain a structured business data set.

[0075] The second step is to determine the business information entropy of each structured business data in the structured business data set to obtain a business information entropy set, wherein the business information entropy may be the information source entropy of the structured business data.

[0076] The third step is to determine the maximum discrete entropy of each structured business data in the structured business data set to obtain a maximum discrete entropy set, wherein the maximum discrete entropy may be a discrete entropy determined by the maximum discrete entropy determination.

[0077] In the fourth step, based on the business information entropy set and the maximum discrete entropy set, a data sensitivity value of each structured business data in the structured business data set is generated to obtain a data sensitivity value set. The data sensitivity value may represent the probability value that the structured business data is private data. The data sensitivity value may be an indicator for measuring the degree of disorder of the structured business data in the structured business data set. The smaller the data sensitivity value, the greater the probability that the structured business data is private data.

[0078] As an example, the execution subject may perform the following determination steps for each structured business data in the structured business data set: first, determine the difference between the maximum discrete entropy of the structured business data and the business information entropy to obtain difference data. Then, determine the ratio of the difference data to the maximum discrete entropy as the data sensitivity value.

[0079] The fifth step is to determine the number of business clusters of the structured business data set. The number of business clusters may be the number of clusters into which the structured business data set is clustered. In practice, the execution subject may use the elbow method to determine the number of business clusters of the structured business data set.

[0080] In step 6, clustering is performed on the structured business data set according to the business cluster quantity and the data sensitivity value set to obtain initial sensitive business data clusters and initial non-sensitive business data clusters. The clustering may be performed using a k-means clustering algorithm.

[0081] Step 7: Determine the data association relationship information set between the above-mentioned initial sensitive business data cluster and the above-mentioned initial non-sensitive business data cluster. The data association relationship information in the above-mentioned data association relationship information set may be the association relationship information of inferring the privacy data through the non-privacy data. In practice, the above-mentioned execution subject may use the Apriori algorithm to determine the data association relationship information set between the above-mentioned initial sensitive business data cluster and the above-mentioned initial non-sensitive business data cluster.

[0082] In the eighth step, the data association relationship information set is screened to obtain a screened data association relationship information set, wherein the screening process may be to screen out data association information sets whose association confidence is greater than or equal to 0.7.

[0083] In step 9, in response to determining that the ratio of the screened quantity to the associated quantity is greater than or equal to a preset ratio threshold, the initial sensitive business data cluster and the initial non-sensitive business data cluster are updated according to the data association relationship information set to obtain updated sensitive business data clusters and updated non-sensitive business data clusters. The screened quantity may be the number of screened data association relationship information included in the screened data association relationship information set. The associated quantity may be the number of data association relationship information included in the data association relationship information set. The preset ratio threshold may be a pre-set value. For example, the preset ratio threshold may be one third.

[0084] As an example, the execution subject may perform the following average value determination steps for each structured business data in the structured business data set: first, determine the structured business data having data association information with the structured business data as the associated structured business data, and obtain the associated structured business data set. Secondly, determine the business condition entropy of the structured business data under the associated conditions of each associated structured data in the associated structured business data set, and obtain the business condition entropy set. Then, determine the ratio of the difference between the maximum discrete entropy of the structured business data and each business condition entropy in the business condition entropy set to the maximum discrete entropy as the updated data sensitivity value, and obtain the updated data sensitivity value set. Finally, determine the average value of the updated data sensitivity value set, and obtain the updated data sensitivity value of the structured business data. In the second step, cluster the obtained updated data sensitivity value set to obtain updated sensitive business data clusters and updated non-sensitive business data clusters.

[0085] In the tenth step, the updated sensitive business data cluster and the unstructured privacy data set are determined as business privacy data sets.

[0086] The above technical solution and its related contents, combined with step "step 108", as an inventive point of an embodiment of the present disclosure, solves the technical problem three mentioned in the background technology "Due to the limitations of the privacy field names determined by expert experience, the coverage is not comprehensive, and there are easy to be missed identification and misidentification, resulting in low accuracy of privacy data identification, low security of privacy data, and low stability and security of the data warehouse". The factors that lead to low accuracy of privacy data identification, low security of privacy data, and low stability and security of the data warehouse are often as follows: Due to the limitations of the privacy field names determined by expert experience, the coverage is not comprehensive, and there are easy to be missed identification and misidentification. If the above factors are solved, the accuracy of access control can be improved, the security of data stored in the data warehouse can be improved, and the user experience can be improved. In order to achieve this effect, the present disclosure first determines the business information entropy and maximum discrete entropy of each structured business data to generate a data sensitivity value, and quantifies the sensitivity of the structured business data. Secondly, the structured business data set is clustered through data sensitivity values ​​to obtain the initial privacy business data cluster and the initial non-privacy business data cluster. The automatic initial division through the data sensitivity value set can avoid the identification of human experience to a certain extent and increase the objectivity of privacy data identification. Then, the data association relationship information of the initial privacy business data cluster and the initial non-privacy business data cluster is determined, and the initial privacy business data cluster and the initial non-privacy business data cluster are updated through the data association relationship information to obtain the business privacy data set. The correlation between data is added on the basis of the data set distance measurement to identify privacy data. The privacy data is determined through multi-dimensional analysis, which can further improve the accuracy of privacy data identification and reduce the cases of misidentification and missed identification, thereby improving the security and stability of the data warehouse, as well as the security of business data, and realizing precise control of user-side access.

[0087] Step 102 : Match the user attribute information corresponding to the parsed data request information with each user attribute access policy in the user attribute access policy set to obtain a matching result set.

[0088] In some embodiments, the execution subject may match the user attribute information corresponding to the parsed data request information with each user attribute access policy in the user attribute access policy set to obtain a matching result set. Among them, the user attribute access policy in the user attribute access policy set is a required policy for the user attribute of the user terminal to access the data in the data warehouse. The access policy may be a policy displayed in the form of tree structure data. The user attribute information corresponding to the parsed data request information may be information describing the identity of the user terminal obtained by querying the attribute server storing the user attribute information through the user identity information included in the parsed data request information. For example, the user attribute information may be the department information, position information, name, etc. of the user corresponding to the client. The matching process is to determine whether the queried user attribute information meets the access conditions specified by the user attribute access policy.

[0089] Step 103: Generate a user access log according to the matching result set.

[0090] In some embodiments, the execution subject may generate a user access log according to the matching result set, wherein the user access log may be a log file for recording the process of the user end accessing data.

[0091] As an example, the execution subject may first select at least one matching result representing a successful match from the matching result set as the target matching result to obtain a target matching result set. Then, the access process of the user terminal to the encrypted business data set corresponding to the target matching result set is recorded to generate a user access log.

[0092] Step 104: perform abnormal behavior detection on the user access log to obtain abnormal behavior detection results.

[0093] In some embodiments, the execution subject may perform abnormal behavior detection on the user access log to obtain abnormal behavior detection results. The abnormal behavior detection results may indicate whether the behavior of the user end accessing the business data stored in the data warehouse is normal. In practice, the execution subject may use a discrete Markov chain to perform abnormal behavior detection on the user access log to obtain abnormal behavior detection results.

[0094] Step 105 , in response to determining that the abnormal behavior detection result indicates that the user access behavior is normal, determining whether the target user attribute information set and the encrypted service data set are changed.

[0095] In some embodiments, the execution subject may determine whether the target user attribute information set and the encrypted business data set have changed in response to determining that the abnormal behavior detection result indicates that the user access behavior is normal. The target user attribute information set and the encrypted business data set are respectively data sets stored in a data warehouse. The target user attribute information in the target user attribute information set may be attribute information that indicates the identity information of the client. The encrypted business data in the encrypted business data set may be data that the business data owner encrypts the business data sent to the data warehouse and then sends to the data warehouse for storage. Changes to the target user attribute information set may include, but are not limited to, at least one of the following: revocation, addition, and modification of user attributes. Changes to the encrypted business data set may include, but are not limited to, at least one of the following: addition, deletion, and update.

[0096] Optionally, after determining in response to the abnormal behavior detection result that the user access behavior is normal and determining whether the target user attribute information set and the business data set have changed, the method may further include the following steps:

[0097] In response to determining that the abnormal behavior detection result indicates that the user access behavior is abnormal, the associated alarm device is controlled to issue an abnormal alarm, and the access request of the user terminal is terminated.

[0098] Step 106, in response to determining that the target user attribute information set and the encrypted service data set have changed, determine each target user attribute information and each encrypted service data that has changed as a changed user attribute information set and a service change data set.

[0099] In some embodiments, the execution subject may, in response to determining that the target user attribute information set and the encrypted business data set have changed, determine each target user attribute information and each encrypted business data that have changed as the changed user attribute information set and the business change data set. In practice, the execution subject may determine each target user attribute information and each encrypted business data that have changed as the changed user attribute information set and the business change data set through the operation behaviors in the user access log and the user access log of the data owner.

[0100] Step 107: Update the user attribute access policy set and the service change data set corresponding to the changed user attribute information set to obtain an updated user attribute access policy set and an updated encrypted service data set.

[0101] In some embodiments, the execution subject may update the user attribute access policy set corresponding to the changed user attribute information set and the service change data set to obtain an updated user attribute access policy set and an updated encrypted service data set.

[0102] As an example, the execution subject may first determine the change time set of the changed user attribute information set in response to determining that the changed user attribute information set is an update of some user attributes. Secondly, perform an XOR operation on the changed user attribute information set and the change time set to obtain XOR operation change information. Subsequently, perform an XOR operation on the changed encryption business data set corresponding to the XOR operation change information and the XOR operation change information to obtain an updated encryption business data set. Then, determine the position information set of the changed user attribute information set in the user attribute access policy set. Finally, replace the user attribute information set corresponding to the position information set with the changed user attribute information set to obtain an updated user attribute access policy set.

[0103] Step 108, dynamically control access to the updated encrypted service data set and the unupdated encrypted service data set according to the updated user attribute access policy set and the unupdated user attribute access policy set, and send the user service data set corresponding to the data request information to the above-mentioned user terminal.

[0104] In some embodiments, the execution subject may dynamically control access to the updated encrypted business data set and the unupdated encrypted business data set according to the updated user attribute access policy set and the unupdated user attribute access policy set, and send the user business data set corresponding to the data request information to the user terminal. The user business data set may be the updated encrypted business data set, or the unupdated encrypted business data set, or may include a data set of the updated encrypted business data set and the unupdated encrypted business data set.

[0105] As an example, the execution subject may first obtain a policy matching result set by matching the user attribute information corresponding to the user identity information extracted from the data request information with the updated user attribute access policy set and the unupdated user attribute access policy set. Then, in response to determining that there is a successful policy matching result in the policy matching result set, determine whether the encrypted business data set corresponding to the policy matching result representing the successful matching is the same as the access data in the data request information. Finally, in response to determining that they are the same, send the updated encrypted business data set representing the successful matching or the unupdated encrypted business data set to the user end. In response to determining that they are different, stop the data request of the user end.

[0106] The above-mentioned embodiments of the present disclosure have the following beneficial effects: the business data dynamic access control method of some embodiments of the present disclosure can improve the security of business data and the granularity and accuracy of access rights, and realize the full-process security access control from data encryption to access control. Specifically, the waste of computing resources and large computing load of the relevant data warehouse server, as well as the increase in the time and complexity of users accessing data in the data warehouse, reduce the user experience because: since the symmetric encryption algorithm can only realize one-to-one encryption and decryption with business data, different keys are generated for different users, resulting in an increase in the amount of encryption and decryption operations, resulting in a waste of computing resources and large computing load of the data warehouse server, as well as the increase in the time and complexity of users accessing data in the data warehouse, reduce the user experience. Based on this, the business data dynamic access control method of some embodiments of the present disclosure can first, in response to receiving the data request information sent by the user end, parse the above data request information to obtain the parsed data request information. Here, parsing the request information can determine the user identity information, which is convenient for subsequent verification of the identity information of the user end. Secondly, the user attribute information corresponding to the above-mentioned parsed data request information and each user attribute access policy in the user attribute access policy set are matched to obtain a matching result set, wherein the user attribute access policy in the above-mentioned user attribute access policy set is the required policy for the user attribute of the user terminal accessing the data in the data warehouse. Here, the user attribute access policy can be the access policy corresponding to multiple user terminals, which reduces the amount of calculation of the data warehouse server and simplifies the access complexity. The matching process can determine whether the above-mentioned user terminal meets the set access policy to determine whether the subsequent user terminal is qualified to access the business data, which can improve the security of the business data set. Thirdly, based on the above-mentioned matching result set, a user access log is generated. Here, the generated access log can record the access process of the user accessing the business data, which is convenient for data tracing and determining the user access behavior. Next, the above-mentioned user access log is subjected to abnormal behavior detection to obtain the abnormal behavior detection result. Here, the abnormal behavior detection can determine whether the access behavior of the user terminal is abnormal, which is convenient for improving the security of the business data and the security of the data warehouse server. Subsequently, in response to determining that the abnormal behavior detection result indicates that the user access behavior is normal, it is determined whether the target user attribute information set and the encrypted business data set have changed, wherein the target user attribute information set and the encrypted business data set are respectively data sets stored in the data warehouse. Here, it is convenient to subsequently determine the change of the target user attribute information set and the business data set. Afterwards, in response to determining that the target user attribute information set and the encrypted business data set have changed, each target user attribute information and each encrypted business data set that has changed is determined as the changed user attribute information set and the business change data set.Here, it is used to subsequently update the changed user attribute information set and the business change data set, so as to adjust and limit the access rights of the user end in real time, improve the accuracy of the user access rights and the security of the data. Then, the user attribute access policy set corresponding to the above-mentioned changed user attribute information set and the above-mentioned business change data set are updated to obtain the updated user attribute access policy set and the updated encrypted business data set. Here, the access rights of the user end can be updated in real time to adapt to the dynamically changing environment to ensure the stability of the data warehouse server and improve the security of the business data. Finally, according to the above-mentioned updated user attribute access policy set and the unupdated user attribute access policy set, the above-mentioned updated encrypted business data set and the unupdated encrypted business data set are dynamically access controlled, and the user business data set corresponding to the above-mentioned data request information is sent to the above-mentioned user end. Here, the security access control of the whole life cycle from encrypted business data to user end access can be improved, the security of the business data stored in the data warehouse and the real-time of user access can be improved, and the user access efficiency and experience can be improved. It can be concluded that the business data dynamic access control method can improve the security of business data sets by encrypting business data sets based on user attribute information, and grant dynamic user access policies for multiple users to access the same business data, which can reduce the amount of computing on the data warehouse server and reduce the computing load, improve the granularity and accuracy of user access control, and achieve full-process secure access throughout the entire life cycle from business data to user-side access, thereby improving the user's access experience.

[0107] Further references Figure 2 As an implementation of the methods shown in the above figures, the present disclosure provides some embodiments of a business data dynamic access control device. These device embodiments are similar to Figure 1 Corresponding to the method embodiments shown, the service data dynamic access control device can be specifically applied to various electronic devices.

[0108] like Figure 2As shown, a business data dynamic access control device 200 includes: a parsing unit 201, a matching unit 202, a generating unit 203, an abnormal behavior detection unit 204, a first determining unit 205, a second determining unit 206, an updating unit 207 and a dynamic access control unit 208. The parsing unit 201 is configured to: in response to receiving data request information from a user end, parse the data request information to obtain the parsed data request information. The matching unit 202 is configured to: match the user attribute information corresponding to the parsed data request information with each user attribute access policy in the user attribute access policy set to obtain a matching result set, wherein the user attribute access policy in the user attribute access policy set is a user attribute requirement policy set for the user end to access data in the data warehouse. The generating unit 203 is configured to: generate a user access log according to the matching result set. The abnormal behavior detection unit 204 is configured to: perform abnormal behavior detection on the user access log to obtain an abnormal behavior detection result. The first determination unit 205 is configured to: in response to determining that the above abnormal behavior detection result indicates that the user access behavior is normal, determine whether the target user attribute information set and the encrypted business data set have changed, wherein the above target user attribute information set and the above encrypted business data set are respectively data sets stored in the data warehouse. The second determination unit 206 is configured to: in response to determining that the above target user attribute information set and the above encrypted business data set have changed, determine each target user attribute information and each encrypted business data that have changed as the changed user attribute information set and the business change data set. The updating unit 207 is configured to: update the user attribute access policy set corresponding to the above changed user attribute information set and the above business change data set to obtain the updated user attribute access policy set and the updated encrypted business data set. The dynamic access control unit 208 is configured to: perform dynamic access control on the above updated encrypted business data set and the unupdated encrypted business data set according to the above updated user attribute access policy set and the unupdated user attribute access policy set, and send the user business data set corresponding to the above data request information to the above user terminal.

[0109] It is understandable that the units recorded in the business data dynamic access control device 200 are similar to the reference Figure 1 Therefore, the operations, features and beneficial effects described above for the method are also applicable to the service data dynamic access control device 200 and the units included therein, and will not be described in detail here.

[0110] Reference below Figure 3 , which shows a structural schematic diagram of an electronic device (eg, an electronic device) 300 suitable for implementing some embodiments of the present disclosure. Figure 3The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0111] like Figure 3 As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 into a random access memory (RAM) 303. In the RAM 303, various programs and data required for the operation of the electronic device 300 are also stored. The processing device 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0112] Typically, the following devices may be connected to the I / O interface 305: input devices 306 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 308 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 309. The communication devices 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 3 The electronic device 300 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead. Figure 3 Each block shown in the figure may represent one device, or may represent multiple devices as required.

[0113] In particular, according to some embodiments of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, some embodiments of the present disclosure include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In some such embodiments, the computer program can be downloaded and installed from the network through the communication device 309, or installed from the storage device 308, or installed from the ROM 302. When the computer program is executed by the processing device 301, the above-mentioned functions defined in the method of some embodiments of the present disclosure are executed.

[0114] It should be noted that the computer-readable medium in some embodiments of the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In some embodiments of the present disclosure, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In some embodiments of the present disclosure, the computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0115] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (Hyper Text Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0116] The above-mentioned computer-readable medium may be included in the above-mentioned electronic device; or it may exist independently without being assembled into the electronic device. The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by the electronic device, the electronic device: in response to receiving data request information from the user end, parses and processes the above-mentioned data request information to obtain parsed data request information; matches the user attribute information corresponding to the above-mentioned parsed data request information with each user attribute access policy in the user attribute access policy set to obtain a matching result set, wherein the user attribute access policy in the above-mentioned user attribute access policy set is a required policy for the user attribute of the user end to access the data in the data warehouse; generates a user access log based on the above-mentioned matching result set; performs abnormal behavior detection on the above-mentioned user access log to obtain abnormal behavior detection results; in response to determining that the above-mentioned abnormal behavior detection results indicate that the user access behavior is normal, determines the target user attribute information set and whether the encrypted business data set has changed, wherein the target user attribute information set and the encrypted business data set are respectively data sets stored in the data warehouse; in response to determining that the target user attribute information set and the encrypted business data set have changed, determining each target user attribute information and each encrypted business data that has changed as a changed user attribute information set and a business change data set; updating the user attribute access policy set corresponding to the changed user attribute information set and the business change data set to obtain an updated user attribute access policy set and an updated encrypted business data set; performing dynamic access control on the updated encrypted business data set and the unupdated encrypted business data set according to the updated user attribute access policy set and the unupdated user attribute access policy set, and sending the user business data set corresponding to the data request information to the user end.

[0117] Computer program code for performing the operations of some embodiments of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0118] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0119] The units described in some embodiments of the present disclosure may be implemented by software or by hardware. The described units may also be arranged in a processor, for example, may be described as: a processor comprising: a parsing unit, a matching unit, a generating unit, an abnormal behavior detection unit, a first determination unit, a second determination unit, an updating unit and a dynamic access control unit. Among them, the names of these units do not constitute a limitation on the unit itself under certain circumstances. For example, the parsing unit may also be described as "a unit that, in response to receiving data request information from a user terminal, parses and processes the above data request information to obtain the parsed data request information".

[0120] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0121] The above descriptions are only some preferred embodiments of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by a specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the above-mentioned inventive concept. For example, the above-mentioned features are replaced with the technical features with similar functions disclosed in the embodiments of the present disclosure (but not limited to) and the technical solutions formed.

Claims

1. A method for dynamic access control of business data, comprising: Performing privacy data identification on the business data set to obtain the business privacy data set, wherein performing privacy data identification on the business data set to obtain the business privacy data set includes: Filtering at least one business data whose data structure type is an unstructured type from the business data set to obtain an unstructured business data set; For each unstructured business data in the unstructured business data set, the following nonlinear mapping steps are performed: Performing semantic feature extraction processing on the unstructured business data to obtain a business semantic feature vector group; Performing dependency syntax parsing on the unstructured business data to obtain a business syntax parsing tree; Encoding the service semantic feature vector group and the service syntax parse tree to obtain a service structure feature vector group; Performing feature splicing on the service semantic feature vector group and the service structure feature vector group to obtain a spliced ​​service feature vector group; Determine the position feature vector of each business word included in the business syntax parse tree to obtain a position feature vector group; Determine a sentence text feature vector of each sentence included in the unstructured business data to obtain a sentence text feature vector group; Performing text embedding on the concatenated business feature vector group, the position feature vector group, and the sentence text feature vector group to obtain a business text feature vector group; Inputting the business text feature vector group into the self-attention mechanism network to obtain a business text weight feature vector group; Performing nonlinear mapping processing on the business text weight feature vector group to obtain business data label information; Generate an unstructured privacy dataset as a business privacy dataset based on the obtained business data label information set; Performing fine-grained partitioning processing on the business privacy data set to obtain a business privacy data partitioning data set; Determine the privacy level information of each business privacy data partition data in the business privacy data partition data set to obtain a privacy level information set; Generate an attribute privacy encryption key pair, wherein the attribute privacy encryption key pair includes: an attribute privacy encryption private key and an attribute privacy encryption public key; According to the attribute privacy encryption public key and the privacy level information set, each business privacy data partition data in the business privacy data partition data set is encrypted to generate encrypted business privacy data, obtain an encrypted business privacy data set, and send the attribute privacy encryption public key to the user end; In response to receiving the data request information sent by the user terminal, parsing the data request information to obtain parsed data request information; Matching the user attribute information corresponding to the parsed data request information with each user attribute access policy in the user attribute access policy set to obtain a matching result set, wherein the user attribute access policy in the user attribute access policy set is a set user attribute requirement policy for accessing data in the data warehouse by the user end; Generate a user access log according to the matching result set; Perform abnormal behavior detection on the user access log to obtain an abnormal behavior detection result; in response to determining that the abnormal behavior detection result indicates that the user access behavior is normal, determine whether a target user attribute information set and an encrypted business data set have changed, wherein the target user attribute information set and the encrypted business data set are respectively data sets stored in a data warehouse; In response to determining that the target user attribute information set and the encrypted service data set have changed, determining each target user attribute information and each encrypted service data that has changed as a changed user attribute information set and a service change data set; The user attribute access policy set corresponding to the changed user attribute information set and the service change data set are updated to obtain an updated user attribute access policy set and an updated encrypted service data set; According to the updated user attribute access policy set and the unupdated user attribute access policy set, dynamic access control is performed on the updated encrypted business data set and the unupdated encrypted business data set, and the user business data set corresponding to the data request information is sent to the user terminal.

2. The method according to claim 1, wherein: After determining in response to determining that the abnormal behavior detection result indicates that the user access behavior is normal and determining whether the target user attribute information set and the encrypted service data set have changed, the method further includes: In response to determining that the abnormal behavior detection result indicates that the user access behavior is abnormal, the associated alarm device is controlled to issue an abnormal alarm, and the access request of the user terminal is terminated.

3. A business data dynamic access control device, comprising: The privacy data identification unit is configured to perform privacy data identification on a business data set to obtain a business privacy data set, wherein the privacy data identification on the business data set to obtain the business privacy data set includes: filtering out at least one business data with a data structure type of unstructured type from the business data set to obtain an unstructured business data set; for each unstructured business data in the unstructured business data set, performing the following nonlinear mapping steps: performing semantic feature extraction processing on the unstructured business data to obtain a business semantic feature vector group; performing dependency syntax parsing processing on the unstructured business data to obtain a business syntax parse tree; encoding the business semantic feature vector group and the business syntax parse tree to obtain a business structure feature vector group; and encoding the business semantic feature vector group. and the business structure feature vector group to obtain a spliced ​​business feature vector group; determine the position feature vectors of each business word included in the business syntax parse tree to obtain a position feature vector group; determine the sentence text feature vectors of each sentence included in the unstructured business data to obtain a sentence text feature vector group; perform text embedding on the spliced ​​business feature vector group, the position feature vector group and the sentence text feature vector group to obtain a business text feature vector group; input the business text feature vector group into a self-attention mechanism network to obtain a business text weight feature vector group; perform nonlinear mapping processing on the business text weight feature vector group to obtain business data label information; generate an unstructured privacy data set as a business privacy data set based on the obtained business data label information set; A fine-grained partitioning unit is configured to perform fine-grained partitioning processing on the business privacy data set to obtain a business privacy data partitioning data set; A first determining unit is configured to determine the privacy level information of each business privacy data partition data in the business privacy data partition data set to obtain a privacy level information set; A first generating unit is configured to generate an attribute privacy encryption key pair, wherein the attribute privacy encryption key pair includes: an attribute privacy encryption private key and an attribute privacy encryption public key; a data encryption unit configured to perform data encryption processing on each business privacy data partition data in the business privacy data partition data set according to the attribute privacy encryption public key and the privacy level information set to generate encrypted business privacy data, obtain an encrypted business privacy data set, and send the attribute privacy encryption public key to the user end; A parsing unit, configured to parse the data request information sent by the user terminal in response to receiving the data request information, and obtain the parsed data request information; a matching unit configured to match the user attribute information corresponding to the parsed data request information with each user attribute access policy in a user attribute access policy set to obtain a matching result set, wherein the user attribute access policy in the user attribute access policy set is a set user attribute requirement policy for accessing data in the data warehouse by the user end; A second generating unit is configured to generate a user access log according to the matching result set; an abnormal behavior detection unit, configured to perform abnormal behavior detection on the user access log to obtain an abnormal behavior detection result; A second determination unit is configured to determine whether a target user attribute information set and an encrypted business data set have been changed in response to determining that the abnormal behavior detection result indicates that the user access behavior is normal, wherein the target user attribute information set and the encrypted business data set are respectively data sets stored in a data warehouse; A third determining unit is configured to, in response to determining that the target user attribute information set and the encrypted service data set have changed, determine each target user attribute information and each encrypted service data that has changed as a changed user attribute information set and a service change data set; An updating unit, configured to update the user attribute access policy set corresponding to the changed user attribute information set and the service change data set, to obtain an updated user attribute access policy set and an updated encrypted service data set; The dynamic access control unit is configured to perform dynamic access control on the updated encrypted business data set and the unupdated encrypted business data set according to the updated user attribute access policy set and the unupdated user attribute access policy set, and send the user business data set corresponding to the data request information to the user terminal.

4. An electronic device, comprising: one or more processors; a storage device having one or more programs stored thereon, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1-2.

5. A computer readable medium having a computer program stored thereon, wherein: When the computer program is executed by a processor, the method according to any one of claims 1 to 2 is implemented.

Images