Access control strategy generation method and system based on large language model

Abstract

The invention relates to the technical field of access control, in particular to an access control strategy generation method and system based on a large language model.Automatic cue words are generated through cue word engineering, enhanced data are generated for an example document according to the automatic cue words, and the example document is a text marked with access control elements; learning an access control element reasoning process in the example document and the enhanced data by using a plurality of large language models, and generating a corresponding access control strategy thinking chain, so as to obtain an access control strategy set of a target document in the attribute mining and strategy generation task based on the thinking chain; and based on a multi-model voting mode, obtaining a final access control attribute and strategy for the access control strategy to be optimized in the access control strategy set according to an optimization result. According to the method, the access control strategy with relatively high quality can be generated, and the method has a relatively good application prospect in the aspects of dynamic and mass data resource access authorization and management under novel open environments such as big data and the Internet of Things.

Description

Technical Field

[0001] The present invention relates to the field of access control technology, and in particular to a method and system for generating access control strategies based on a large language model. Background Art

[0002] Access control technology prevents unauthorized access to resources by managing user rights, and ensures that data resources are used within a legal scope. It is an important means to ensure data security. In new open environments such as big data and the Internet of Things, people have proposed to use attribute-based access control (ABAC) to authorize and manage access to dynamic and massive data resources. The attributes of entity resources are used as the decision factors for access control, and the attribute set of the entity is used to flexibly determine whether to grant it the corresponding access rights, which can achieve fine-grained and efficient permission decisions.

[0003] The implementation of the ABAC model requires the definition or generation of access control policies. Especially in the early stage of information system establishment, how to configure correct, complete and consistent access control policies is the basis for system managers to implement access control on data resources. Existing policy generation technologies mainly include "top-down" and "bottom-up". Among them, the "top-down" model requires security experts to analyze and manually formulate access control policies based on the business needs and security needs of the information system. This method relies on the professional knowledge of security experts, turning access control policy generation into an inefficient and labor-intensive work. The generated policies also have problems with reliability and accuracy. The "bottom-up" model uses data mining and other means to automatically generate policies based on the "user-authority relationship" information already in the information system, reducing dependence on experts. However, with the increasing scale and complexity of information systems, the formulation and management of access control policies have become more and more cumbersome and time-consuming. Existing policy generation methods need to build policies based on the existing access control policy information or access control logs in the information system. In the early stage of information system construction, they cannot be directly applied in the absence of access control information. In addition, existing methods lack the technology to optimize the policy after the initial policy extraction, which will cause the policy to overfit the access control policy information or access control logs, and have problems such as low accuracy, high complexity, and poor interpretability, making it difficult to directly apply it to the access control model.

[0004] In fact, in most organizations' information systems, there are system project specification documents described in natural language. These documents contain policy information related to access control preset by system designers. They are important bases and information sources for security experts to understand the application environment and application background and analyze security requirements. However, manually screening existing documents to extract hidden access control policies is an error-prone, time-consuming and labor-intensive task. Therefore, it is urgent to study methods to automatically extract attribute-based access control policies from project specification documents described in natural language. Summary of the invention

[0005] To this end, the present invention provides a method and system for generating access control policies based on a large language model, which solve the problems of poor accuracy and time-consuming in existing document extraction access control policies.

[0006] According to the design scheme provided by the present invention, on the one hand, a method for generating an access control policy based on a large language model is provided, comprising:

[0007] Generate automatic prompt words using prompt word engineering, and generate enhanced data for a sample document based on the automatic prompt words, wherein the sample document is a text marked with access control elements, wherein the access control elements are used to describe the characteristics, status or identification of entities involved in access control;

[0008] Using multiple large language models to learn the reasoning process of access control elements in sample documents and enhanced data and generate corresponding access control policy thought chains, so as to obtain the access control policy set of the target document in the attribute mining and policy generation task based on the thought chain, wherein the access control policy is the rule for the subject to access the object;

[0009] The access control policies to be optimized in the access control policy set are selected based on a multi-model voting method, and the final access control attributes and policies are obtained according to the optimization results.

[0010] As the access control policy generation method based on the large language model of the present invention, further, automatic prompt words are generated by using prompt word engineering, including:

[0011] Automatic prompt words are generated according to the question description and manual calibration and using a multi-round answer function. The multi-round answer function is used to set multiple question descriptions for the question to obtain the answer corresponding to the question through multi-round question and answer. The automatic prompt words are prompt words obtained by integrating the question description and the corresponding answer using the prompt word engineering during the multi-round question and answer process.

[0012] As the access control policy generation method based on the large language model of the present invention, further, the prompt words obtained by integrating the question description and the corresponding answer using the prompt word engineering include:

[0013] The prompt word template is configured according to the question description and the answer in the historical dialogue to generate the prompt word, wherein the prompt word template includes the task instruction configuration and the context configuration executed by the large language model.

[0014] As the access control policy generation method based on the large language model of the present invention, further, generating enhanced data for the sample document according to the automatic prompt words includes:

[0015] Generate an intermediate text of the sample document using the automatic prompt words and a data enhancement function, wherein the data enhancement function is used to generate a similar semantic text for the sample document through a prompt template question-answering method;

[0016] A tagger is used to tag the access control elements for the intermediate text to generate enhanced data marked with the access control elements. The tagger tags the access control elements for the intermediate text in a semi-supervised manner through a large model.

[0017] As the access control policy generation method based on the large language model of the present invention, further, the access control elements include subject attributes, object attributes, action attributes and environment attributes.

[0018] As the access control policy generation method based on the large language model of the present invention, further, using multiple large language models to learn the access control element reasoning process in the example documents and enhanced data, it includes:

[0019] Divide the sample texts into document types according to different application scenarios and / or usage specifications, and make each document type contain a number of texts;

[0020] Multiple large language models respectively learn the access control element reasoning process of text in different document types, and the multiple large language models include but are not limited to: ERNIE 3.5, GLM-4, GPT-3.5 and GPT-4.

[0021] As the access control policy generation method based on the large language model of the present invention, further, the access control policy to be optimized in the access control policy set is obtained based on a multi-model voting method, including:

[0022] For each access control policy in the access control policy set, multiple large language models obtain the optimization of the access control policy to be optimized in the access control policy set based on the discussion chain and take turns to specify the optimization opinions of the access control policy to be optimized, and optimize the access control policy to be optimized based on the optimization opinions and using the majority voting idea. The discussion chain is a collaborative optimization response of multiple large language models to the access control policy based on the policy optimization prompt instructions.

[0023] On the other hand, the present invention also provides an access control policy generation system based on a large language model, comprising: a data enhancement module, a learning and reasoning module, and an optimization output module, wherein:

[0024] A data enhancement module, for generating automatic prompt words using prompt word engineering, and generating enhanced data for a sample document based on the automatic prompt words, wherein the sample document is a text marked with access control elements, wherein the access control elements are used to describe the characteristics, status or identification of entities involved in access control;

[0025] A learning and reasoning module is used to use multiple large language models to learn the reasoning process of access control elements in sample documents and enhanced data and generate corresponding access control policy thought chains, so as to obtain the access control policy set of the target document in the attribute mining and policy generation task based on the thought chain, wherein the access control policy is the rule for the subject to access the object;

[0026] The optimization output module is used to optimize the access control policies to be optimized in the access control policy set based on a multi-model voting method, and obtain the final access control attributes and policies according to the optimization results.

[0027] Beneficial effects of the present invention:

[0028] The present invention utilizes LLMs to generate automatic prompt words, takes the system project specification documents within the information system as an example, prompts LLMs to generate task data sets, and improves the availability of data enhancement documents; from the perspective of small sample learning, with the help of prompt words and annotated system project specification documents, LLMs are trained to mine access control security attributes and generate access control policies, proving that LLMs that learn prompt words through a small number of samples are capable of mining access control security attributes; comprehensively utilizes LLMs' situational learning and logical reasoning capabilities, prompts LLMs to automatically generate intermediate reasoning steps for executing access control policy generation tasks, and significantly improves the ability of the basic model to perform complex reasoning; constructs a policy optimization discussion chain through multi-model voting, optimizes the generated access control policies according to the opinions put forward by different models, thereby improving the quality and simplicity of the access policies. We further used multiple LLMs to perform cross-validation on three datasets: expert annotation, network collection, and data augmentation, and conducted ablation experiments. The experiments showed that the access control policy generation strategy LLMs-ACPGen based on the large language model in this scheme performed well in attribute mining and policy generation tasks. The attribute mining F1 value and policy coverage reached 85.94% and 89.51% respectively. The performance is close to that of the current mainstream method based on expert models, but the training cost is lower, which fully proves the effectiveness of this scheme and has good application prospects in the access authorization and management of dynamic and massive data resources in new open environments such as big data and the Internet of Things. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 The following is a schematic diagram of the access control policy generation process based on the large language model in the embodiment;

[0030] Figure 2 An example of LLMs-ACPGen, an access control policy generation strategy based on a large language model in an embodiment;

[0031] Figure 3 This is a schematic diagram of an access control policy generation framework in an embodiment;

[0032] Figure 4 This is an example of automatic prompt word optimization in the embodiment;

[0033] Figure 5 This is a schematic diagram of a thinking chain template in the embodiment;

[0034] Figure 6 Schematic diagram of the chain template discussed in the embodiments;

[0035] Figure 7 This is a schematic diagram of the data set description in the embodiment;

[0036] Figure 8 This is a comparison experiment of the effectiveness of data enhancement in the embodiment;

[0037] Fig. 9 This is a schematic diagram of the comparative experiment of small sample learning attribute mining performance in the embodiment;

[0038] Fig.10 This is a schematic diagram of a performance comparison experiment of a thinking chain strategy generation in the embodiment;

[0039] Fig.11 This is a schematic diagram of the chain strategy optimization performance comparison experiment discussed in the embodiment;

[0040] Fig.12 Schematic diagram of ablation experiment results in the embodiment. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solutions and advantages of the present invention clearer and more understandable, the present invention is further described in detail below in conjunction with the accompanying drawings and technical solutions.

[0042] At the intersection of computer science and artificial intelligence, IE is a key subtask in natural language processing (NLP), which usually consists of three parts: named entity recognition (NER), relation extraction (RE), and event extraction (EE). In recent years, as large language models (LLMs) represented by GPT-4, Llama 2, and GLM-130B have demonstrated outstanding capabilities in text understanding and generation, people have conducted more research on generative IE methods. Compared with traditional discriminant-based methods, generative IE methods use LLMs to generate structured information instead of extracting it from text, and have higher usability. Attribute-based access control is an important means to maintain the security of information systems in a big data environment. However, in the early stages of establishing an information system, there is usually a problem of difficulty in constructing access control policies. In order to achieve the automatic generation of attribute-based access control policies, the embodiments of the present invention, see Figure 1 As shown, a method for generating an access control policy based on a large language model is provided, comprising:

[0043] S101. Generate automatic prompt words using prompt word engineering, and generate enhanced data for a sample document according to the automatic prompt words. The sample document is a text marked with access control elements. The access control elements are used to describe the characteristics, status or identification of entities involved in access control.

[0044] In ABAC, an attribute is used to describe the characteristics, status, or identity of an entity that participates in access control, including subject attributes A s 、Object attribute A o , Action Attribute A a and environmental attribute A e The four attributes constitute the attribute elements of access control and provide a basis for the authority management and judgment of access control.

[0045] Access control policy is the specific embodiment of the rules for the subject to access the object and the subject's authorization logic for the object, which can be expressed as a five-tuple acp = (A s -tuple,A o -tuple,A a -tuple,A e -tuple, Sign), where X-tuple represents the attribute tuple, which is the embodiment of the dynamic assignment relationship of attributes and can be expressed as X-tuple = {x 1 ,x 2 ,...,x n}; Sign∈{permit,deny}, indicating that the decision result is “allow” or “deny”.

[0046] like Figure 2 and 3 As shown in the figure, the access control policy generation LLMs-ACPGen based on the large model first performs data enhancement through the automatic prompt word optimization method, uses LLMs to generate automatic prompt words, and takes the system project specification documents within the information system as an example to prompt LLMs to generate task data sets. Then, using the annotated system project specification documents as a small sample, the LLMs access control security attribute mining and access control policy generation capabilities are trained. Then, in the attribute mining and policy generation tasks, LLMs are prompted to automatically generate the intermediate reasoning steps for executing the access control policy generation task to form a self-generated thinking chain. Finally, a policy optimization discussion chain is constructed by multi-model voting, and the generated access control policy is optimized according to the opinions put forward by different models to form the final attributes and policies.

[0047] Specifically, the automatic prompt words generated by the prompt word project can be designed to include:

[0048] Automatic prompt words are generated according to the question description and manual calibration and using a multi-round answer function. The multi-round answer function is used to set multiple question descriptions for the question to obtain the answer corresponding to the question through multi-round question and answer. The automatic prompt words are prompt words obtained by integrating the question description and the corresponding answer using the prompt word engineering during the multi-round question and answer process.

[0049] Among them, the prompt words obtained by integrating the question description and the corresponding answer using the prompt word engineering may include:

[0050] The prompt word template is configured according to the question description and the answer in the historical dialogue to generate the prompt word, wherein the prompt word template includes the task instruction configuration and the context configuration executed by the large language model.

[0051] When LLMs are trained by prompt words to extract access control elements, due to the lack of training data and the high difficulty of downstream tasks, it is difficult for the model to learn sufficiently rich feature representations, which will lead to problems such as low confidence in the extraction of access control elements by LLMs. In view of the problem of insufficient system project specification document data used for model training in information systems, in the embodiments of this case, automatic prompt word optimization (Automatic Prompt Optimization) prompts the model to summarize the experience of answering questions and use the experience as prompt words to realize automatic prompt word generation of LLMs; LLMs are used for data augmentation (Data Augmentation), and an LLMs annotator is constructed to generate augmented data (Augmented Data) with access control element labels.

[0052] In prompt optimization, the model performance is improved by optimizing the prompt format and language. In the LLMs access control factor extraction task, since the output quality of LLMs is very sensitive to the given prompts, even a slight change in the prompt format may have a significant impact on the model performance. Therefore, how to design excellent prompts has become an important task in the field of prompt engineering. However, manually designing prompts by experts will cause problems such as waste of human resources and low efficiency of prompt optimization. For this reason, see Figure 4 As shown, in the embodiment of this case, in the process of multi-turn question answering with LLMs about generating system project specification documents, the answers output by the model are manually calibrated to optimize the model's own way of thinking, and finally the model is prompted to summarize the experience of answering questions raised by users in multi-turn question answering, and the experience is used as prompt words to achieve automatic optimization of LLMs' prompt words on how to generate system project specification documents. In the field of data enhancement, the optimized prompt words can usually significantly improve the model's text generation ability, thereby making the enhanced data more realistic and usable in the access control factor extraction task.

[0053] The process of generating enhanced data for the sample document according to the automatic prompt words may include:

[0054] Generate an intermediate text of the sample document using the automatic prompt words and a data enhancement function, wherein the data enhancement function is used to generate a similar semantic text for the sample document through a prompt template question-answering method;

[0055] A tagger is used to tag the access control elements for the intermediate text to generate enhanced data marked with the access control elements. The tagger tags the access control elements for the intermediate text in a semi-supervised manner through a large model.

[0056] Data augmentation is a data preprocessing technology that generates new training data samples by performing various transformations and modifications on the original data. LLMs Data Augmentation refers to using LLMs to perform data augmentation on training texts, requiring LLMs to refer to system project specification documents within the information system in the form of prompt template questions and answers to generate semantically similar enhanced data. Then, using LLMs as annotators, a small number of example documents with access control elements already marked are used to train LLMs' attribute mining and policy generation capabilities, and LLMs are used to perform attribute mining and policy generation on the enhanced data, ultimately forming a data augmentation data set to achieve automatic labeling of enhanced data. In this embodiment of the case, the implementation steps of LLMs data augmentation can be described as follows:

[0057] Based on the question description D and manual calibration C, the multi-round question-answering function multiQA is used to generate automatic prompt words P auto ;

[0058] Given multiple example documents d example , using the automatic prompt word P auto , through the data augmentation function, LLMs are prompted to refer to the example d example , generating enhanced data d of unlabeled access control elements unmarked ;

[0059] Use LLMs as annotators to label the enhanced data in a semi-supervised manner and generate enhanced data d with access control elements labeled marked , complete data enhancement.

[0060] The pseudo code for data enhancement based on automatic prompt word optimization is shown in Algorithm 1:

[0061]

[0062] S102. Use multiple large language models to learn the reasoning process of access control elements in example documents and enhanced data and generate corresponding access control policy thought chains, so as to obtain a set of access control policies for target documents in attribute mining and policy generation tasks based on the thought chains, wherein the access control policies are rules for the subject to access the object.

[0063] The system project specification document containing access control information can be expressed as D = {d 1 ,d 2 ,...,d n}, divide the document set D into a training set D with labeled attributes and strategies train and the test set D test , taking LLMs as the attribute mining function f, from the target document d k Mining the access control attribute set:

[0064] f(d k ,D train )=A(d k ) (1)

[0065] Among them, A(d k )=A s ∪A o ∪A a ∪A e , from the document d k It is composed of different attributes mined from .

[0066] In strategy generation, LLMs are used as strategy generation function g, from the target document d k Generate an access control policy set in:

[0067] g(d k ,A(d k ),D train )=ACP(d k ) (2)

[0068] Among them, ACP(d k )={acp 1 ,acp 2 ,...,acp n}, indicating that from the document d k The access control policy set generated in .

[0069] The access control sentence rate is an indicator to measure the richness of access control information in system project specification documents. It is used to calculate the ratio of the number of sentences containing access control information to the total number of sentences in the document:

[0070]

[0071] Among them, Sen AC (d k ) indicates document d k The number of access control statements in Sen total (d k ) indicates document d k The total number of sentences.

[0072] The access control statement rate of a document should be kept within a reasonable range. If this indicator is too low, the document will lack access control information, thus affecting the performance of access control element extraction; if this indicator is too high, the document structure and content will be unreasonable, and the authenticity and usability of the business document will be reduced.

[0073] The performance of access control attribute mining is usually evaluated by three indicators: precision, recall, and F1 value. Precision refers to the ratio of the number of positive samples correctly identified by the model to the total number of positive samples identified by the model:

[0074]

[0075] Among them, TP stands for true positive, that is, the number of positive samples correctly identified by the model; FP stands for false positive, that is, the number of negative samples mistakenly identified as positive samples by the model.

[0076] Recall refers to the ratio of the number of positive samples correctly identified by the model to the number of positive samples that actually exist:

[0077]

[0078] Among them, FN represents false negatives, that is, the number of positive samples that the model mistakenly identifies as negative samples.

[0079] The F1 value is the harmonic mean of precision and recall, which is used to comprehensively consider the two indicators of precision and recall. The higher the F1 value, the better the performance of attribute mining:

[0080]

[0081] Policy coverage is an indicator to measure whether the access control policy is comprehensive and whether it can effectively cover all relevant resources and user operations. Specifically, policy coverage refers to the ratio of the actual access mode covered by the access control policy to all possible access modes:

[0082]

[0083] Among them, Num true (d k ) indicates that the generated access control policy is used for document d k All attribute combinations in the are used for permission judgment, and the judgment result is the number of correct attribute combinations; Num total (d k ) indicates document d k The total number of attribute combinations in .

[0084] Weighted structural complexity (WSC) is an indicator to measure the complexity of access control policies. It assigns weights to each attribute in the policy and calculates the complexity of the policy based on these weights:

[0085]

[0086]

[0087] Among them, ω j refers to the weight of the jth strategy element; X j refers to the jth strategy element, X j ∈{A s ,A o ,A a ,A e}; Count(X j ) refers to the number of times the jth strategy element appears in the strategy; WSC(d k ) refers to the document d kThe total complexity of all strategies in .

[0088] Specifically, the example texts can be divided into document types according to different application scenarios and / or usage specifications, and each document type contains several texts; multiple large language models respectively learn the access control element reasoning process of texts in different document types, and the multiple large language models include but are not limited to: ERNIE 3.5, GLM-4, GPT-3.5 and GPT-4.

[0089] Few-Shot Learning is a machine learning problem in which the training dataset contains limited information. It aims to train the model through a small number of labeled samples so that the model can quickly adapt to new tasks or fields. Since LLMs are pre-trained on large-scale datasets, through their powerful learning ability, only a small number of training samples are needed to enable the model to achieve performance similar to that of fine-tuned downstream task professional models. At present, academic research on few-shot learning mainly focuses on the N-way K-shot problem, that is, identifying N categories, each with K samples. This setting can simulate small sample scenarios in the real world and evaluate the performance of the model in this case. In this embodiment, three different categories of documents containing access control information can be selected, and LLMs can be trained with different dataset sizes to enable them to quickly acquire the ability to perform attribute mining and policy generation tasks. The pseudocode for LLMs small-shot learning is shown in Algorithm 2.

[0090]

[0091]

[0092] Chain-of-Thought (CoT) is a technology to improve the reasoning ability of models. It enables the model to think about the problem step by step and give the final answer through the self-generation of the model or the design of intermediate reasoning steps by experts. For the self-generated chain of thought (SG-CoT), people usually use "Let's think step by step" as a prompt to guide the model to give reasoning steps when answering questions, thereby enhancing the accuracy and interpretability of the results. In the field of expert-designed chain of thought, on the one hand, by designing a self-prompted chain of thought (SP-CoT), the model can be prompted to ask a new question based on the answer to the target question, and then answer the question. If the new answer is consistent with the answer to the target question, it means that the model has fully understood the target question at the semantic level. Through the self-prompted chain of thought, the open-domain multi-hop reasoning (ODMR) ability of LLMs can be significantly enhanced, thereby improving the performance of LLMs in solving complex problems. On the other hand, complex problems can be transformed into multiple simple questions by prompting LLMs, and each simple question can be answered separately, and then the answers to each simple question can be combined to obtain the answer to the final complex question.

[0093] Thinking chain template Figure 5 In the embodiment of this case, the above multiple thought chains are used to prompt LLMs to perform the access control policy generation task respectively, and the expert design or model is used to automatically generate the thought chain to improve the reasoning ability of LLMs, guide LLMs to gradually extract access control elements from system project specification documents, and realize the automatic generation of access control policies.

[0094] S103: Optimize the access control policies in the access control policy set based on a multi-model voting method, and obtain the final access control attributes and policies according to the optimization results.

[0095] Specifically, for each access control policy in the access control policy set, multiple large language models obtain the optimization of the access control policy to be optimized in the access control policy set based on the discussion chain and take turns to specify the optimization opinions of the access control policy to be optimized, and optimize the access control policy to be optimized based on the optimization opinions and using the majority voting idea. The discussion chain is a collaborative optimization response of multiple large language models to the access control policy based on the policy optimization prompt instructions.

[0096] Discussion chain template such as Figure 6As shown. Different models have different applicability in executing downstream tasks for data resources of different types or fields. This paper uses the Chain-of-Discussion to determine the optimization scheme of the generated access control policy through multi-model voting. First, LLMs judge each policy and vote to determine the policy that needs to be optimized; then, multiple models respectively put forward optimization opinions for the policies that need to be optimized, and the models take turns to judge multiple opinions and make the final optimization. Using the discussion chain to optimize the access control policy can comprehensively consider the performance of different LLMs in processing different categories of documents, and obtain a simpler and more accurate set of access control policies.

[0097] Furthermore, based on the above method, an embodiment of the present invention also provides an access control policy generation system based on a large language model, comprising: a data enhancement module, a learning and reasoning module, and an optimization output module, wherein:

[0098] A data enhancement module, for generating automatic prompt words using prompt word engineering, and generating enhanced data for a sample document based on the automatic prompt words, wherein the sample document is a text marked with access control elements, wherein the access control elements are used to describe the characteristics, status or identification of entities involved in access control;

[0099] A learning and reasoning module is used to use multiple large language models to learn the reasoning process of access control elements in sample documents and enhanced data and generate corresponding access control policy thought chains, so as to obtain the access control policy set of the target document in the attribute mining and policy generation task based on the thought chain, wherein the access control policy is the rule for the subject to access the object;

[0100] The optimization output module is used to optimize the access control policies to be optimized in the access control policy set based on a multi-model voting method, and obtain the final access control attributes and policies according to the optimization results.

[0101] In order to verify the effectiveness of this solution, the following is a further explanation based on experimental data:

[0102] Three different types of datasets, expert annotation, network collection, and data enhancement, were selected for the experiment. Among them, the expert annotation datasets include four types of datasets: iTrust, IBM App, Cyberchair, and CollectedACP, which were obtained by Slankas et al. through manual annotation. The network collection dataset is 10 system project specification documents collected on the Internet, including information system management regulations and usage specifications of various universities and laboratories. The data enhancement dataset is a dataset generated by the network collection dataset as an example using a data enhancement method based on automatic prompt word optimization, which includes 10 system project specification documents. The dataset description is shown in Tables 1 and Figure 7 shown.

[0103] Table 1 Dataset description

[0104]

[0105] To demonstrate the advantages of this solution, we can compare it with the two most commonly used (a total of five) expert model-based policy generation methods at this stage. For ease of understanding, they are divided into methods based on access control policy information and methods based on access control logs. Among them, for the method based on access control policy information, a method of generating access control policies based on the access control policy information already existing in the information system is used. For the method based on access control logs, a policy is constructed based on access control logs.

[0106] In addition, in order to evaluate the contribution of this scheme to the performance of large models participating in the access control policy generation task, the dataset π 3 , taking the GLM-4 model using zero-shot learning and simple prompting method as the baseline*, ablation experiments are conducted on this solution.

[0107] To verify the effectiveness of the solution in this case, the experimental environment is set as follows: the operating system is Win11 23H2, the CPU is 13th Gen Intel(R)Core(TM)i9-13900HX 2.20GHz, the GPU is NVIDIA GeForce RTX4090Laptop GPU, and the memory size is 32GB.

[0108] Five experiments were designed to evaluate the access control factor extraction performance, including data enhancement effectiveness comparison, small sample learning attribute mining performance comparison, thought chain strategy generation performance comparison, discussion chain strategy optimization performance comparison, and ablation study. The specific contents of the experiment are as follows:

[0109] Comparison of data enhancement effectiveness: Taking dataset π as an example 2 The document in is taken as an example. Through data enhancement, five documents are generated using the automatic prompt word optimization method and the method without optimization. The access control statement rates of the enhanced documents using automatic prompt word optimization, the enhanced documents without optimization, and the example documents are calculated respectively, and their average values ​​are calculated and compared and analyzed.

[0110] Comparison of small sample learning attribute mining performance: We randomly sampled 1, 2, and 5 documents from the three datasets for small sample learning, and calculated the performance of ERNIE 3.5, GLM-4, GPT-3.5, and GPT-4 models with π 1 , π 2 , π 3The three datasets are used as training sets for attribute mining F1 values ​​of small sample learning or zero-shot learning.

[0111] Comparison of thought chain strategy generation performance: on dataset π 3 Five documents are randomly sampled for small sample learning. On this basis, the strategy coverage of simple prompts, Least-to-Most, self-prompt thinking chains, and self-generated thinking chains on the expert annotated dataset is calculated and analyzed.

[0112] Discussion chain strategy optimization performance comparison: on the dataset π 3 We randomly sample 5 documents for small sample learning and use self-generated thought chains to generate strategies. On this basis, we use discussion chains to optimize strategies and calculate and analyze π 1 , π 2 , π 3 The average WSC of the strategies before and after optimization for each document in the three datasets, as well as the compression ratio of the strategy WSC.

[0113] Ablation Study: Using dataset π 3 , taking the GLM-4 model using zero-shot learning and simple prompting method as the baseline*, ablation experiments are performed on the four methods proposed in this paper. In addition, the dataset π 3 ,Compare the performance of LLMs-ACPGen with five expert model-based policy generation methods, and evaluate the model's policy generation ability from two dimensions:,policy coverage and dataset size.

[0114] Model details: Experiments were conducted on a variety of publicly released models: ERNIE 3.5, GLM-4, GPT-3.5, GPT-4. The details of each pre-trained model are shown in Table 2.

[0115] Table 2 Pre-training model information

[0116]

[0117] 1. Comparison of data enhancement effectiveness

[0118] The experimental results are shown in Table 3 and Figure 8As shown. It can be seen that no matter which model is used, the access control statement rate of the document obtained by data enhancement using automatic prompt word optimization is closer to the sample document. This shows that through the automatic prompt word optimization method, the enhanced document is more similar to the sample document at the semantic level. To a certain extent, the automatic prompt word optimization method can better improve the availability and authenticity of data enhancement. In addition, the access control statement rate variance of this type of enhanced document is the smallest, reflecting that the data enhancement method based on automatic prompt word optimization has higher stability.

[0119] Table 3. Comparative experimental results of data enhancement effectiveness

[0120]

[0121] 2. Comparison of small sample learning attribute mining performance

[0122] The experimental results are shown in Table 4 and Fig. 9 From the perspective of small sample learning with different numbers of documents, the small sample learning effects of different models on different datasets are quite obvious. Among them, ERNIE 3.5 and GPT-3.5 have obvious small sample learning effects on dataset π. 2 and π 3 The contribution of small sample learning on attribute mining F1 value is almost 40%. From the perspective of different datasets, due to the dataset π 1 is an English dataset, and dataset π 2 and π 3 For Chinese dataset, GPT-4 in dataset π 1 The small sample learning effect of GPT-4 is better, while GLM-4 is just the opposite, which reflects the sensitivity of different models to different language environments. From the perspective of different pre-training models, the performance of GPT-4 and GLM-4 is generally better than the other two models. This phenomenon is related to the number of parameters and structure of the model.

[0123] Table 4 Experimental results of small sample learning attribute mining performance comparison

[0124]

[0125] 3. Comparison of thinking strategy generation performance

[0126] The experimental results are shown in Table 5 and Fig.10As shown in the figure. It can be seen intuitively that using the model self-generated thinking chain and the least-to-most method to prompt LLMs to generate access control policies can achieve higher policy coverage. Since the multi-hop thinking chain is designed for open-domain question-answering (ODQA) and is not suitable for more complex IE problems, LLMs cannot fully understand the multi-hop thinking chain in the access control policy generation problem, resulting in low policy coverage using this method.

[0127] Table 5. Experimental results of performance comparison of thinking chain strategy generation

[0128]

[0129] 4. Discussion chain strategy optimization performance comparison

[0130] The experimental results of the chain strategy optimization performance comparison are shown in Table 6. Fig.11 As shown in the figure, it can be seen intuitively that using discussion chains for strategy optimization has achieved good results on the three data sets, and the strategy WSC is compressed to 93.00%, 82.68%, and 54.24% of the original respectively.

[0131] Table 6 Discussion chain strategy optimization performance comparison experimental results

[0132]

[0133] 5. Ablation experiment

[0134] The ablation test results are shown in Tables 7, 8 and Fig.12 As shown. By combining the four methods proposed in this paper, the contribution of each method to the extraction of access control elements is calculated. From Table 7 and Fig.12 It can be seen that the attribute F1 value and policy coverage are basically synchronized, and both can be used as important indicators for evaluating access control factor extraction. Small sample learning contributes the most to performance, with nearly 40% improvement in attribute F1 value and policy coverage. Self-generated thought chains also significantly improve the performance of the baseline, which shows that prompting the model to think correctly and guiding the model reasoning steps are also crucial in the downstream task field of LLMs. The phenomenon of reducing policy coverage by using automatic prompt word optimization for data enhancement or using discussion chains for policy optimization may be data fluctuations caused by noise.

[0135] Table 7 Ablation experiment results 1. Methods α, β, γ, and δ represent the automatic generation of prompt words, small sample learning, automatic generation of thought chains, and discussion chains in this case.

[0136]

[0137] Table 8 shows the access control policy generation capabilities of different models. Among them, A is a method based on access control policy information, and both it and the solution LLMs-ACPGen in this case are supervised methods; B, C, and D are methods based on access control logs, which are unsupervised methods. For supervised methods, the size of the training set used to train the model and the model policy coverage are used as evaluation indicators to detect model performance and learning ability; for unsupervised methods, since the model depends on access control logs, the size of the data set is only used as a reference. The performance of the baseline model on the real data set is selected for comparison with the solution in this case, and the policy generation capability of the model is evaluated from two dimensions: policy coverage and data set size.

[0138] From Table 8 and Fig.12 It can be seen that due to the strong learning and generalization capabilities of LLMs, under the condition of small sample learning, LLMs-ACPGen can show performance similar to that of mainstream methods based on expert models, and the training set size is less than 7% of the expert model, which fully demonstrates that LLMs-ACPGen has strong "out-of-the-box" capabilities.

[0139] Table 8 Ablation experiment results 2

[0140]

[0141] The above data show that the solution in this case performs well in attribute mining and strategy generation tasks and has good application prospects.

[0142] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0143] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0144] The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention.

[0145] Those skilled in the art will appreciate that all or part of the steps in the above method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk or an optical disk. Optionally, all or part of the steps in the above embodiment can also be implemented using one or more integrated circuits, and accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or in the form of software function modules. The present invention is not limited to any specific form of combination of hardware and software.

[0146] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A method for generating access control policies based on a large language model, characterized in that: Include: Generate automatic prompt words using prompt word engineering, and generate enhanced data for a sample document based on the automatic prompt words, wherein the sample document is a text marked with access control elements, wherein the access control elements are used to describe the characteristics, status or identification of entities involved in access control; Using multiple large language models to learn the reasoning process of access control elements in sample documents and enhanced data and generate corresponding access control policy thought chains, so as to obtain the access control policy set of the target document in the attribute mining and policy generation task based on the thought chain, wherein the access control policy is the rule for the subject to access the object; The access control policies to be optimized in the access control policy set are selected based on a multi-model voting method, and the final access control attributes and policies are obtained according to the optimization results.

2. The access control policy generation method based on a large language model according to claim 1 is characterized in that: Generate automatic prompt words using prompt word engineering, including: Automatic prompt words are generated according to the question description and manual calibration and using a multi-round answer function. The multi-round answer function is used to set multiple question descriptions for the question to obtain the answer corresponding to the question through multi-round question and answer. The automatic prompt words are prompt words obtained by integrating the question description and the corresponding answer using the prompt word engineering during the multi-round question and answer process.

3. The access control policy generation method based on a large language model according to claim 2 is characterized in that: The prompt words obtained by integrating the question description and the corresponding answer using the prompt word engineering include: The prompt word template is configured according to the question description and the answer in the historical dialogue to generate the prompt word, wherein the prompt word template includes the task instruction configuration and the context configuration executed by the large language model.

4. The access control policy generation method based on a large language model according to claim 1 is characterized in that: Generate augmented data for sample documents based on automatic prompt words, including: Generate an intermediate text of the sample document using the automatic prompt words and a data enhancement function, wherein the data enhancement function is used to generate a similar semantic text for the sample document through a prompt template question-answering method; A tagger is used to tag the access control elements for the intermediate text to generate enhanced data marked with the access control elements. The tagger tags the access control elements for the intermediate text in a semi-supervised manner through a large model.

5. The access control policy generation method based on a large language model according to claim 1 or 4, characterized in that: The access control elements include subject attributes, object attributes, action attributes and environment attributes.

6. The access control policy generation method based on a large language model according to claim 1 is characterized in that: Using multiple large language models to learn the reasoning process of access control elements in example documents and enhanced data, including: Divide the sample texts into document types according to different application scenarios and / or usage specifications, and make each document type contain a number of texts; Multiple large language models respectively learn the access control element reasoning process of text in different document types, and the multiple large language models include but are not limited to: ERNIE 3.5, GLM-4, GPT-3.5 and GPT-4.

7. The access control policy generation method based on a large language model according to claim 1 is characterized in that: Based on the multi-model voting method, the access control policy to be optimized in the access control policy set is obtained, including: For each access control policy in the access control policy set, multiple large language models obtain the optimization of the access control policy to be optimized in the access control policy set based on the discussion chain and take turns to specify the optimization opinions of the access control policy to be optimized, and optimize the access control policy to be optimized based on the optimization opinions and using the majority voting idea. The discussion chain is a collaborative optimization response of multiple large language models to the access control policy based on the policy optimization prompt instructions.

8. An access control policy generation system based on a large language model, characterized in that: Contains: data enhancement module, learning reasoning module and optimization output module, among which, A data enhancement module, for generating automatic prompt words using prompt word engineering, and generating enhanced data for a sample document based on the automatic prompt words, wherein the sample document is a text marked with access control elements, wherein the access control elements are used to describe the characteristics, status or identification of entities involved in access control; A learning and reasoning module is used to use multiple large language models to learn the reasoning process of access control elements in sample documents and enhanced data and generate corresponding access control policy thought chains, so as to obtain the access control policy set of the target document in the attribute mining and policy generation task based on the thought chain, wherein the access control policy is the rule for the subject to access the object; The optimization output module is used to optimize the access control policies to be optimized in the access control policy set based on a multi-model voting method, and obtain the final access control attributes and policies according to the optimization results.

9. An electronic device, characterized in that: include: at least one processor, and a memory coupled to the at least one processor; The memory stores a computer program, and the computer program can be executed by the at least one processor to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed, the method according to any one of claims 1 to 7 can be implemented.

Images