User data isolation access control method and system based on HDFS

Abstract

The present invention relates to the technical field of permission control, and discloses a user data isolation access control method and system based on HDFS. The method comprises: extracting data from a user-specific permission set to obtain an operation permission data set, performing dynamic permission analysis on the operation permission data set to obtain a dynamic permission rule set; performing real-time calculation and continuous monitoring on the user identity information flow to obtain hierarchical collaborative preliminary access control decision data; performing context-aware verification and behavior pattern analysis on the hierarchical collaborative preliminary access control decision data to obtain confirmation data, performing permission matching based on the confirmation data and the knowledge graph of the dynamic permission rule set to obtain target access control decision data; performing fault response strategy analysis on the target access control decision data to obtain a temporary permission adjustment strategy corresponding to the target access control decision data. The present invention significantly improves the accuracy and reliability of access control decisions.

Description

Technical Field

[0001] The present invention relates to the technical field of authority control, and in particular to a user data isolation access control method and system based on HDFS. Background Art

[0002] In the current big data environment, HDFS (Hadoop Distributed File System) has become the preferred platform for many enterprises and organizations to store and manage massive data. In order to facilitate users to access data in HDFS, tools such as hdfs-over-ftp are usually used to allow users to access the HDFS file system through the FTP protocol. This method simplifies the data access process and improves data utilization efficiency. However, with the continuous expansion of data scale and the increase in the number of users, traditional access control methods face many challenges. Static permission configuration is difficult to adapt to dynamically changing business needs, coarse-grained access control cannot meet the requirements of refined data isolation, and simple identity authentication mechanisms are difficult to cope with increasingly complex security threats.

[0003] The deficiencies in existing technologies are mainly reflected in the following aspects: First, the traditional permission control mechanism lacks flexibility and cannot dynamically adjust the permission policy according to the user's behavior pattern and system load. Secondly, the existing access control methods often ignore the importance of contextual information and user behavior patterns, which makes it difficult to make accurate access control decisions under abnormal circumstances. Furthermore, most systems lack effective fault response mechanisms and are unable to adjust permission policies in time to reduce risks when faced with potential system failures or security threats. Finally, existing permission management methods are usually isolated and lack the coordinated optimization of permission policies at different levels (such as file level, directory level, and operation level), making it difficult to achieve comprehensive and sophisticated data isolation control. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides a user data isolation access control method and system based on HDFS, which are used to improve the accuracy and security of access control decisions of existing access control methods.

[0005] The present invention provides a user data isolation access control method based on HDFS, comprising: performing identity authentication and role authority extraction on a login request initiated by a user through an FTP client to obtain a user identity information flow; performing authority matrix construction on the user identity information flow to obtain a user-specific authority set, wherein the step of performing authority matrix construction on the user identity information flow to obtain a user-specific authority set comprises: performing data parsing on the user identity information flow to obtain a user role identifier and target authority level data, and performing role authority template matching on the user role identifier to obtain a basic authority matrix; performing numerical mapping processing on the target authority level data to obtain an authority level coefficient, and matching the basic authority matrix with the target authority level data. The method comprises the steps of: performing a matrix multiplication operation on the basic permission matrix and the permission level coefficient to obtain a preliminary adjustment permission matrix; performing feature extraction on the user historical behavior data corresponding to the user identity information flow to obtain a user behavior feature vector, and performing weight assignment on the user behavior feature vector to obtain a behavior weight coefficient; performing element-level multiplication operation on the preliminary adjustment permission matrix and the behavior weight coefficient to obtain a target permission matrix, and performing threshold filtering on the target permission matrix to obtain a candidate permission item set; performing conflict detection on the candidate permission item set to obtain a non-conflicting permission item list, and performing structured encapsulation on the non-conflicting permission item list to obtain a user-specific permission set; and performing element-level multiplication operation on the user-specific permission set to obtain a target permission matrix, and performing threshold filtering on the target permission matrix to obtain a candidate permission item set. Data extraction, to obtain an operation permission data set, wherein the operation permission data set includes: read permission data, write permission data and delete permission data, and dynamic permission analysis is performed on the operation permission data set to obtain a dynamic permission rule set, specifically including: structural analysis of the user-specific permission set to obtain a permission item list, and operation type classification of the permission item list to obtain a preliminary operation permission data set; fine-grained division of the preliminary operation permission data set to obtain read permission data, write permission data and delete permission data, and data correlation analysis of the read permission data, write permission data and delete permission data to obtain a permission dependency graph; and permission dependency The relationship graph is traversed to obtain a set of permission propagation paths, and the permission propagation path set is optimized to obtain a simplified permission propagation model; the simplified permission propagation model is analyzed in time series to obtain permission change trend data, and the permission change trend data is predicted and extrapolated to obtain permission evolution prediction results; the permission evolution prediction results are extracted from rules to obtain a candidate dynamic permission rule set, and the candidate dynamic permission rule set is conflict resolved and prioritized to obtain a dynamic permission rule set; the user identity information flow is calculated and continuously monitored in real time through the user-specific permission set and the dynamic permission rule set to obtain hierarchical and collaborative preliminary access control decision data;Perform context-aware verification and behavior pattern analysis on the hierarchical collaborative preliminary access control decision data to obtain confirmation data, and perform permission matching based on the confirmation data and the knowledge graph of the dynamic permission rule set to obtain target access control decision data; perform fault response strategy analysis on the target access control decision data to obtain a temporary permission adjustment strategy corresponding to the target access control decision data. ;

[0006] The present invention also provides a user data isolation access control system based on HDFS, comprising:

[0007] The extraction module is used to authenticate the login request initiated by the user through the FTP client and extract the role permissions to obtain the user identity information flow;

[0008] A construction module is used to construct a permission matrix for the user identity information flow to obtain a user-specific permission set. The step of constructing a permission matrix for the user identity information flow to obtain a user-specific permission set includes: performing data parsing on the user identity information flow to obtain user role identification and target permission level data, and performing role permission template matching on the user role identification to obtain a basic permission matrix; performing numerical mapping processing on the target permission level data to obtain a permission level coefficient, and performing matrix multiplication operation on the basic permission matrix and the permission level coefficient to obtain a preliminary adjustment permission matrix; performing feature extraction on the user historical behavior data corresponding to the user identity information flow to obtain a user behavior feature vector, and performing weight assignment on the user behavior feature vector to obtain a behavior weight coefficient; performing element-level multiplication operation on the preliminary adjustment permission matrix and the behavior weight coefficient to obtain a target permission matrix, and performing threshold filtering on the target permission matrix to obtain a candidate permission item set; performing conflict detection on the candidate permission item set to obtain a non-conflicting permission item list, and structurally encapsulating the non-conflicting permission item list to obtain a user-specific permission set;

[0009] The analysis module is used to extract data from the user-specific permission set to obtain an operation permission data set, wherein the operation permission data set includes: read permission data, write permission data and delete permission data, and perform dynamic permission analysis on the operation permission data set to obtain a dynamic permission rule set, which specifically includes: performing structured analysis on the user-specific permission set to obtain a permission item list, and classifying the permission item list by operation type to obtain a preliminary operation permission data set; performing fine-grained division on the preliminary operation permission data set to obtain read permission data, write permission data and delete permission data, and classifying the read permission data , perform data correlation analysis on write permission data and delete permission data to obtain a permission dependency graph; perform graph traversal processing on the permission dependency graph to obtain a permission propagation path set, and perform path optimization on the permission propagation path set to obtain a simplified permission propagation model; perform time series analysis on the simplified permission propagation model to obtain permission change trend data, and perform predictive extrapolation on the permission change trend data to obtain permission evolution prediction results; perform rule extraction on the permission evolution prediction results to obtain a candidate dynamic permission rule set, and perform conflict resolution and priority sorting on the candidate dynamic permission rule set to obtain a dynamic permission rule set;

[0010] A monitoring module, used to perform real-time calculation and continuous monitoring of the user identity information flow through the user-specific permission set and the dynamic permission rule set to obtain hierarchical and collaborative preliminary access control decision data;

[0011] A matching module, used to perform context-aware verification and behavior pattern analysis on the hierarchical collaborative preliminary access control decision data to obtain confirmation data, and perform permission matching based on the confirmation data and the knowledge graph of the dynamic permission rule set to obtain target access control decision data;

[0012] The adjustment module is used to perform a fault response strategy analysis on the target access control decision data to obtain a temporary permission adjustment strategy corresponding to the target access control decision data.

[0013] In the technical solution provided by the present invention, by performing identity authentication and role authority extraction on the login request initiated by the user through the FTP client, a user identity information flow is obtained, which realizes accurate identification of the user identity and preliminary authority division, and lays a foundation for subsequent refined authority control; a permission matrix is ​​constructed for the user identity information flow to obtain a user-specific permission set, which realizes personalized customization of permissions, so that the system can flexibly configure access permissions according to the characteristics and needs of different users; thirdly, by performing data extraction on the user-specific permission set, an operation permission data set containing read permission data, write permission data and delete permission data is obtained, and a dynamic permission analysis is performed on it to obtain a dynamic permission rule set, so that the system can respond to user behavior and environmental changes in real time, dynamically adjust the permission strategy, and improve the adaptability and security of the system; in addition, by using the user-specific permission set and dynamic permission rule set, the system can dynamically adjust the permission strategy, and improve the adaptability and security of the system. The dynamic permission rule set calculates and continuously monitors the user identity information flow in real time to obtain hierarchical and collaborative preliminary access control decision data, realizing multi-level and comprehensive permission control and ensuring refined management of data access; further, the hierarchical and collaborative preliminary access control decision data is context-awarely verified and analyzed in terms of behavior patterns to obtain confirmation data, and permission matching is performed based on the confirmation data and the knowledge graph of the dynamic permission rule set to obtain target access control decision data, which fully considers environmental factors and user behavior patterns and greatly improves the accuracy and reliability of access control decisions; finally, by analyzing the fault response strategy of the target access control decision data, the corresponding temporary permission adjustment strategy is obtained, which enhances the fault tolerance and security of the system, enabling it to respond quickly to potential faults or security threats, dynamically adjust permission strategies, and minimize risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0015] Figure 1 This is a flow chart of a method for user data isolation access control based on HDFS in an embodiment of the present invention;

[0016] Figure 2 The figure is a schematic diagram of a user data isolation access control system based on HDFS in an embodiment of the present invention. DETAILED DESCRIPTION

[0017] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0018] In the description of the present invention, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc., indicating the orientation or positional relationship, are based on the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", and "third" are used for descriptive purposes only, and cannot be understood as indicating or implying relative importance.

[0019] In addition, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0020] For ease of understanding, the specific process of the embodiment of the present invention is described below. Figure 1 , Figure 1 : is a flow chart of a method for user data isolation access control based on HDFS according to an embodiment of the present invention. Figure 1 As shown, the following steps are included:

[0021] S101, performing identity authentication and role authority extraction on a login request initiated by a user through an FTP client to obtain a user identity information flow;

[0022] S102, constructing a permission matrix for the user identity information flow to obtain a user-specific permission set;

[0023] S103, extracting data from the user-specific permission set to obtain an operation permission data set, wherein the operation permission data set includes: read permission data, write permission data, and delete permission data, and performing dynamic permission analysis on the operation permission data set to obtain a dynamic permission rule set;

[0024] S104, performing real-time calculation and continuous monitoring of user identity information flow through user-specific permission sets and dynamic permission rule sets to obtain hierarchical and collaborative preliminary access control decision data;

[0025] S105, performing context-aware verification and behavior pattern analysis on the hierarchical collaborative preliminary access control decision data to obtain confirmation data, and performing permission matching based on the confirmation data and the knowledge graph of the dynamic permission rule set to obtain target access control decision data;

[0026] S106: Perform fault response strategy analysis on the target access control decision data to obtain a temporary permission adjustment strategy corresponding to the target access control decision data.

[0027] It should be noted that the user identity information flow is obtained by performing identity authentication and role authority extraction on the login request initiated by the user through the FTP client. This process involves operations such as parsing the login request, password encryption, database matching query, role association analysis, and authority level division. For example, when the user "Alice" initiates a login request through the FTP client, the system will verify her username and password, and extract her role information (such as "data analyst") and preliminary authority level. Subsequently, the authority matrix is ​​constructed for the user identity information flow to obtain a user-specific authority set. It includes processes such as data parsing, role authority template matching, authority level coefficient calculation, and user behavior feature extraction. For example, for "Alice", the system will match the corresponding authority template according to her "data analyst" role, and generate a specific authority matrix based on her authority level and historical behavior data.

[0028] Next, data is extracted from the user-specific permission set to obtain an operation permission data set, including read permission data, write permission data, and delete permission data. Then, dynamic permission analysis is performed on the operation permission data set to obtain a dynamic permission rule set. This process involves steps such as building a permission item catalog, classifying operation types, analyzing permission dependencies, and optimizing permission propagation paths. For example, the system may analyze the access pattern of "Alice" to different types of data files, build a permission dependency graph, and predict the changes in permissions that may be needed in the future through time series analysis.

[0029] Subsequently, the user identity information flow is calculated and continuously monitored in real time through the user-specific permission set and dynamic permission rule set to obtain the hierarchical collaborative preliminary access control decision data. This includes real-time analysis of user operation requests, rapid indexing of permission data, rule matching, permission synthesis calculation, and multi-dimensional cross-validation. For example, when "Alice" tries to access a new data set, the system will calculate her access rights in real time, consider static permissions and dynamic rules, and perform multi-level permission strategy collaborative optimization. Then, the hierarchical collaborative preliminary access control decision data is context-awarely verified and analyzed for behavior patterns to obtain confirmation data, and permission matching is performed based on the confirmation data and the knowledge graph of the dynamic permission rule set to obtain the target access control decision data. This process involves operations such as context information extraction, anomaly detection, user behavior pattern analysis, knowledge graph construction and query. For example, the system will analyze whether "Alice's" current operating environment (such as time, location, and equipment) is abnormal, and compare her current behavior with historical behavior patterns to ensure the legitimacy of the access request.

[0030] Finally, the target access control decision data is analyzed for fault response strategies to obtain the temporary permission adjustment strategy corresponding to the target access control decision data. This includes fault scenario simulation, risk level assessment, fault tree construction, critical path analysis, and permission impact assessment. For example, the system simulates possible fault conditions, such as network outages or data node failures, assesses the impact of these failures on Alice's current operations, and formulates corresponding temporary permission adjustment strategies to ensure data security and operational continuity.

[0031] By executing the above steps, the user's login request initiated through the FTP client is authenticated and the role permission is extracted to obtain the user identity information flow, which realizes the accurate identification of the user identity and the preliminary permission division, laying the foundation for the subsequent refined permission control; the permission matrix of the user identity information flow is constructed to obtain the user-specific permission set, which realizes the personalized customization of permissions, so that the system can flexibly configure access rights according to the characteristics and needs of different users; thirdly, by extracting data from the user-specific permission set, an operation permission data set containing read permission data, write permission data and delete permission data is obtained, and a dynamic permission analysis is performed on it to obtain a dynamic permission rule set, so that the system can respond to user behavior and environmental changes in real time, dynamically adjust the permission strategy, and improve the adaptability and security of the system; in addition, by using the user-specific permission set and dynamic permission The limited rule set calculates and continuously monitors the user identity information flow in real time to obtain hierarchical and collaborative preliminary access control decision data, realizing multi-level and comprehensive permission control and ensuring refined management of data access; further, the hierarchical and collaborative preliminary access control decision data is context-aware verified and analyzed for behavior patterns to obtain confirmation data, and permission matching is performed based on the confirmation data and the knowledge graph of the dynamic permission rule set to obtain the target access control decision data, which fully considers environmental factors and user behavior patterns and greatly improves the accuracy and reliability of access control decisions; finally, by analyzing the fault response strategy of the target access control decision data, the corresponding temporary permission adjustment strategy is obtained, which enhances the fault tolerance and security of the system, enabling it to respond quickly to potential faults or security threats, dynamically adjust permission strategies, and minimize risks.

[0032] In a specific embodiment, the process of executing step S101 may specifically include the following steps:

[0033] (1) Parse the data packet of the login request sent by the user through the FTP client to obtain the original login information including the user name and password, and perform secure hash processing on the password in the original login information to obtain encrypted password data;

[0034] (2) Perform a database matching query on the user name and encrypted password data to obtain the user's basic identity information, and perform role association analysis on the user's basic identity information to obtain the user's role type data;

[0035] (3) Divide the user role type data into permission levels to obtain preliminary permission level data, and conduct historical behavior correlation analysis on the preliminary permission level data to obtain user credit score data;

[0036] (4) Perform threshold comparison processing on the user's credit score data to obtain the permission adjustment factor, and perform weighted calculation on the preliminary permission level data and the permission adjustment factor to obtain the target permission level data;

[0037] (5) Perform a structured combination of user basic identity information, user role type data, and target permission level data to obtain a user identity information flow.

[0038] Specifically, the FTP protocol data packet is deconstructed to extract key information such as the username and password. For example, when the user enters the username "datauser01" and the password "Pass@123", the packet parser extracts this information from the USER and PASS commands of the FTP protocol. Subsequently, the password in the original login information is securely hashed to obtain the encrypted password data. The SHA-256 hash algorithm is used here, which can convert input of any length into a fixed-length 256-bit output, greatly increasing the difficulty of password cracking. Next, the username and encrypted password data are matched in the database to obtain the user's basic identity information. This step uses the pre-established user information database to quickly locate and return matching user records through SQL query statements. The user's basic identity information usually includes basic attributes such as user ID, name, department, and position. Then, the user's basic identity information is analyzed for role association to obtain user role type data. This process involves the application of the role-based access control (RBAC) model to associate users with predefined roles (such as ordinary users, administrators, data analysts, etc.).

[0039] Subsequently, the user role type data is divided into permission levels to obtain preliminary permission level data. Based on different roles, users are assigned different levels of initial permissions. For example, ordinary users may be given level 1 permissions, while data analysts may be given level 3 permissions. Next, the preliminary permission level data is analyzed for historical behavior association to obtain user credit score data. This process involves statistics and evaluation of the user's operation behavior over a period of time (such as 30 days), including login frequency, data access mode, and whether there are abnormal operations. Through these indicators, a comprehensive user credit score is calculated. Then, the user credit score data is processed by threshold comparison to obtain the permission adjustment factor. The user credit score is compared with the preset threshold, and a permission adjustment factor is determined based on the score. For example, if the user's credit score exceeds 90 points (out of 100 points), a positive adjustment factor of 1.2 may be obtained; and if the score is less than 60 points, a negative adjustment factor of 0.8 may be obtained. Next, the preliminary permission level data and the permission adjustment factor are weighted to obtain the target permission level data. This calculation process takes into account the user's basic permissions and credit status to produce a more accurate final permission level.

[0040] Finally, the user's basic identity information, user role type data, and target permission level data are structured and combined to obtain the user identity information flow. The results of all previous processing are integrated into a unified data structure to facilitate subsequent permission control and data access management.

[0041] For example: Suppose a data analyst Alice logs into the HDFS system through an FTP client. The system first parses her login request and obtains the username "alice_analyst" and the password hashed with SHA-256. The database matching query confirms Alice's identity and associates it with the role of "data analyst". Based on the role, Alice is assigned a preliminary permission level of 4 (out of 5). The system then analyzes Alice's behavioral data over the past 30 days and finds that she has frequent data access records but no abnormal operations, so her credit score is calculated to be 88 points. This score is compared with the threshold to obtain a permission adjustment factor of 1.1. Multiply the preliminary permission level 4 by 1.1 to obtain the final target permission level 4.4. Finally, the system combines Alice's basic identity information (ID, department, etc.), role type (data analyst), and target permission level (4.4) into a structured user identity information flow.

[0042] In a specific embodiment, the process of executing step S102 may specifically include the following steps:

[0043] (1) Perform data analysis on the user identity information flow to obtain the user role identification and target permission level data, and perform role permission template matching on the user role identification to obtain the basic permission matrix;

[0044] (2) Perform numerical mapping on the target permission level data to obtain the permission level coefficient, and perform matrix multiplication on the basic permission matrix and the permission level coefficient to obtain the preliminary adjustment permission matrix;

[0045] (3) Extract features from the user's historical behavior data corresponding to the user identity information flow to obtain a user behavior feature vector, and assign weights to the user behavior feature vector to obtain a behavior weight coefficient;

[0046] (4) Perform element-wise multiplication on the preliminary adjustment permission matrix and the behavior weight coefficient to obtain the target permission matrix, and perform threshold filtering on the target permission matrix to obtain a set of candidate permission items;

[0047] (5) Perform conflict detection on the candidate permission item set to obtain a list of non-conflicting permission items, and perform structured encapsulation on the list of non-conflicting permission items to obtain a user-specific permission set.

[0048] It should be noted that the user identity information flow is structured and parsed to extract the user role identifier and target permission level data. The user role identifier is a unique string used to represent the user's role type in the system, such as "data analyst", "system administrator", etc. The target permission level data is a numerical value that represents the user's comprehensive permission level, usually ranging from 0 to 1. Subsequently, the user role identifier is matched with the role permission template to obtain the basic permission matrix. This process involves a predefined role permission template library, where each role corresponds to a permission matrix that describes the role's access rights to different resources. Next, the target permission level data is numerically mapped to obtain the permission level coefficient. This mapping process converts the target permission level into a weight factor for subsequent permission adjustment. Then, matrix multiplication is performed on the basic permission matrix and the permission level coefficient to obtain a preliminary adjustment permission matrix. This achieves a detailed adjustment of the basic role permissions based on the user's specific permission level.

[0049] Subsequently, the user's historical behavior data corresponding to the user identity information flow is feature extracted to obtain the user behavior feature vector. This process involves statistics and analysis of the user's operation behavior over a period of time, including but not limited to multiple dimensions such as access frequency, data volume, and operation type. The feature extraction uses a sliding window method to ensure that the user's recent behavior pattern is captured. Next, the user behavior feature vector is weighted to obtain the behavior weight coefficient. The weight assignment is based on a pre-defined importance scoring standard, assigning different weights to different behavior features. Then, the preliminary adjustment permission matrix and the behavior weight coefficient are element-wise multiplied to obtain the target permission matrix. Taking into account the impact of the user's historical behavior on permissions, more personalized permission control is achieved. Next, the target permission matrix is ​​threshold filtered to obtain a set of candidate permission items. Threshold filtering sets a minimum permission value, and only permission items that exceed this threshold will be retained in the candidate set.

[0050] Finally, the candidate permission item set is conflict-checked to obtain a list of non-conflicting permission items. Conflict detection mainly resolves possible conflicts between different permission items to ensure that the final permission setting logic is consistent. Subsequently, the list of non-conflicting permission items is structured and encapsulated to obtain a user-specific permission set. This permission set is a structured data object that contains all operations that the user can perform and their corresponding permission levels.

[0051] For example, assume that the identity information flow of a data analyst user Alice contains the role identifier "DATA_ANALYST" and the target permission level 0.85. The system first matches the basic permission matrix of the "DATA_ANALYST" role, which may contain read and write permissions for different data directories in HDFS. For example, the read and write permissions for the public data directory are 1, the read permission for the sensitive data directory is 0.7, and the write permission is 0. Then, the system maps 0.85 to the permission level coefficient 1.1, multiplies it with the basic permission matrix, and obtains the preliminary adjustment permission matrix. Next, the system analyzes Alice's behavior data for the past 30 days and extracts feature vectors, such as the average number of daily visits of 50 times, the data read volume of 5GB, and the data written volume of 0.5GB. Based on these features, the system calculates the behavior weight coefficient of 1.05. The preliminary adjustment permission matrix is ​​multiplied by 1.05 to obtain the target permission matrix. After threshold filtering (assuming the threshold is 0.6), the system obtains a set of candidate permission items, including read and write permissions for public data and read permissions for sensitive data. Conflict detection ensures that there are no contradictions between these permission items, and finally encapsulates these permissions into a user-specific permission set as the basis for Alice to access data in HDFS.

[0052] In a specific embodiment, the process of executing step S103 may specifically include the following steps:

[0053] (1) Perform structured analysis on the user's specific permission set to obtain a permission item list, and classify the permission item list by operation type to obtain a preliminary operation permission data set;

[0054] (2) Fine-grained division of the preliminary operation permission data set to obtain read permission data, write permission data, and delete permission data, and data correlation analysis is performed on the read permission data, write permission data, and delete permission data to obtain a permission dependency graph;

[0055] (3) Perform graph traversal on the permission dependency graph to obtain a set of permission propagation paths, and then optimize the permission propagation path set to obtain a simplified permission propagation model;

[0056] (4) Perform time series analysis on the simplified permission propagation model to obtain permission change trend data, and perform forecasting and extrapolation on the permission change trend data to obtain permission evolution prediction results;

[0057] (5) Perform rule extraction on the permission evolution prediction results to obtain a candidate dynamic permission rule set, and perform conflict resolution and priority sorting on the candidate dynamic permission rule set to obtain a dynamic permission rule set.

[0058] Specifically, the user-specific permission set is converted into a permission item catalog, which contains the user's access rights to various directories and files in HDFS. Subsequently, the permission item catalog is classified by operation type, and the permission items are grouped according to operation types such as read, write, and delete to obtain a preliminary operation permission data set. This data set clearly shows the distribution of user permissions under different operation types. Next, the preliminary operation permission data set is fine-grained to obtain read permission data, write permission data, and delete permission data. This division makes permission control more refined and can implement different permission policies for different operation types. Then, the data correlation analysis of these three types of permission data is performed to obtain a permission dependency graph. This graph describes the dependency and association between different permissions. For example, the delete permission usually depends on the write permission, and the write permission may depend on the read permission.

[0059] The permission dependency graph is traversed and the depth-first search algorithm is used to obtain the permission propagation path set. This path set shows how permissions are transmitted and influenced between different operations and resources. Subsequently, the permission propagation path set is optimized to remove redundant and circular paths and obtain a simplified permission propagation model. This model is more concise and efficient, and is convenient for subsequent analysis and prediction. Then, the simplified permission propagation model is analyzed in time series, and the moving average method and exponential smoothing method are used to obtain permission change trend data. These data reflect the changing rules of user permissions over time. Next, the permission change trend data is predicted and extrapolated, and the ARIMA (autoregressive integrated moving average) model is used to obtain the permission evolution prediction results. This prediction result shows the possible changing trend of user permissions in the future.

[0060] Finally, the rule extraction is performed on the permission evolution prediction results, and the decision tree algorithm is used to obtain the candidate dynamic permission rule set. This rule set contains dynamic permission adjustment rules generated based on the prediction results. Subsequently, the candidate dynamic permission rule set is conflict resolved and prioritized, and the rule priority scoring mechanism is used to obtain the final dynamic permission rule set. This rule set will be used to adjust user permissions in real time to adapt to changing access needs and security requirements.

[0061] For example, suppose a data scientist user Bob has the following initial permissions in HDFS: read and write permissions for the " / data / public" directory, read permissions for the " / data / sensitive" directory, and read and delete permissions for the " / data / archive" directory. First, these permissions are parsed into a permission item list, and then classified by operation type to obtain a preliminary operation permission data set. After fine-grained division, specific read, write, and delete permission data are obtained. Data association analysis shows that Bob's delete permission depends on the read permission, forming a permission dependency graph. After graph traversal processing, the permission propagation path is obtained, such as read permission → write permission → delete permission. Path optimization removes some redundant paths and obtains a simplified model. Time series analysis of Bob's permission changes in the past three months shows that his access frequency to the " / data / sensitive" directory has gradually increased. Using the ARIMA model forecast, it is inferred that Bob may need write permission for the " / data / sensitive" directory in the next month. Based on this prediction, rule extraction generated a candidate rule: "If the user reads the sensitive data directory more than 100 times in a month, consider granting write permission." After conflict resolution and priority sorting, this rule was included in the dynamic permission rule set with a medium priority.

[0062] In a specific embodiment, the process of executing step S104 may specifically include the following steps:

[0063] (1) Perform real-time analysis on the user identity information flow to obtain the current user operation request data, and identify the operation type of the current user operation request data to obtain the operation type identifier;

[0064] (2) Quickly index the user-specific permission set to obtain static permission data corresponding to the operation type identifier, and perform rule matching on the dynamic permission rule set to obtain applicable dynamic permission adjustment parameters;

[0065] (3) Perform permission synthesis calculation on static permission data and dynamic permission adjustment parameters to obtain preliminary permission decision results, and perform multi-dimensional cross-validation on the preliminary permission decision results to obtain permission consistency scores;

[0066] (4) Perform threshold judgment on the permission consistency score to obtain the permission decision credibility index, and adjust the preliminary permission decision result according to the permission decision credibility index to obtain the revised permission decision data;

[0067] (5) The revised permission decision data is processed in layers to obtain a multi-level permission strategy including file level, directory level and operation level, and the multi-level permission strategy is collaboratively optimized to obtain hierarchical and collaborative preliminary access control decision data.

[0068] Specifically, the user identity information flow is parsed to extract the current user operation request data, including user ID, request timestamp, target resource path, etc. Subsequently, the operation type of the current user operation request data is identified to obtain the operation type identifier, such as READ, WRITE, DELETE, etc. This process uses regular expression matching technology to quickly identify the operation type. Next, the user-specific permission set is quickly indexed, and a hash table structure is used to use the operation type identifier as the key to quickly retrieve the corresponding static permission data. At the same time, the dynamic permission rule set is matched, and the decision tree algorithm is used to obtain the applicable dynamic permission adjustment parameters. This process takes into account dynamic characteristics such as the user's historical behavior and time factors.

[0069] Then, the static permission data and dynamic permission adjustment parameters are combined to obtain the preliminary permission decision result. This calculation process can be expressed by the following formula:

[0070] in, This is the preliminary authority decision result. For static permission data, Adjust parameters for dynamic permissions.

[0071] Subsequently, the preliminary authority decision results are cross-validated in multiple dimensions, and the authority consistency score is obtained using the random forest algorithm. This score reflects the consistency between the decision results and the historical decision-making pattern. The score calculation formula is as follows:

[0072] in, Score permissions consistency, To verify the number of dimensions, For the The weight of the dimension, For the The consistency scores of the dimensions.

[0073] Next, a threshold is determined for the permission consistency score to obtain the permission decision credibility index. The judgment formula is:

[0074] in, is the credibility indicator of authority decision, is the preset threshold. The preliminary authority decision result is adjusted according to the authority decision credibility index to obtain the revised authority decision data. =1, the initial decision result remains unchanged; if =0, additional security checks or lowering of the permission level are required. Finally, the revised permission decision data is processed hierarchically to obtain a multi-level permission strategy including file level, directory level and operation level. File-level permissions control access to a single file, directory-level permissions control access to the entire directory, and operation-level permissions control specific types of operations. These multi-level permission strategies are collaboratively optimized using a linear programming algorithm to obtain hierarchical collaborative preliminary access control decision data.

[0075] For example, suppose data scientist Carol initiates a write request through the HDFS client to write a new data file to the " / data / projects / ML_model / " directory. The system first parses Carol's identity information flow and recognizes that this is a WRITE operation. A quick index of Carol's static permission set shows that she has 0.8 write permissions for the directory (out of 1.0). Dynamic rule matching shows that because Carol recently successfully completed an important project, her dynamic permission adjustment parameter is 0.1.

[0076] Calculated using the permission synthesis formula: R = 0.8 × (1 + 0.1) = 0.88. Multi-dimensional cross-validation takes into account factors such as Carol's historical behavior, current time (working hours), and requested file size, and obtains a permission consistency score of 0.95. Assuming the threshold is set to 0.9, then T = 1, indicating that this decision is credible.

[0077] After layered processing, the following permission policies are obtained: file level - allow writing new files; directory level - allow creating new files in the " / data / projects / ML_model / " directory; operation level - allow WRITE operations. Collaborative optimization ensures that there are no conflicts between these policies, and ultimately forms a comprehensive access control decision that allows Carol to perform this write operation.

[0078] In a specific embodiment, the process of executing step S105 may specifically include the following steps:

[0079] (1) Extract context information from the hierarchical collaborative preliminary access control decision data to obtain an operating environment feature vector, and perform anomaly detection on the operating environment feature vector to obtain an environmental anomaly index;

[0080] (2) Perform time series analysis on the user's historical operation logs to obtain the user's behavior pattern characteristics, and calculate the similarity between the user's behavior pattern characteristics and the current operation to obtain a behavior consistency score;

[0081] (3) Perform weighted fusion on the environmental abnormality index and the behavior consistency score to obtain contextual credibility data, and perform threshold judgment on the contextual credibility data to obtain confirmation data;

[0082] (4) Construct a knowledge graph for the dynamic permission rule set to obtain a permission relationship knowledge graph, and perform a subgraph query on the permission relationship knowledge graph based on the confirmation data to obtain a candidate permission rule subset;

[0083] (5) Match the candidate permission rule subsets with the hierarchical collaborative preliminary access control decision data to obtain a refined permission strategy, resolve conflicts and prioritize the refined permission strategy to obtain the target access control decision data.

[0084] Specifically, the operating environment features, including access time, IP address, device type and other information, are extracted from the preliminary access control decision data to form an operating environment feature vector. Subsequently, the isolation forest algorithm is used to detect anomalies on this feature vector to obtain an environmental anomaly index. This index reflects the degree of deviation between the current operating environment and the user's normal operating environment. The user's historical operation logs are analyzed in time series, and the long short-term memory network (LSTM) algorithm is used to extract user behavior pattern features. These features include operation frequency, data access mode, common command sequence, etc. Then, the cosine similarity algorithm is used to calculate the similarity between the user behavior pattern features and the current operation to obtain a behavior consistency score. This score reflects the degree of match between the current operation and the user's historical behavior pattern.

[0085] Subsequently, the environmental anomaly index and the behavioral consistency score are weighted and fused to obtain contextual credibility data. The fusion process takes into account the importance weights of the two indicators, usually 40% for environmental anomaly and 60% for behavioral consistency. The contextual credibility data is threshold judged and the threshold is set to 0.8. If it is higher than this value, the operation is considered to be credible and the confirmation data is obtained. The confirmation data is a binary value indicating whether the current operation is considered to be credible. Next, the knowledge graph of the dynamic permission rule set is constructed to obtain a permission relationship knowledge graph. This graph describes the relationship between different permissions, the inheritance relationship, and the correspondence between permissions and resources. Based on the confirmation data, a subgraph query is performed on the permission relationship knowledge graph, and the graph database query language Cypher is used to obtain a subset of candidate permission rules. This subset contains the permission rules that are most relevant to the current operation.

[0086] Finally, the candidate permission rule subset is matched with the hierarchical collaborative preliminary access control decision data, and a refined permission strategy is obtained using a decision tree algorithm. This strategy takes into account static permissions, dynamic rules, and contextual information. The refined permission strategy is conflict resolved and prioritized, and a sorting algorithm based on rule priority and specificity is used to obtain the target access control decision data. This decision data is the basis for the final execution of access control.

[0087] For example, suppose a data analyst, David, tries to access the sensitive data directory " / data / financial / " in HDFS from an unknown IP address at 10 pm on Saturday. First, extract the operating environment feature vector: [Saturday, 22:00, unknown IP, laptop]. The environmental abnormality index calculated using the isolation forest algorithm is 0.75 (normal range 0-1, the higher the more abnormal). Next, analyze David's historical operation logs and use the LSTM algorithm to extract behavioral pattern features, such as accessing data from 9:00 to 18:00 on normal working days, and the main operations are reading and analysis. Calculate the cosine similarity between the current operation and the historical pattern, and get a behavioral consistency score of 0.3 (range 0-1, the higher the more consistent).

[0088] The environmental anomaly index (0.75) and the behavior consistency score (0.3) are weighted and fused: 0.75 × 0.4 + 0.3 × 0.6 = 0.48 to obtain the contextual credibility data. Because 0.48 is lower than the set threshold of 0.8, the data is confirmed to be "untrustworthy". Based on the "untrustworthy" confirmation data, a subgraph query is performed in the permission relationship knowledge graph to obtain a subset of strict permission rules related to financial data access. This subset may include rules such as "access to financial data is prohibited during non-working hours" and "unknown IP addresses require multi-factor authentication". Finally, these candidate permission rules are matched with the preliminary access control decision data to obtain a stricter and refined permission policy. After conflict resolution and priority sorting, the final target access control decision may be "require additional authentication" or "temporarily deny access and record anomalies."

[0089] In a specific embodiment, the process of executing step S106 may specifically include the following steps:

[0090] (1) Perform fault scenario simulation on the target access control decision data to obtain a list of potential fault types, and then perform risk level assessment on the list of potential fault types to obtain a fault risk scoring matrix;

[0091] (2) Perform cluster analysis on the fault risk score matrix to obtain a set of high-risk fault scenarios, and construct a fault tree for the set of high-risk fault scenarios to obtain a fault propagation model;

[0092] (3) Perform critical path analysis on the fault propagation model to obtain a list of fault-sensitive nodes, and perform permission impact assessment on the list of fault-sensitive nodes to obtain a set of permission adjustment recommendations;

[0093] (4) Conduct feasibility analysis on the permission adjustment suggestion set to obtain executable permission adjustment plans, and prioritize the executable permission adjustment plans to obtain a hierarchical permission adjustment strategy;

[0094] (5) Set the timeliness of the hierarchical permission adjustment strategy to obtain temporary permission rules with validity periods, and perform structured encapsulation on the temporary permission rules with validity periods to obtain the temporary permission adjustment strategy corresponding to the target access control decision data.

[0095] It should be noted that the Monte Carlo simulation method is used to perform multiple random disturbances on the target access control decision data to simulate various possible fault conditions and obtain a list of potential fault types. This list includes but is not limited to: data node failure, network delay, permission database, authentication server overload, etc. Subsequently, the risk level of the potential fault type list is evaluated, and the analytic hierarchy process (AHP) is used to consider factors such as the probability of fault occurrence, impact range, and recovery difficulty to obtain a fault risk score matrix. Cluster analysis is performed on the fault risk score matrix, and the K-means algorithm is used to divide the fault types into three risk levels of high, medium, and low to obtain a set of high-risk fault scenarios. For this high-risk set, the fault tree analysis (FTA) method is used to construct a fault propagation model. This model graphically shows how a fault propagates from a component to the entire system, which helps to understand the propagation path and impact range of the fault. Subsequently, a critical path analysis is performed on the fault propagation model, and the minimum cut set algorithm is used to identify the fault path that has the greatest impact on system stability, and a list of fault-sensitive nodes is obtained. These nodes are the points in the system that are most likely to cause serious faults. The permission impact assessment is performed on the list of fault-sensitive nodes. The decision matrix method is used to evaluate the potential impact of each sensitive node on user permissions and obtain a permission adjustment recommendation set. This recommendation set contains specific permission adjustment plans for each sensitive node.

[0096] Then, a feasibility analysis is conducted on the permission adjustment suggestion set, and executable permission adjustment plans are screened out by considering factors such as technical implementation difficulty, impact on user experience, and degree of security improvement. These executable plans are prioritized, and a weighted scoring method is used to comprehensively consider implementation difficulty, expected results, and urgency to obtain a hierarchical permission adjustment strategy. This strategy divides adjustment plans into three levels: immediate execution, short-term implementation, and long-term planning. Finally, the hierarchical permission adjustment strategy is time-effective, and a validity period is set for each adjustment plan to obtain temporary permission rules with validity periods. These rules are structured and encapsulated in JSON format to form a temporary permission adjustment strategy corresponding to the target access control decision data. This strategy is a dynamic and adaptive permission management solution that can adjust user permissions in real time according to the system status.

[0097] For example, assume that in an HDFS cluster, the target access control decision data shows that user group A has read and write permissions for the " / data / financial / " directory. Through fault scenario simulation, potential fault types are identified, including: permission database corrupted (fault ID: F1), authentication server overload (fault ID: F2), and data node failure (fault ID: F3). Use the AHP method to assess risk and obtain the risk scoring matrix:

[0098] F1:0.8, F2:0.6, F3:0.4.

[0099] Through K-means clustering, F1 and F2 are classified as high-risk failure scenarios. A fault tree is constructed for these two faults, and the analysis shows that the authentication server (node ​​ID: N1) and the permission database (node ​​ID: N2) are fault-sensitive nodes. The permission impact assessment shows that the failure of these two nodes will cause users to be unable to access sensitive data normally. The permission adjustment suggestions include: 1) Implement load balancing for N1 (suggestion ID: S1); 2) Add a real-time backup mechanism for N2 (suggestion ID: S2). After feasibility analysis, it is determined that both suggestions are executable. Priority sorting result: S1 > S2.

[0100] The final temporary permission adjustment strategy is:

[0101] 1. Immediate execution: Reduce user group A's access rights to " / data / financial / " to read-only, valid for 24 hours.

[0102] 2. Short-term implementation (within 48 hours): Implement load balancing for the authentication server.

[0103] 3. Long-term plan (within 7 days): Add a real-time backup mechanism to the permissions database.

[0104] The embodiment of the present invention also provides a user data isolation access control system based on HDFS. Figure 2 As shown, the user data isolation access control system based on HDFS specifically includes:

[0105] Extraction module 201, used to authenticate the login request initiated by the user through the FTP client and extract the role authority to obtain the user identity information flow;

[0106] A construction module 202 is used to construct a permission matrix for the user identity information flow to obtain a user-specific permission set;

[0107] The analysis module 203 is used to extract data from the user-specific permission set to obtain an operation permission data set, wherein the operation permission data set includes: read permission data, write permission data and delete permission data, and perform dynamic permission analysis on the operation permission data set to obtain a dynamic permission rule set;

[0108] A monitoring module 204, configured to perform real-time calculation and continuous monitoring of the user identity information flow through the user-specific permission set and the dynamic permission rule set to obtain hierarchical collaborative preliminary access control decision data;

[0109] The matching module 205 is used to perform context-aware verification and behavior pattern analysis on the hierarchical collaborative preliminary access control decision data to obtain confirmation data, and perform permission matching based on the confirmation data and the knowledge graph of the dynamic permission rule set to obtain target access control decision data;

[0110] The adjustment module 206 is used to perform a fault response strategy analysis on the target access control decision data to obtain a temporary permission adjustment strategy corresponding to the target access control decision data.

[0111] Through the collaborative work of the above modules, the user identity information flow is obtained by authenticating the login request initiated by the user through the FTP client and extracting the role permissions, which realizes the accurate identification of the user identity and the preliminary division of permissions, laying the foundation for the subsequent refined permission control; the permission matrix of the user identity information flow is constructed to obtain the user-specific permission set, which realizes the personalized customization of permissions, so that the system can flexibly configure access rights according to the characteristics and needs of different users; thirdly, by extracting data from the user-specific permission set, an operation permission data set containing read permission data, write permission data and delete permission data is obtained, and a dynamic permission analysis is performed on it to obtain a dynamic permission rule set, so that the system can respond to user behavior and environmental changes in real time, dynamically adjust the permission strategy, and improve the adaptability and security of the system; in addition, using user-specific permission sets and The dynamic permission rule set calculates and continuously monitors the user identity information flow in real time to obtain hierarchical and collaborative preliminary access control decision data, realizing multi-level and comprehensive permission control and ensuring refined management of data access; further, the hierarchical and collaborative preliminary access control decision data is context-awarely verified and analyzed for behavior patterns to obtain confirmation data, and permission matching is performed based on the confirmation data and the knowledge graph of the dynamic permission rule set to obtain target access control decision data, which fully considers environmental factors and user behavior patterns and greatly improves the accuracy and reliability of access control decisions; finally, by analyzing the fault response strategy of the target access control decision data, the corresponding temporary permission adjustment strategy is obtained, which enhances the fault tolerance and security of the system, enabling it to respond quickly to potential faults or security threats, dynamically adjust permission strategies, and minimize risks.

[0112] The above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit the same. Although the present invention has been described in detail with reference to the embodiments, a person skilled in the art should understand that the specific implementation modes of the present invention can still be modified or replaced by equivalents, and any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be included in the scope of the claims of the present invention.

Claims

1. A user data isolation access control method based on HDFS, characterized in that: include: Perform identity authentication and role permission extraction on the login request initiated by the user through the FTP client to obtain the user identity information flow; Constructing a permission matrix for the user identity information flow to obtain a user-specific permission set, the step of constructing a permission matrix for the user identity information flow to obtain a user-specific permission set includes: performing data parsing on the user identity information flow to obtain a user role identifier and target permission level data, and performing role permission template matching on the user role identifier to obtain a basic permission matrix; performing numerical mapping processing on the target permission level data to obtain a permission level coefficient, and performing matrix multiplication operation on the basic permission matrix and the permission level coefficient to obtain a preliminary adjustment permission matrix; performing feature extraction on the user historical behavior data corresponding to the user identity information flow to obtain a user behavior feature vector, and performing weight assignment on the user behavior feature vector to obtain a behavior weight coefficient; performing element-level multiplication operation on the preliminary adjustment permission matrix and the behavior weight coefficient to obtain a target permission matrix, and performing threshold filtering on the target permission matrix to obtain a candidate permission item set; performing conflict detection on the candidate permission item set to obtain a non-conflicting permission item list, and structurally encapsulating the non-conflicting permission item list to obtain a user-specific permission set; Data is extracted from the user-specific permission set to obtain an operation permission data set, wherein the operation permission data set includes: read permission data, write permission data, and delete permission data, and dynamic permission analysis is performed on the operation permission data set to obtain a dynamic permission rule set, which specifically includes: structural analysis of the user-specific permission set to obtain a permission item list, and operation type classification of the permission item list to obtain a preliminary operation permission data set; fine-grained division of the preliminary operation permission data set to obtain read permission data, write permission data, and delete permission data, and classification of the read permission data, write permission data, and delete permission data; Perform data correlation analysis on permission data and deletion permission data to obtain a permission dependency graph; perform graph traversal processing on the permission dependency graph to obtain a permission propagation path set, and perform path optimization on the permission propagation path set to obtain a simplified permission propagation model; perform time series analysis on the simplified permission propagation model to obtain permission change trend data, and perform forecasting and extrapolation on the permission change trend data to obtain permission evolution forecast results; perform rule extraction on the permission evolution forecast results to obtain a candidate dynamic permission rule set, and perform conflict resolution and priority sorting on the candidate dynamic permission rule set to obtain a dynamic permission rule set; The user identity information flow is calculated and continuously monitored in real time by the user-specific permission set and the dynamic permission rule set to obtain hierarchical collaborative preliminary access control decision data, including: real-time analysis of the user identity information flow to obtain current user operation request data, and operation type identification of the current user operation request data to obtain an operation type identifier; rapid indexing of the user-specific permission set to obtain static permission data corresponding to the operation type identifier, and rule matching of the dynamic permission rule set to obtain applicable dynamic permission adjustment parameters; permission synthesis calculation of the static permission data and the dynamic permission adjustment parameters to obtain a preliminary permission decision result, and multi-dimensional cross-validation of the preliminary permission decision result to obtain a permission consistency score; threshold judgment of the permission consistency score to obtain a permission decision credibility index, and adjustment of the preliminary permission decision result according to the permission decision credibility index to obtain revised permission decision data; hierarchical processing of the revised permission decision data to obtain a multi-level permission strategy including file level, directory level and operation level, and collaborative optimization of the multi-level permission strategy to obtain hierarchical collaborative preliminary access control decision data; The preliminary access control decision data of the hierarchical collaboration is subjected to context-aware verification and behavior pattern analysis to obtain confirmation data, and permission matching is performed based on the confirmation data and the knowledge graph of the dynamic permission rule set to obtain target access control decision data, including: extracting context information from the preliminary access control decision data of the hierarchical collaboration to obtain an operating environment feature vector, and performing anomaly detection on the operating environment feature vector to obtain an environmental anomaly index; performing time series analysis on the user's historical operation log to obtain user behavior pattern characteristics, and performing similarity calculation between the user behavior pattern characteristics and the current operation to obtain behavior consistency Scoring; weighted fusion of the environmental anomaly index and the behavior consistency score to obtain contextual credibility data, and threshold judgment of the contextual credibility data to obtain confirmation data; knowledge graph construction of the dynamic permission rule set to obtain a permission relationship knowledge graph, and subgraph query of the permission relationship knowledge graph based on the confirmation data to obtain a candidate permission rule subset; rule matching of the candidate permission rule subset with the hierarchical collaborative preliminary access control decision data to obtain a refined permission strategy, and conflict resolution and priority sorting of the refined permission strategy to obtain target access control decision data; A fault response strategy analysis is performed on the target access control decision data to obtain a temporary permission adjustment strategy corresponding to the target access control decision data.

2. The method for user data isolation access control based on HDFS according to claim 1, characterized in that: The steps of performing identity authentication and role authority extraction on the login request initiated by the user through the FTP client to obtain the user identity information flow include: Parsing the data packet of the login request sent by the user through the FTP client to obtain the original login information including the user name and password, and performing secure hash processing on the password in the original login information to obtain encrypted password data; Performing a database matching query on the user name and the encrypted password data to obtain basic user identity information, and performing role association analysis on the basic user identity information to obtain user role type data; Performing permission level classification on the user role type data to obtain preliminary permission level data, and performing historical behavior association analysis on the preliminary permission level data to obtain user credit score data; Performing threshold comparison processing on the user credit score data to obtain a permission adjustment factor, and performing weighted calculation on the preliminary permission level data and the permission adjustment factor to obtain target permission level data; The user basic identity information, the user role type data and the target authority level data are structured and combined to obtain a user identity information flow.

3. The user data isolation access control method based on HDFS according to claim 1 is characterized in that: The step of performing a fault response strategy analysis on the target access control decision data to obtain a temporary permission adjustment strategy corresponding to the target access control decision data includes: Performing a fault scenario simulation on the target access control decision data to obtain a list of potential fault types, and performing a risk level assessment on the list of potential fault types to obtain a fault risk scoring matrix; Performing cluster analysis on the fault risk scoring matrix to obtain a set of high-risk fault scenarios, and constructing a fault tree for the set of high-risk fault scenarios to obtain a fault propagation model; Performing a critical path analysis on the fault propagation model to obtain a list of fault-sensitive nodes, and performing a permission impact assessment on the list of fault-sensitive nodes to obtain a set of permission adjustment recommendations; Performing a feasibility analysis on the permission adjustment suggestion set to obtain executable permission adjustment schemes, and prioritizing the executable permission adjustment schemes to obtain a hierarchical permission adjustment strategy; The hierarchical permission adjustment strategy is time-effectively set to obtain temporary permission rules with validity periods, and the temporary permission rules with validity periods are structured and packaged to obtain temporary permission adjustment strategies corresponding to the target access control decision data.

4. A user data isolation access control system based on HDFS, used to execute the user data isolation access control method based on HDFS according to any one of claims 1 to 3, characterized in that: include: The extraction module is used to authenticate the login request initiated by the user through the FTP client and extract the role permissions to obtain the user identity information flow; A construction module is used to construct a permission matrix for the user identity information flow to obtain a user-specific permission set. The step of constructing a permission matrix for the user identity information flow to obtain a user-specific permission set includes: performing data parsing on the user identity information flow to obtain user role identification and target permission level data, and performing role permission template matching on the user role identification to obtain a basic permission matrix; performing numerical mapping processing on the target permission level data to obtain a permission level coefficient, and performing matrix multiplication operation on the basic permission matrix and the permission level coefficient to obtain a preliminary adjustment permission matrix; performing feature extraction on the user historical behavior data corresponding to the user identity information flow to obtain a user behavior feature vector, and performing weight assignment on the user behavior feature vector to obtain a behavior weight coefficient; performing element-level multiplication operation on the preliminary adjustment permission matrix and the behavior weight coefficient to obtain a target permission matrix, and performing threshold filtering on the target permission matrix to obtain a candidate permission item set; performing conflict detection on the candidate permission item set to obtain a non-conflicting permission item list, and structurally encapsulating the non-conflicting permission item list to obtain a user-specific permission set; The analysis module is used to extract data from the user-specific permission set to obtain an operation permission data set, wherein the operation permission data set includes: read permission data, write permission data and delete permission data, and perform dynamic permission analysis on the operation permission data set to obtain a dynamic permission rule set, which specifically includes: performing structured analysis on the user-specific permission set to obtain a permission item list, and classifying the permission item list by operation type to obtain a preliminary operation permission data set; performing fine-grained division on the preliminary operation permission data set to obtain read permission data, write permission data and delete permission data, and classifying the read permission data , perform data correlation analysis on write permission data and delete permission data to obtain a permission dependency graph; perform graph traversal processing on the permission dependency graph to obtain a permission propagation path set, and perform path optimization on the permission propagation path set to obtain a simplified permission propagation model; perform time series analysis on the simplified permission propagation model to obtain permission change trend data, and perform predictive extrapolation on the permission change trend data to obtain permission evolution prediction results; perform rule extraction on the permission evolution prediction results to obtain a candidate dynamic permission rule set, and perform conflict resolution and priority sorting on the candidate dynamic permission rule set to obtain a dynamic permission rule set; A monitoring module, used to perform real-time calculation and continuous monitoring of the user identity information flow through the user-specific permission set and the dynamic permission rule set to obtain hierarchical collaborative preliminary access control decision data, including: real-time analysis of the user identity information flow to obtain current user operation request data, and operation type identification of the current user operation request data to obtain an operation type identifier; rapid indexing of the user-specific permission set to obtain static permission data corresponding to the operation type identifier, and rule matching of the dynamic permission rule set to obtain applicable dynamic permission adjustment parameters; permission synthesis calculation of the static permission data and the dynamic permission adjustment parameters to obtain a preliminary permission decision result, and multi-dimensional cross-validation of the preliminary permission decision result to obtain a permission consistency score; threshold judgment of the permission consistency score to obtain a permission decision credibility index, and adjustment of the preliminary permission decision result according to the permission decision credibility index to obtain revised permission decision data; hierarchical processing of the revised permission decision data to obtain a multi-level permission strategy including file level, directory level and operation level, and collaborative optimization of the multi-level permission strategy to obtain hierarchical collaborative preliminary access control decision data; A matching module is used to perform context-aware verification and behavior pattern analysis on the preliminary access control decision data of the hierarchical collaboration to obtain confirmation data, and perform permission matching based on the confirmation data and the knowledge graph of the dynamic permission rule set to obtain target access control decision data, including: extracting context information from the preliminary access control decision data of the hierarchical collaboration to obtain an operating environment feature vector, and performing anomaly detection on the operating environment feature vector to obtain an environmental anomaly index; performing time series analysis on the user's historical operation log to obtain user behavior pattern characteristics, and performing similarity calculation between the user behavior pattern characteristics and the current operation to obtain a behavior Consistency scoring; weighted fusion of the environmental anomaly index and the behavior consistency score to obtain contextual credibility data, and threshold judgment of the contextual credibility data to obtain confirmation data; knowledge graph construction of the dynamic permission rule set to obtain a permission relationship knowledge graph, and subgraph query of the permission relationship knowledge graph based on the confirmation data to obtain a candidate permission rule subset; rule matching of the candidate permission rule subset with the hierarchical collaborative preliminary access control decision data to obtain a refined permission strategy, and conflict resolution and priority sorting of the refined permission strategy to obtain target access control decision data; The adjustment module is used to perform a fault response strategy analysis on the target access control decision data to obtain a temporary permission adjustment strategy corresponding to the target access control decision data.

Images