A method, device and equipment for multi-level permission control access to a large model knowledge base

Abstract

The present application relates to a method, device and equipment for multi-level permission control access to a large model knowledge base. The method introduces resource permissions, hierarchical permissions, environmental permissions and semantic permissions in the process of user access to the knowledge base. Based on multi-level permission filtering, the method can quickly retrieve relevant resources that match the user's access permissions from the knowledge base. Resource data for which the user does not have relevant access permissions is ensured not to be retrieved to enter the next question-and-answer process, thereby narrowing the scope of resource retrieval and improving the speed and efficiency of resource retrieval in the knowledge base. At the same time, multi-level permission access control can effectively prevent unauthorized resource data leakage, thereby improving the security and intelligence of the knowledge base. In addition, multi-level permission access control can be used to perform more accurate resource matching according to the actual needs of the user, thereby improving user satisfaction. It has good application prospects and practical value, and can be widely used in large-scale knowledge base management systems.

Description

Technical Field

[0001] The present application relates to the field of computer security technology, and in particular to a method, device and equipment for multi-level permission control access to a large model knowledge base. Background Art

[0002] Traditional knowledge bases are built using NLP (natural language processing) technology, and there are mainly the following solutions for knowledge management: The first is to build a full-text retrieval system and then use keyword retrieval to obtain relevant knowledge. The advantages of this solution are that it is simple and easy to implement, and can quickly obtain documents containing keywords. However, there are problems such as insufficient accuracy in obtaining knowledge through keyword retrieval, inability to understand the contextual semantics of users' knowledge queries, and users need to spend time reading and screening the returned content. For complex queries or natural language questions, the retrieval effect is poor and cannot provide direct answers. The second is to build a knowledge graph and obtain relevant knowledge through graph search. The advantages of this solution are that it can intuitively represent entities and their relationships, high query efficiency, support complex queries, and can answer complex reasoning questions based on relationships. The disadvantages are that the cost of building a knowledge graph is high, updating and maintenance are difficult, and the knowledge coverage is limited. The third is to build a question-answer pair for frequently asked questions, and retrieve answers by string matching the question-answer pair. The advantages of this solution are that it is simple and easy to implement and can quickly respond to common questions. The disadvantages are that it can only answer predefined questions and cannot provide valid answers to new or undefined questions; the string matching method is easily affected by the user's question-asking method, and the correct answer may not be matched if the user changes slightly; new question-answer pairs need to be added continuously, and the maintenance cost is high; it is difficult to provide accurate answers to complex questions or questions that require the integration of multiple knowledge points.

[0003] The rapid development of big model technology has provided new solutions to address the shortcomings of traditional knowledge base solutions. For example, big models can understand the semantics in natural language, improve query accuracy and relevance; can automatically build and update knowledge graphs; and can dynamically generate answers without the need for predefined question-answer pairs. Based on big models for knowledge management, users usually interact with the knowledge management system through natural language input. However, this new natural language interaction method and the introduction of big model technology have brought new challenges to knowledge management permission control. When faced with complex knowledge access needs, it is difficult to fully and accurately meet user query needs. Traditional permission control methods have certain limitations when dealing with access control of knowledge content generated by big models, especially in ensuring that only authorized users can access specific content. Therefore, a new dynamic knowledge access permission control method is urgently needed to solve the above problems. Summary of the invention

[0004] Based on this, it is necessary to provide a method, device and equipment for multi-level authority control access to a large model knowledge base to address the above technical problems.

[0005] A multi-level permission control access method for a large model knowledge base, the method comprising:

[0006] Obtain the role information, login environment information, and user questions when the user logs into the knowledge base;

[0007] Find the user's static permissions based on role information. Static permissions include resource permissions and hierarchical permissions. Resource permissions are used to determine user access permissions by building matching relationships between users and departments, users and projects, departments and resources, and projects and resources. Hierarchical permissions are used to determine user access permissions by building matching relationships between user permission levels, resource permission levels, user confidentiality levels, resource confidentiality levels, and user roles.

[0008] Find the user's dynamic permissions based on the login environment information. Dynamic permissions are also called environment permissions. Environment permissions are used to determine the user's access permissions by building a matching relationship between the user's login environment factors and the environment factors that allow access to resources.

[0009] Search for the user's semantic permissions based on the user's question. The semantic permissions are used to determine the user's access permissions by comparing the semantic element information in the user's question with the semantic element whitelist or blacklist;

[0010] The static permissions, dynamic permissions and semantic permissions are combined to filter the resources that the user is allowed to access in the knowledge base, and a list of resources that the user is allowed to access is obtained. The relevant background knowledge of the user's question is obtained by calculating the similarity between the list of resources that the user is allowed to access and the user's question.

[0011] User questions and relevant background knowledge as context are submitted to the big model for answer generation, and the generated content, user questions, static permissions, dynamic permissions, and semantic permissions are submitted to the big model for generated content review. If the review passes, the generated content will be displayed to the user as the final answer; if the review fails, the reason for failure will be fed back to the user.

[0012] In one embodiment, the specific process of resource authority determining user access rights includes:

[0013] The department to which the user belongs is recorded as the set Du, and the list of projects to which the user has access rights is recorded as the set Pu;

[0014] The list of projects to which the resources belong is recorded as set Pd, and the list of departments to which the resources belong is recorded as set Dd;

[0015] Construct resource permission judgment conditions, expressed as: and ;

[0016] If the resource permission judgment condition is met, it is judged that the user has the access permission to the corresponding resource; otherwise, it is judged that the user does not have the access permission.

[0017] In one embodiment, the specific process of determining user access rights by hierarchical authority includes:

[0018] The user authority level is recorded as Lu, the resource authority level is recorded as Ld, the user confidentiality level is recorded as Su, the resource confidentiality level is recorded as Sd, the user role is recorded as Ru, and the user role allowed to access the resource is recorded as Rd;

[0019] Construct the hierarchical permission judgment conditions, expressed as: and and ;

[0020] When the hierarchical permission judgment condition is met, it is judged that the user has the access rights to the corresponding resources; otherwise, it is judged that the user does not have the access rights.

[0021] In one embodiment, the specific process of determining user access rights by the environment authority includes:

[0022] User login environment factors include location environment factors, time environment factors, network environment factors and device environment factors;

[0023] The location environment factor is recorded as GEOu, the location that the resource is allowed to access is recorded as GEOd, the time environment factor is recorded as Tu, the time that the resource is allowed to access is recorded as Td, the network environment factor and the device environment factor are recorded as NETu and DEVu respectively, and the network and device that the resource is allowed to access are recorded as NETd and DEVd respectively;

[0024] The construction environment permission judgment condition is expressed as:

[0025] and and and ;

[0026] When the environment permission judgment condition is met, it is judged that the user has the access rights to the corresponding resources; otherwise, it is judged that the user does not have the access rights.

[0027] In one embodiment, the specific process of semantic permissions for determining user access rights includes:

[0028] Extracting semantic element information from user questions based on the big model; where the semantic element information includes entity information, entity relationship and business type;

[0029] Compare the semantic element information with the semantic element whitelist or blacklist. If the semantic element information is in the semantic element whitelist, determine that the user has semantic access rights; if the semantic element information is in the semantic element blacklist, determine that the user does not have semantic access rights, filter out illegal content in the user's questions, and remind the user to ask the question again.

[0030] In one embodiment, the resources in the knowledge base that the user is allowed to access are filtered by combining static permissions, dynamic permissions, and semantic permissions to obtain a list of resources that the user is allowed to access, including:

[0031] The intersection of static permissions, dynamic permissions, and semantic permissions is taken as the final permission. Based on the final permission, the resources in the knowledge base that the user is allowed to access are filtered to obtain a list of resources that the user is allowed to access.

[0032] In one embodiment, the resources include interface resources, graph resources, document resources, question and answer resources, and database resources.

[0033] A multi-level authority control access device for a large model knowledge base, the device comprising:

[0034] The login information acquisition module is used to obtain the role information, login environment information and user questions when the user logs into the knowledge base;

[0035] The static permission search module is used to search for the static permissions of users according to role information. Static permissions include resource permissions and hierarchical permissions. Resource permissions are used to determine user access permissions by building matching relationships between users and departments, users and projects, departments and resources, and projects and resources. Hierarchical permissions are used to determine user access permissions by building matching relationships between user permission levels, resource permission levels, user confidentiality levels, resource confidentiality levels and user roles.

[0036] Dynamic permission search module, used to search for dynamic permissions of users according to login environment information. Dynamic permissions are also called environment permissions. Environment permissions are used to determine user access permissions by building a matching relationship between user login environment factors and resource access environment factors.

[0037] A semantic permission search module is used to search for the user's semantic permission based on the user's question. The semantic permission is used to determine the user's access permission by comparing the semantic element information in the user's question with the semantic element whitelist or blacklist.

[0038] The multi-level permission filtering module is used to filter the resources that users can access in the knowledge base by combining static permissions, dynamic permissions, and semantic permissions, and obtain a list of resources that users can access. It also obtains the relevant background knowledge of the user's question by calculating the similarity between the list of resources that users can access and the user's question.

[0039] The answer generation review module is used to submit user questions and relevant background knowledge as context to the big model for answer generation, and submit the generated content, user questions, static permissions, dynamic permissions and semantic permissions to the big model for generated content review. If the review passes, the generated content will be displayed to the user as the final answer; if the review fails, the reason for failure will be fed back to the user.

[0040] A computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0041] Obtain the role information, login environment information, and user questions when the user logs into the knowledge base;

[0042] Find the user's static permissions based on role information. Static permissions include resource permissions and hierarchical permissions. Resource permissions are used to determine user access permissions by building matching relationships between users and departments, users and projects, departments and resources, and projects and resources. Hierarchical permissions are used to determine user access permissions by building matching relationships between user permission levels, resource permission levels, user confidentiality levels, resource confidentiality levels, and user roles.

[0043] Find the user's dynamic permissions based on the login environment information. Dynamic permissions are also called environment permissions. Environment permissions are used to determine the user's access permissions by building a matching relationship between the user's login environment factors and the environment factors that allow access to resources.

[0044] Search for the user's semantic permissions based on the user's question. The semantic permissions are used to determine the user's access permissions by comparing the semantic element information in the user's question with the semantic element whitelist or blacklist;

[0045] The static permissions, dynamic permissions and semantic permissions are combined to filter the resources that the user is allowed to access in the knowledge base, and a list of resources that the user is allowed to access is obtained. The relevant background knowledge of the user's question is obtained by calculating the similarity between the list of resources that the user is allowed to access and the user's question.

[0046] User questions and relevant background knowledge as context are submitted to the big model for answer generation, and the generated content, user questions, static permissions, dynamic permissions, and semantic permissions are submitted to the big model for generated content review. If the review passes, the generated content will be displayed to the user as the final answer; if the review fails, the reason for failure will be fed back to the user.

[0047] The above-mentioned large-model knowledge base multi-level permission control access method, device and equipment, by introducing resource permissions, hierarchical permissions, environmental permissions and semantic permissions in the process of user access to the knowledge base, can quickly retrieve relevant resources that match the user's access permissions from the knowledge base based on multi-level permission filtering, and the resource data that the user does not have the relevant access permissions will not be retrieved to enter the next question-and-answer process, which narrows the resource search scope and improves the speed and efficiency of resource retrieval in the knowledge base. At the same time, multi-level permission access control can effectively prevent unauthorized resource data leakage, and improve the security and intelligence of the knowledge base. In addition, through multi-level permission access control, more accurate resource matching can be performed according to the actual needs of users, which improves user satisfaction. It has good application prospects and practical value and can be widely used in large-scale knowledge base management systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 A flowchart of a multi-level authority control access method for a large model knowledge base in one embodiment;

[0049] Figure 2 A schematic diagram of the overall architecture of a multi-level permission control access method for a large model knowledge base in an embodiment;

[0050] Figure 3 A schematic diagram of a dynamic multi-level permission design in one embodiment;

[0051] Figure 4 A schematic diagram of resources in one embodiment;

[0052] Figure 5 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0054] In one embodiment, Figure 1 and Figure 2 As shown, a multi-level permission control access method for a large model knowledge base is provided, including the following steps:

[0055] Step S1, obtaining the role information, login environment information and user questions when the user logs into the knowledge base.

[0056] The login environment information includes login device, network, time and location.

[0057] Step S2, searching for the user's static permissions based on the role information, where the static permissions include resource permissions and hierarchical permissions; wherein, resource permissions are used to determine the user's access permissions by constructing a matching relationship between the user and the department, the user and the project, the department and the resource, and the project and the resource; hierarchical permissions are used to determine the user's access permissions by constructing a matching relationship between the user permission level, the resource permission level, the user confidentiality level, the resource confidentiality level and the user role.

[0058] Specifically, the specific process of resource permissions to determine user access rights includes:

[0059] The department to which the user belongs is recorded as the set Du, and the list of projects to which the user has access rights is recorded as the set Pu;

[0060] The list of projects to which the resources belong is recorded as set Pd, and the list of departments to which the resources belong is recorded as set Dd;

[0061] Construct resource permission judgment conditions, expressed as: and ;

[0062] If the resource permission judgment condition is met, it is judged that the user has the access permission to the corresponding resource; otherwise, it is judged that the user does not have the access permission.

[0063] It is understandable that Figure 3 As shown, resource permissions include permissions for specific resources or resource groups such as departments, projects, documents, and application programming interfaces. Resource permissions establish a corresponding relationship between the resources that users can access and users, and determine whether users have access permissions to the specified resources when they access the resources to determine whether to allow access to the resources. When a user initiates a knowledge question and answer session, the user's department and the list of projects with access permissions are searched to further find the list of resources that the user can access, thereby limiting the scope of the user's question and answer session to the specified scope of resources with permissions, thereby improving the speed and efficiency of resource retrieval.

[0064] Specifically, the hierarchical permissions include user level, confidentiality level and other hierarchical permissions. The specific process of judging user access rights by hierarchical permissions includes:

[0065] The user authority level is recorded as Lu, the resource authority level is recorded as Ld, the user confidentiality level is recorded as Su, the resource confidentiality level is recorded as Sd, the user role is recorded as Ru, and the user role allowed to access the resource is recorded as Rd;

[0066] Construct the hierarchical permission judgment conditions, expressed as: and and ;

[0067] When the hierarchical permission judgment condition is met, it is judged that the user has the access rights to the corresponding resources; otherwise, it is judged that the user does not have the access rights.

[0068] It can be understood that hierarchical permissions establish a correspondence between the user's access permission level and the accessible level of the accessed resource. When the user accesses the resource, it is determined whether the user's access permission level is higher than the accessible level of the resource. If so, access is allowed, otherwise access is not allowed.

[0069] Step S3, searching for the user's dynamic permissions based on the login environment information. Dynamic permissions are also called environmental permissions. Environmental permissions are used to determine the user's access permissions by building a matching relationship between the user's login environment factors and the environment factors that allow access to resources.

[0070] Specifically, environmental permissions include time, location, equipment and other environment-related permissions. The specific process of environmental permissions to determine user access rights includes:

[0071] User login environment factors include location environment factors, time environment factors, network environment factors and device environment factors;

[0072] The location environment factor is recorded as GEOu, the location that the resource is allowed to access is recorded as GEOd, the time environment factor is recorded as Tu, the time that the resource is allowed to access is recorded as Td, the network environment factor and the device environment factor are recorded as NETu and DEVu respectively, and the network and device that the resource is allowed to access are recorded as NETd and DEVd respectively;

[0073] The construction environment permission judgment condition is expressed as:

[0074] and and and ;

[0075] When the environment permission judgment condition is met, it is judged that the user has the access rights to the corresponding resources; otherwise, it is judged that the user does not have the access rights.

[0076] It can be understood that environmental permissions dynamically control access to the user's permissions to use the environmental factors of the knowledge base system. When the user logs in at a specified time, place, and device, the environmental permissions are automatically obtained. Environmental permissions can change dynamically according to different environments. Environmental permissions add dynamic factors such as time judgment, location judgment, and device judgment. At the same time, they also allow for user-related static resource permissions and grading options. Environmental permissions also need to obtain the intersection of permissions with the user's static permissions and semantic permissions as the final effective permissions.

[0077] Step S4, searching for the user's semantic authority according to the user's question, where the semantic authority is used to determine the user's access authority by comparing the semantic element information in the user's question with a semantic element whitelist or blacklist.

[0078] Specifically, semantic permissions include permissions such as time, entity, relationship, and business classification in the semantics of the user's question. The specific process of semantic permissions to determine user access rights includes:

[0079] Extracting semantic element information from user questions based on the big model; where the semantic element information includes time, entity information, entity relationship, business type and other information in the semantics of user questions;

[0080] Compare the semantic element information with the semantic element whitelist or blacklist. If the semantic element information is in the semantic element whitelist, determine that the user has semantic access rights; if the semantic element information is in the semantic element blacklist, determine that the user does not have semantic access rights, filter out illegal content in the user's questions, and remind the user to ask the question again.

[0081] It can be understood that the association between users and semantic elements can be maintained through a database table, allowing users to dynamically add or delete a whitelist of semantic elements that are allowed to be accessed, or a blacklist of semantic elements that are prohibited from being accessed. By judging the permissions of semantic elements, the prohibited content in users' natural language questions can be quickly filtered out and the users can be reminded.

[0082] Step S5, comprehensively filter the resources in the knowledge base that the user is allowed to access by using static permissions, dynamic permissions, and semantic permissions to obtain a list of resources that the user is allowed to access, and obtain relevant background knowledge about the user's question by calculating the similarity between the list of resources that the user is allowed to access and the user's question.

[0083] Specifically, the intersection of static permissions, dynamic permissions and semantic permissions is taken as the final permission, and the resources in the knowledge base that the user is allowed to access are filtered based on the final permission to obtain a list of resources that the user is allowed to access.

[0084] Understandably, through Figure 3The multi-level permissions shown can quickly retrieve and filter out relevant resources that match the user's access rights from the knowledge base, narrow the retrieval scope of resources, and improve the speed and efficiency of resource retrieval in the knowledge base. At the same time, multi-level permission control can effectively prevent unauthorized resource data leakage, thereby improving the security and intelligence of the knowledge base.

[0085] Step S6, submit the user's question and related background knowledge as the context to the big model for answer generation, and submit the generated content, user questions, static permissions, dynamic permissions and semantic permissions to the big model for generated content review. If the review passes, the generated content will be displayed to the user as the final answer; if the review fails, the reason for failure will be fed back to the user.

[0086] Furthermore, the resources mentioned in this application specifically refer to the knowledge sources in the large-scale knowledge question-answering scenario, such as Figure 4 As shown in the figure, the knowledge sources of the large-scale knowledge question-answering system usually include interface resources, graph resources, document resources, question-answering resources, and database resources. Among them, interface resources are interfaces that the knowledge management system needs to access, such as API (application programming interface), including interface definitions and description information. Graph resources are knowledge graph resources of the knowledge management system. Document resources are text document resources of various formats that the knowledge management system needs to access. Question-answering resources are question-answering (QA) data that the knowledge management system needs to access. Database resources are database resources that the knowledge management system needs to access, including relational databases, data warehouses, etc.

[0087] Among them, when users conduct knowledge Q&A through natural language, the big model can dynamically access the pre-determined external and content API interfaces, usually through the built-in FunctionCalling function of the big model, or vectorize the API description to obtain VectorAPI, and calculate the semantic similarity between VectorAPI and the user's question content vector (VectorQuery) to determine which API resource to call. The above-mentioned resource permissions, hierarchical permissions, and environmental permissions can effectively filter out API resources that do not have access permissions before calculating the API semantic similarity, thereby improving the efficiency of API resource Q&A.

[0088] When users conduct knowledge Q&A with natural language, document resources are usually segmented into document segments according to various segmentation algorithms during the knowledge construction phase. Vector Vd is calculated for each document segment and saved in the vector database. When answering document knowledge questions, the user question vector Qd is first calculated, and the background context related to the user's question is obtained by calculating the semantic similarity between Qd and Vd. The above-mentioned multi-level permission access control methods such as resource permissions, hierarchical permissions, environmental permissions, and semantic permissions can effectively filter out document resources that do not have permission to access before calculating the semantic similarity between user questions and documents, thereby improving the efficiency of document resource Q&A.

[0089] When users use natural language to conduct knowledge Q&A on graph resources, a domain knowledge graph is usually constructed and saved in the graph database during the knowledge construction phase. When answering questions on the knowledge graph, entity and relationship information is first extracted from the user's question, and then the knowledge graph is searched based on the extracted entities and relationships. The above-mentioned multi-level permission access control methods such as resource permissions, hierarchical permissions, environmental permissions, and semantic permissions can effectively filter out graph entities or relationships that do not have permission to access before or during the search of user questions in the knowledge graph, thereby improving the efficiency of knowledge graph resource Q&A.

[0090] When users conduct knowledge Q&A through natural language, Q&A resources usually automatically or manually generate a number of Q&A pairs and save them in the database during the knowledge construction stage. The vectors of Vq (the word vector of the question) and Va (the word vector of the answer) of the Q&A pair are calculated and saved in the vector database. When answering knowledge questions, the user question vector Qd is first calculated, and the background Q&A content related to the user's question is obtained by calculating the semantic similarity between Qd and Vq. The above-mentioned multi-level permission access control methods such as resource permissions, hierarchical permissions, environmental permissions, and semantic permissions can effectively filter out Q&A resources that do not have permission to access before calculating the semantic similarity between user questions and documents, thereby improving the efficiency of Q&A resources.

[0091] Without loss of generality, in the knowledge construction stage, the large model knowledge management system maintains the access permission relationship between users and interface resources, users and document resources, users and graph resources, users and question and answer resources, users and database or database table resources, and maintains the access permission relationship between environment and interface resources, environment and document resources, environment and graph resources, environment and question and answer resources, environment and database or database table resources, and saves these permission mapping relationships in the database for management and maintenance. In the large model knowledge question and answer stage, dynamic multi-level permission management and control of knowledge questions and answers can be realized, especially environmental permissions can dynamically obtain different permissions according to the time, location, network equipment, etc. of users using knowledge questions and answers, and semantic permissions can dynamically obtain semantic permissions according to the content of users using knowledge questions and answers.

[0092] In one embodiment, a multi-level authority control access device for a large model knowledge base is provided, comprising:

[0093] The login information acquisition module is used to obtain the role information, login environment information and user questions when the user logs into the knowledge base;

[0094] The static permission search module is used to search for the static permissions of users according to role information. Static permissions include resource permissions and hierarchical permissions. Resource permissions are used to determine user access permissions by building matching relationships between users and departments, users and projects, departments and resources, and projects and resources. Hierarchical permissions are used to determine user access permissions by building matching relationships between user permission levels, resource permission levels, user confidentiality levels, resource confidentiality levels and user roles.

[0095] Dynamic permission search module, used to search for dynamic permissions of users according to login environment information. Dynamic permissions are also called environment permissions. Environment permissions are used to determine user access permissions by building a matching relationship between user login environment factors and resource access environment factors.

[0096] A semantic permission search module is used to search for the user's semantic permission based on the user's question. The semantic permission is used to determine the user's access permission by comparing the semantic element information in the user's question with the semantic element whitelist or blacklist.

[0097] The multi-level permission filtering module is used to filter the resources that users can access in the knowledge base by combining static permissions, dynamic permissions, and semantic permissions, and obtain a list of resources that users can access. It also obtains the relevant background knowledge of the user's question by calculating the similarity between the list of resources that users can access and the user's question.

[0098] The answer generation review module is used to submit user questions and relevant background knowledge as context to the big model for answer generation, and submit the generated content, user questions, static permissions, dynamic permissions and semantic permissions to the big model for generated content review. If the review passes, the generated content will be displayed to the user as the final answer; if the review fails, the reason for failure will be fed back to the user.

[0099] For the specific definition of the large model knowledge base multi-level authority control access device, please refer to the definition of the large model knowledge base multi-level authority control access method above, which will not be repeated here. Each module in the above-mentioned large model knowledge base multi-level authority control access device can be implemented in whole or in part through software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0100] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 5 As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a multi-level authority control access method for a large model knowledge base is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covered on the display screen, or a button, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse, etc.

[0101] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0102] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0103] Obtain the role information, login environment information, and user questions when the user logs into the knowledge base;

[0104] Find the user's static permissions based on role information. Static permissions include resource permissions and hierarchical permissions. Resource permissions are used to determine user access permissions by building matching relationships between users and departments, users and projects, departments and resources, and projects and resources. Hierarchical permissions are used to determine user access permissions by building matching relationships between user permission levels, resource permission levels, user confidentiality levels, resource confidentiality levels, and user roles.

[0105] Find the user's dynamic permissions based on the login environment information. Dynamic permissions are also called environment permissions. Environment permissions are used to determine the user's access permissions by building a matching relationship between the user's login environment factors and the environment factors that allow access to resources.

[0106] Search for the user's semantic permissions based on the user's question. The semantic permissions are used to determine the user's access permissions by comparing the semantic element information in the user's question with the semantic element whitelist or blacklist;

[0107] The static permissions, dynamic permissions and semantic permissions are combined to filter the resources that the user is allowed to access in the knowledge base, and a list of resources that the user is allowed to access is obtained. The relevant background knowledge of the user's question is obtained by calculating the similarity between the list of resources that the user is allowed to access and the user's question.

[0108] User questions and relevant background knowledge as context are submitted to the big model for answer generation, and the generated content, user questions, static permissions, dynamic permissions, and semantic permissions are submitted to the big model for generated content review. If the review passes, the generated content will be displayed to the user as the final answer; if the review fails, the reason for failure will be fed back to the user.

[0109] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0110] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A multi-level authority control access method for a large model knowledge base, characterized in that: The method comprises: Obtain the role information, login environment information, and user questions when the user logs into the knowledge base; Search the user's static permissions according to the role information, the static permissions include resource permissions and hierarchical permissions; wherein the resource permissions are used to determine the user's access permissions by constructing matching relationships between users and departments, users and projects, departments and resources, and projects and resources; the hierarchical permissions are used to determine the user's access permissions by constructing matching relationships between user permission levels, resource permission levels, user confidentiality levels, resource confidentiality levels and user roles; Searching for the user's dynamic permissions based on the login environment information. The dynamic permissions are also called environment permissions. The environment permissions are used to determine the user's access permissions by building a matching relationship between the user's login environment factors and the environment factors that allow access to resources; Searching for the user's semantic authority based on the user's question, wherein the semantic authority is used to determine the user's access authority by comparing the semantic element information in the user's question with a semantic element whitelist or blacklist; The static permissions, dynamic permissions and semantic permissions are combined to filter the resources in the knowledge base that the user is allowed to access, and a list of resources that the user is allowed to access is obtained, and the relevant background knowledge of the user's question is obtained by calculating the similarity between the list of resources that the user is allowed to access and the user's question; Submit the user's question and the relevant background knowledge as the context to the big model for answer generation, and submit the generated content, user's question, static permissions, dynamic permissions and semantic permissions to the big model for generated content review. If the review passes, the generated content is displayed to the user as the final answer; if the review fails, the reason for failure is fed back to the user; The resources specifically refer to the knowledge sources in the large-scale knowledge question-answering scenario, including interface resources, graph resources, document resources, question-answering resources, and database resources; Among them, when the user conducts knowledge questions and answers through natural language, the big model dynamically accesses the pre-set external and content API interfaces, through the built-in FunctionCalling function of the big model, or vectorizes the API description to obtain VectorAPI, and calculates the semantic similarity between VectorAPI and the user's question content vector (VectorQuery) to determine which API resource to call, and filters out API resources that have no access permissions through the resource permissions, hierarchical permissions, environmental permissions, and semantic permissions before calculating the API semantic similarity; When users conduct knowledge question and answering in natural language, the document resources are segmented into document segments according to various segmentation algorithms in the knowledge construction stage, and the vector Vd is calculated for each document segment and saved in the vector database. When conducting knowledge question and answering in the document, the user question vector Qd is first calculated, and the background context content related to the user's question is obtained by calculating the semantic similarity between Qd and Vd, and the document resources that are not accessible are filtered out by the resource permissions, hierarchical permissions, environmental permissions and semantic permissions before calculating the semantic similarity; When a user asks a question in natural language, the graph resource constructs a domain knowledge graph in the knowledge construction stage and saves it in the graph database. When answering questions on the knowledge graph, first extract the entity and relationship information from the user's question, then search on the knowledge graph based on the extracted entities and relationships, and filter out graph entities or relationships that have no access permissions before or during the search in the knowledge graph through the resource permissions, hierarchical permissions, environmental permissions, and semantic permissions. When a user asks a question and answers knowledge through natural language, a number of question and answer pairs are generated in the knowledge construction stage and saved in the database. The word vector Vq of the question and the word vector Va of the answer are calculated and saved in the vector database. When asking a question and answering knowledge, the user question vector Qd is calculated first, and the background question and answer pair content related to the user's question is obtained by calculating the semantic similarity between Qd and Vq. Before calculating the semantic similarity, the resource permissions, hierarchical permissions, environmental permissions and semantic permissions are used to filter out the question and answer pair resources that do not have access permissions.

2. The method according to claim 1, characterized in that: The specific process of determining user access rights by using resource permissions includes: The department to which the user belongs is recorded as the set Du, and the list of projects to which the user has access rights is recorded as the set Pu; The list of projects to which the resources belong is recorded as set Pd, and the list of departments to which the resources belong is recorded as set Dd; Construct resource permission judgment conditions, expressed as: ; If the resource permission judgment condition is met, it is determined that the user has the access permission for the corresponding resource; otherwise, it is determined that the user does not have the access permission.

3. The method according to claim 1, characterized in that The specific process of determining user access rights by hierarchical permissions includes: The user authority level is recorded as Lu, the resource authority level is recorded as Ld, the user confidentiality level is recorded as Su, the resource confidentiality level is recorded as Sd, the user role is recorded as Ru, and the user role allowed to access the resource is recorded as Rd; Construct the hierarchical permission judgment conditions, expressed as: ; When the hierarchical authority judgment condition is met, it is judged that the user has the access authority to the corresponding resource; otherwise, it is judged that the user does not have the access authority.

4. The method according to claim 1, characterized in that The specific process of determining user access rights by the environment authority includes: The user login environment factors include location environment factors, time environment factors, network environment factors and device environment factors; The location environment factor is recorded as GEOu, the location that the resource is allowed to access is recorded as GEOd, the time environment factor is recorded as Tu, the time that the resource is allowed to access is recorded as Td, the network environment factor and the device environment factor are recorded as NETu and DEVu respectively, and the network and device that the resource is allowed to access are recorded as NETd and DEVd respectively; The construction environment permission judgment condition is expressed as: ； When the environmental authority judgment condition is met, it is judged that the user has the access rights to the corresponding resources; otherwise, it is judged that the user does not have the access rights.

5. The method according to claim 1, characterized in that: The specific process of determining user access rights by using semantic permissions includes: Extracting semantic element information in user questions based on the big model; wherein the semantic element information includes entity information, entity relationship and business type; The semantic element information is compared with the semantic element whitelist or blacklist. If the semantic element information is in the semantic element whitelist, it is determined that the user has semantic access rights; if the semantic element information is in the semantic element blacklist, it is determined that the user does not have semantic access rights, and illegal content in the user's questions is filtered out, and the user is reminded to ask the question again.

6. The method according to claim 1, characterized in that The static permissions, dynamic permissions, and semantic permissions are combined to filter the resources in the knowledge base that the user is allowed to access, and a list of resources that the user is allowed to access is obtained, including: The intersection of the static permission, the dynamic permission and the semantic permission is taken as the final permission, and the resources in the knowledge base that the user is allowed to access are filtered based on the final permission to obtain a list of resources that the user is allowed to access.

7. A multi-level authority control access device for a large model knowledge base, characterized in that: The device comprises: The login information acquisition module is used to obtain the role information, login environment information and user questions when the user logs into the knowledge base; A static permission search module is used to search for the static permission of the user according to the role information, wherein the static permission includes resource permission and hierarchical permission; wherein the resource permission is used to determine the user's access permission by constructing a matching relationship between the user and the department, the user and the project, the department and the resource, and the project and the resource; the hierarchical permission is used to determine the user's access permission by constructing a matching relationship between the user permission level, the resource permission level, the user confidentiality level, the resource confidentiality level and the user role; A dynamic permission search module is used to search for the user's dynamic permission according to the login environment information. The dynamic permission is also called the environment permission. The environment permission is used to determine the user's access permission by building a matching relationship between the user's login environment factors and the environment factors that allow access to resources. A semantic permission search module is used to search for the user's semantic permission according to the user's question. The semantic permission is used to determine the user's access permission by comparing the semantic element information in the user's question with the semantic element whitelist or blacklist; A multi-level permission filtering module is used to filter the resources in the knowledge base that the user is allowed to access by combining the static permissions, dynamic permissions and semantic permissions to obtain a list of resources that the user is allowed to access, and obtain relevant background knowledge of the user's question by calculating the similarity between the list of resources that the user is allowed to access and the user's question; The answer generation and review module is used to submit the user's question and the relevant background knowledge as the context to the big model for answer generation, and submit the generated content, user question, static permission, dynamic permission and semantic permission to the big model for generated content review. If the review is passed, the generated content is displayed to the user as the final answer; if the review is not passed, the reason for failure is fed back to the user; The resources specifically refer to the knowledge sources in the large-scale knowledge question-answering scenario, including interface resources, graph resources, document resources, question-answering resources, and database resources; Among them, when the user conducts knowledge questions and answers through natural language, the big model dynamically accesses the pre-set external and content API interfaces, through the built-in FunctionCalling function of the big model, or vectorizes the API description to obtain VectorAPI, and calculates the semantic similarity between VectorAPI and the user's question content vector (VectorQuery) to determine which API resource to call, and filters out API resources that have no access permissions through the resource permissions, hierarchical permissions, environmental permissions, and semantic permissions before calculating the API semantic similarity; When users conduct knowledge question and answering in natural language, the document resources are segmented into document segments according to various segmentation algorithms in the knowledge construction stage, and the vector Vd is calculated for each document segment and saved in the vector database. When conducting knowledge question and answering in the document, the user question vector Qd is first calculated, and the background context content related to the user's question is obtained by calculating the semantic similarity between Qd and Vd, and the document resources that are not accessible are filtered out by the resource permissions, hierarchical permissions, environmental permissions and semantic permissions before calculating the semantic similarity; When a user asks a question in natural language, the graph resource constructs a domain knowledge graph in the knowledge construction stage and saves it in the graph database. When answering questions on the knowledge graph, first extract the entity and relationship information from the user's question, then search on the knowledge graph based on the extracted entities and relationships, and filter out graph entities or relationships that have no access permissions before or during the search in the knowledge graph through the resource permissions, hierarchical permissions, environmental permissions, and semantic permissions. When a user asks a question and answers knowledge through natural language, a number of question and answer pairs are generated in the knowledge construction stage and saved in the database. The word vector Vq of the question and the word vector Va of the answer are calculated and saved in the vector database. When asking a question and answering knowledge, the user question vector Qd is calculated first, and the background question and answer pair content related to the user's question is obtained by calculating the semantic similarity between Qd and Vq. Before calculating the semantic similarity, the resource permissions, hierarchical permissions, environmental permissions and semantic permissions are used to filter out the question and answer pair resources that do not have access permissions.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

Images