Large-scale data fine-grained authorization method and device based on graph structure

Abstract

The invention discloses a large-scale data fine-grained authorization method and device based on a graph structure, and belongs to the field of access control. In order to solve the problem of rough authorization management in a big data environment, the method adopts the main steps of data preprocessing, user adaptive access control list construction, policy access control list generation, policy graph construction and authorization query. According to the method, flexible and fine authority management is realized through a graph structure, authority demand changes can be dynamically adapted, efficient and extensible access control is provided, meanwhile, a complex authority relationship is convenient to maintain, and the management precision and efficiency in a large-scale data scene are improved.

Description

Technical Field

[0001] The present invention belongs to the field of access control, and in particular relates to a large-scale data fine-grained authorization method and device based on a graph structure. Background Art

[0002] In modern information systems, data security and privacy protection have become critical issues. With the rapid growth of data volume and increasing complexity, traditional access control methods are facing more and more challenges. Especially for large-scale data sets, how to implement fine-grained authorization management to ensure that each user can only access the data they are authorized to has become a key issue.

[0003] Traditional access control methods mainly include access control list (ACL), role-based access control (RBAC) and attribute-based access control (ABAC). However, these methods have shortcomings when dealing with fine-grained access authorization of big data. For example, ACL is complex and inefficient when managing a large number of users and resources; although RBAC simplifies permission management through roles, it is insufficient in fine-grained control; although ABAC is flexible, the complexity of its attributes and rules increases the management burden of the system. Summary of the invention

[0004] The purpose of the present invention is to achieve large-scale fine-grained authority management through a graph structure to solve the problem of coarse granularity of authorization management in existing access control methods.

[0005] The technical solution adopted by the present invention to achieve the above-mentioned purpose is:

[0006] A large-scale data fine-grained authorization method based on a graph structure includes the following steps:

[0007] 1) Obtain user, role, resource type, and authorization-related database tables and integrate them into a single-user composite behavior log, which contains behavior tags and time information;

[0008] 2) Build a user access control list through single-user composite behavior logs to predict user permission requirements and access patterns;

[0009] 3) Build policy access control lists based on company policies and personnel documents;

[0010] 4) Integrate the user access control list and the policy access control list to obtain the access control list;

[0011] 5) Building a policy graph based on the entity information in the access control list and the relationship information between entities;

[0012] 6) Based on the user's request to access resources, a policy map query is performed to obtain the user's authorization status for resources.

[0013] Furthermore, the authorization-related database table in step 1) includes the user's login and logout logs, file operation logs, removable device plug-in and unplug logs, and upload and download behavior logs.

[0014] Furthermore, the step of integrating and forming a single user composite behavior log in step 1) includes:

[0015] Classify or enumerate the data content in the original log by category, retain the user ID and time information of each log entry, and simplify the repeated behaviors of the same user on the same data into a set of behavior labels;

[0016] Different types of behavior logs from the same user are aggregated according to the user ID and rearranged in chronological order to form a single-user composite behavior log.

[0017] Furthermore, the step of constructing a user access control list in step 2) includes:

[0018] Convert the time information in the single user's composite behavior log into location information so that the behavior tag set contains the time dimension and obtains the user behavior feature sequence;

[0019] Build a user adaptive mechanism to dynamically adjust and optimize user authorization policies to match actual user behavior;

[0020] The user behavior feature sequence is processed according to the user adaptive mechanism to generate a user access control list.

[0021] Furthermore, the step of obtaining the user behavior feature sequence in step 2) includes:

[0022] Divide a continuous period of time into multiple time periods of preset granularity, and set an index and a starting position offset for each time period;

[0023] Classify or enumerate the attributes in the behavior tag set and connect them to generate a behavior set;

[0024] According to the behavior labels, the behavior types in each time period are counted to obtain the user behavior feature sequence.

[0025] Furthermore, the adaptive mechanism in step 2) includes two sub-mechanisms:

[0026] Behavior pattern analysis mechanism: Analyze the user's behavior sequence over a period of time and identify user operation habits and access patterns;

[0027] Authorization policy optimization mechanism: Use machine learning algorithms to analyze user behavior data, extract potential behavior patterns, and optimize existing authorization policies.

[0028] Furthermore, the step of constructing a policy access control list in step 3) includes:

[0029] Perform text segmentation and part-of-speech tagging on company policies and personnel department documents to obtain preprocessed text;

[0030] Extract keywords from preprocessed text and identify entity information;

[0031] Extract the relationships between roles and permissions, and between people and roles from the identified entities;

[0032] Based on the labeled dataset of user access control lists, a natural language processing model is trained to extract the permission rules in the policy;

[0033] Generate a policy access control list based on the obtained entity information, relationships and permission rules.

[0034] Furthermore, the step of constructing a strategy map in step 5) includes:

[0035] Determine four types of nodes based on the entities in the access control list: users, roles, operations, and resources;

[0036] Based on the relationships between entities in the access control list, two types of edges are constructed between nodes: role inheritance relationships and access permission relationships;

[0037] Positive authorization and negative authorization are introduced. Positive authorization means that a certain operation is allowed, while negative authorization means that an operation is prohibited. The edge connecting the role node and the operation node is marked to indicate whether it corresponds to positive authorization or negative authorization.

[0038] Define the policy graph structure and add authorization conditions and attribute information:

[0039] If there is an inheritance or inclusion relationship between role categories, the prohibition policy is inherited from the higher-level category and the authorization policy is inherited from the lower-level category to obtain the forward path and reverse path between role nodes;

[0040] By removing redundant edges, we obtain a policy graph with category-based access control policies that are either authorized or prohibited.

[0041] Furthermore, the category-based access control policy in step 5) includes the following relationship categories: category assignment relationship, permission category relationship, disabled category relationship, authorized relationship, disabled relationship, and undefined relationship.

[0042] Furthermore, the step of querying the strategy graph in step 6) includes:

[0043] According to the user request, determine the node corresponding to the user in the strategy graph as the query starting point;

[0044] Use the graph query algorithm to start from the role node and traverse the paths along the edges in the strategy graph to find the paths from the role node to the operation node and from the operation node to the resource node.

[0045] Check the edge type on the traversal path to confirm whether the edge connecting the role node and the operation node is marked as positive authorization or negative authorization; if the path contains positive authorization, the user is authorized to perform the current operation; if it contains negative authorization, the current operation is prohibited; if the path contains specific conditions, verify whether the user request meets these conditions;

[0046] If the user role has an inheritance relationship, continue the query along the forward path or reverse path;

[0047] After the query is completed, the corresponding query results are returned according to the authorization or prohibition information on the path, including authorization passed, authorization denied, or undefined authorization.

[0048] Furthermore, in step 6), when performing a policy graph query, a graph database and a graph algorithm are used to perform permission query and path search.

[0049] A large-scale data fine-grained authorization device based on a graph structure, comprising:

[0050] The data preprocessing module is used to obtain user, role, resource type and authorization-related database tables and integrate them into a single-user composite behavior log, which contains behavior tags and time information;

[0051] Adaptive access control list construction module, used to build user access control lists through single-user composite behavior logs, predict user permission requirements and access patterns; build policy access control lists based on company policies and personnel documents; integrate user access control lists and policy access control lists to obtain access control lists;

[0052] The graph-based fine-grained access control module is used to build a policy graph based on the entity information and the relationship information between entities in the access control list; according to the user's access resource request, the policy graph query is performed to obtain the user's authorization status for the resource.

[0053] The technical effects achieved by the present invention are as follows:

[0054] 1. The present invention provides a flexible permission management model by modeling the relationship between users, resources, roles and permissions as a graph structure. The model can adapt to complex permission requirements and changing scenarios, making permission management more flexible and highly scalable.

[0055] 2. The present invention can refine access control to the level of objects, attributes, instances and specific data units, greatly improving the management accuracy of resources. By defining different types of nodes and edges and adding access control attributes to the edges, the present invention can accurately manage and verify complex permission relationships and achieve high-precision access control.

[0056] 3. The present invention utilizes the query and traversal functions of the graph database to effectively process complex relationships and multi-level connection queries. The graph database is suitable for processing users, roles, resources and the complex relationships between them, and can also provide efficient storage and query performance under large-scale data sets, thereby ensuring the scalability and performance of the system in large-scale scenarios.

[0057] 4. The present invention can dynamically adjust to adapt to the changing permission requirements and data structures, and can be extended to large-scale data sets, with good scalability. This enables the system to maintain efficient and stable performance even in big data scenarios.

[0058] 5. The present invention intuitively represents the permission relationship through a graph structure, which is convenient for system administrators to manage and maintain permissions. The nodes and edges of the graph can clearly present the relationship between users, roles, resources and their permissions, thereby improving the operability and maintainability of permission management.

[0059] 6. The present invention can verify permissions quickly and efficiently through the query and path search functions of the graph database. The query algorithm can accurately calculate the user's permissions in a specific scenario, thereby achieving refined access control of large-scale data.

[0060] 7. The present invention solves the problem of rough authorization management in big data scenarios through a fine-grained access control strategy based on a graph structure. It can deeply explore the relationship between users and permissions, and effectively solves the shortcomings of existing authorization schemes in terms of fine-grained user management.

[0061] 8. The present invention can learn and analyze authorization features related to identity, time, etc., so as to dynamically adjust the authorization policy. This enables the solution to have a high level of scenario generalization ability, can adapt to the permission requirements in different application scenarios, and further enhance the intelligence and adaptability of the solution. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 This diagram is a large-scale data fine-grained authorization process based on a graph structure according to an embodiment of the present invention.

[0063] Figure 2 It is a schematic diagram of authorization strategy according to another embodiment of the present invention. DETAILED DESCRIPTION

[0064] In order to make the various technical features and advantages or technical effects in the above technical solutions of the present invention more obvious and easy to understand, they are described in detail below with reference to the accompanying drawings.

[0065] The embodiment of the present invention proposes a large-scale data fine-grained authorization method and device based on a graph structure, which mainly creates an access control policy graph through authorization feature extraction and graph-based access control to achieve the purpose of fine-grained authorization. The device includes: a data preprocessing module, an adaptive access control list construction module and a graph-based fine-grained access control module, wherein the data preprocessing module is mainly used to obtain a single-user composite behavior log; the adaptive access control list construction module is mainly used to build a user adaptive mechanism to find the authorization or prohibition and the corresponding file data and operation behavior for each user; the graph-based fine-grained access control module is mainly composed of two parts: authorization graph construction and query. The method and device perform the same processing steps, such as Figure 1 As shown, each step is described in detail below.

[0066] 1. Data preprocessing

[0067] Get the system's users, roles, resource types, and various authorization-related database tables. Various authorization-related database tables include user login and logout behavior logs, file operation behavior logs, removable device plug-in and unplug behavior logs, and upload and download behavior logs.

[0068] The above behavior logs are integrated into a unified single-user composite behavior log, which contains the label and corresponding timestamp of each behavior log, as well as the internal corporate policies and personnel documents of the human resources department. The steps to integrate and form a single-user composite behavior log include:

[0069] 1) Classify or enumerate the original behavior log according to the access data content, retain the user ID and time in each user behavior log entry, simplify the operation behavior on the object resource in the log into a behavior label, specifically, connect the same behavior on the same data content (including access, modification, deletion and other operation behaviors) together to obtain a behavior label set.

[0070] 2) Aggregate different types of behavior logs from the same user according to user ID and rearrange them in chronological order to obtain a single user composite behavior log.

[0071] 2. Authorization information extraction

[0072] 2-1. Build a user access control list based on the single-user composite behavior log, and learn and predict the user's permission requirements and access patterns from the historical access record data of the single-user composite behavior log. The steps include:

[0073] 1) Convert the time information of the behavior log into location information, so that the behavior tag set contains the behavior time information, and obtain the user behavior feature sequence. The method of converting the time information into location information is: first divide the continuous time, for example, 24 hours, into T time periods with a granularity of G, and the range of each time period is [0:00+b+G t ,0:00+b+G (t+1) ], where t is the index of the time period and b is the offset of the starting point of the time period. TG = 24h = 1440m = 86400s. Then, by classifying or enumerating each attribute in the behavior tag set, the corresponding behavior set is obtained after connection. Finally, the behavior tags of each time period are counted by type. The counted behavior types mainly include login and logout, plugging and unplugging removable devices, sending and receiving emails, and file operations (including access, modification, deletion, etc.).

[0074] 2) Build a user adaptive mechanism to find the authorization or prohibition and the corresponding file data and operation behavior for each user. The user adaptive mechanism aims to dynamically adjust and optimize the user's authorization policy to ensure that it matches the user's actual behavior and needs, including (1) a behavior pattern analysis mechanism to analyze the user's behavior sequence over a period of time and identify the user's operation habits and access patterns; (2) an authorization policy optimization mechanism that uses machine learning algorithms to automatically analyze a large amount of user behavior data, extract potential behavior patterns from it, and optimize and adjust existing authorization policies. The system can identify common user group behaviors and generate more appropriate access control policies for these groups.

[0075] 3) The user behavior feature sequence is processed according to the user adaptive mechanism to construct a user access control list, which contains the user behavior classification count values ​​by time period, that is, the result of counting different behavior labels of users in different time periods, providing behavior type information and behavior time information for subsequent access control.

[0076] 2-2. Build a policy access control list based on HR department documents and company policies: Develop a higher priority user access control list based on internal organizational regulations. Use natural language processing technology to extract permission rules and information from unstructured company policies and documents. The specific steps can be divided into:

[0077] 1) Preprocessing: text segmentation and part-of-speech tagging of policy documents.

[0078] 2) Information extraction, including extracting keywords from the text and performing named entity recognition to extract entity content such as job roles, permissions, data information, etc. from the text.

[0079] 3) Relationship extraction: extract the relationship between people and roles, and the relationship between roles and permissions from the identified entities, and use dependency parsing or syntactic analysis to determine the relationship.

[0080] 4) Model training: Train the NLP model and use the deep learning framework to label and differentiate the permissions of internal personnel in the organization through the labeled data set obtained from the user access control list.

[0081] 2-3. Revise the access control list of the generated graph based on the above two lists. Since the policy and existing access control records cannot cover all requirements, revise some authorization policies that have not been considered, integrate and update the existing policy access control list, and obtain the revised access control list.

[0082] 3. Build a strategy map

[0083] 3-1. Determine the nodes of the graph according to the authorization relationship in the access control list. The types of nodes include:

[0084] (1) P: represents individual users in the system, that is, the set of user subjects.

[0085] (2) C represents a set of user categories with the same permissions, that is, user roles.

[0086] (3) A represents the operation performed by the user on the resource, such as read, write, modify, delete, etc.

[0087] (4) R represents the collection of object resources, including data objects in the system, such as databases, tables, documents, files, etc.

[0088] For P, C, and R type nodes, each entity is a node; for A type, each entity can have multiple nodes.

[0089] 3-2. Determine the relationship between entities, i.e. the edge of the graph, based on the authorization relationship in the access control list. There are two types:

[0090] (1) The inheritance relationship between user roles, that is, the edges connecting user nodes and role nodes, and between role nodes, which are used to represent the transfer of permissions;

[0091] (2) Access permission relations, i.e., the edges connecting role nodes and operation nodes, indicate that a role has the permission to perform a specific operation (such as read, write, modify, delete, etc.). This edge clarifies the functional permissions of a role on a specific resource in the system. Execution permission relations (i.e., the edges connecting operations and object resources) clarify the permission level of a specific operation on a resource.

[0092] Construct a policy graph based on the above nodes and edges. Consider an authorization policy that contains positive authorization and negative authorization, where negative authorization represents prohibition. Due to the introduction of negative authorization, when there is an edge connecting a C-type node and an A-type node, it must be specified whether this corresponds to authorization or prohibition.

[0093] Defines a strategy graph: a tuple Where V is a node set, E is a combination of undirected edges, and lv is a node labeling function: for each node v in the node set V, lv(v).ent∈P∪C∪A∪R, that is, the node represented by node v belongs to the four major node types. le is an edge labeling function. For an edge e connecting nodes v1 and v2 in the edge set E, let le(e).adj={v1,v2}, which is the labeling function of edge e, used to record which two nodes v1,v2 it connects, where v1,v2∈V, and v1≠v2.

[0094] The record tag of a node contains a field type T, where T∈{P,C,A,R}. If lv(v).ent=p∈P, then lv(v).type=P (indicating that the node type is the principal user). Similarly, C and R represent categories and resources, respectively.

[0095] The type of edge is determined by the type of the adjacent nodes, that is, if le(e).adj={v1,v2}, then type(e)=(lv(v1).type,lv(v2).type). Taking lv(v1).type=C,lv(v2).type=A as an example, e1 is the edge connecting v1 and v2, type(e1)=(C,A), and this edge type is the edge connecting users and roles. The edge type (T1,T2) is simply represented as T1T2, such as CA is the type of edge connecting C-type nodes and A-type nodes. Because the edge is undirected, the types T1T2 and T2T1 are not distinguished. In order to handle policies that include prohibitions, consider adding an additional field authorization to the label of the edge of type CA, whose value is {α,β}, representing positive and negative authorization (i.e., authorized and prohibited operations), respectively. In order to further refine the control, more attributes can be added to the access permission edge, such as time limit, location, device type, conditional expression, etc., to accurately control the permissions in specific situations. In this way, authorization policies can be further divided and managed. The conditions of the edge can be marked with γ. If γ is met, authorization or prohibition is completed according to {α, β}. That is, {α, β} and γ are used to mark the edge type CA, and the CA type edge is divided into two corresponding sets CA α,γ and CA β,γ , to represent whether the edge is authorized or prohibited under condition γ.

[0096] The path of length n between two nodes v0 and v1 in the strategy graph G is a sequence v0,v1,..vn , where the nodes are different, that is, there is no cycle in the graph. For 1≤i≤n, for some edges e, {v i-1 ,v i}=le(e).adj.

[0097] When categories have an inheritance or inclusion relationship (such as managers and ordinary employees), the category inherits prohibitions from its higher-level category and inherits authorizations from its lower-level category. and They represent the paths from high-level categories to low-level categories and from low-level categories to high-level categories respectively. The paths between nodes of the same level without containment relationship do not distinguish between their forward and reverse directions.

[0098] For a well-formed graph with no redundant edges and forbidden strategies The goal is to be able to extract a Class-Based Access Control (CBAC) policy with authorization or prohibition from a policy graph to extract the permission policy assigned to user classes rather than individual users. For a policy graph, it contains a countable set of categories A countable set of entities Countable set of actions Resource countable set The following relationships exist in the policy:

[0099] 1) Category allocation relationship:

[0100] 2) Relationship between authority categories: If for resources Action on Meet in category If it is executable, then

[0101] 3) Disable category relationships: If for resources Action on Meet in category If the above prohibits execution, then there is

[0102] 4) Authorization relationship: If for the subject Executable in resources Action on Then there is

[0103] 5) Disable relationships: If for the subject Disable execution on resources Action on Then there is

[0104] 6) Undefined relations: That is, undefined subject-operation-object resource behavior, for the subject In Resources Action on Undefined authorization situation.

[0105] For each strategy map Extraction strategy Will Represented as a tuple:

[0106]

[0107] in: are the subject, category, action, resource, scenario identifier and inclusion relationship in the strategy graph. Then:

[0108]

[0109]

[0110] 3. Authorization query

[0111] Based on the user's access request, the authorization status of a resource is queried through graph query to verify the permission.

[0112] The purpose of graph query is to analyze the policy by obtaining policy information while building the query, and to calculate the authorization of the CBAC policy from the graph representation. If there is no inclusion relationship between categories and no other access condition restrictions, they can be simplified as a whole, that is, all paths of length 3 starting from the P-type node and ending at the R-type node can effectively calculate the authorization When a user requests to access a resource, the authorization query can be answered by graph theory: for a given node v representing category C, the type starting from v is calculated. CA A,C ,AR to obtain the associated set of allowed actions. The last two nodes of each path define an action allowed for the service in that category. The complexity is polynomial in the size of the policy, or more precisely, in the size of the subgraph of the policy graph to be traversed.

[0113] When a user requests access to a resource, the permission is verified through graph query, and the graph database (such as Neo4j) and graph algorithm are used to perform permission query and path search. The permission query is used to query the role and corresponding permissions of the user node, and the path search is used to search the path between the user and the data entity based on the graph structure to make permission judgments.

[0114] Another embodiment of the present invention is Figure 2 As shown, the specific implementation is as follows:

[0115] 1) Obtain a single user's composite behavior log, including the user's login and logout behavior, removable device plug-in and unplug behavior, file operation behavior, etc. The log contains the behavior label and the corresponding timestamp.

[0116] 2) Build a user access control list based on the log. Use the user behavior feature sequence to build s=<uid,time,action,resources> , where uid is the user id, time is the time granularity, action is the operation performed, such as read, change, delete, etc. resources is the resource data, that is, the object.

[0117] 3) Build an access control list based on the personnel department documents and company policies, extract the position identity information corresponding to different user IDs, and formulate a policy access control list in combination with company policy regulations, such as time restrictions: prohibiting viewing data during non-working hours, etc. Information extraction First, identify named entities from the text, and use BiLSTM+Attention for entity recognition and relationship extraction.

[0118] 4) Since existing logs and company policies may ignore some authorization conditions or make mistakes, it is necessary to conduct an audit after the construction is completed. Based on the above two lists, an access control list for building the graph is generated and improved to obtain s=<uid,role,condition,action,resources> , where condition contains condition information such as time.

[0119] 5) Build an authorization policy graph. The process of building an authorization graph involves defining nodes and relationships, as well as creating and managing a graph database. Nodes include users, roles, operations, and resources. Use a graph database to create nodes and represent authorization relationships, and define attributes and vectors on permission edges. For example, you can add an attribute to indicate the type of authorization (allow or prohibit), as well as other conditions (such as time range, IP address, etc.). Take the Neo4j graph database as an example:

[0120]

[0121] 6) Query and manage permissions. When a user requests access to a data entity, the system parses the operation requested by the user and the target data entity.

[0122] User request analysis: identify the requesting user subject, identify the operation request, and identify the target object.

[0123] Permission verification: Verify whether the user has permission to perform the requested operation through graph query, and check the access rights of the specific data fields represented by the vector. Example: Use Cypher query language to check whether the user has permission to read the document.

[0124]

[0125] Access control: Allow or deny user access requests based on permission verification results.

[0126] In actual applications, you can use more features of Cypher to optimize query performance, such as using indexes, query planning optimization, etc. You can also combine Neo4j's transaction management, data consistency guarantee and other functions to manage and operate data. Through the above methods, you can use the Neo4j graph database to perform complex permission queries and check whether a user has access rights to a specific document or resource.

[0127] Although the present invention has been disclosed as above by way of embodiments, it is not intended to limit the present invention. Appropriate modifications or equivalent substitutions of the technical solutions of the present invention made by ordinary technicians in the field should all be included in the protection scope of the present invention. The protection scope of the present invention shall be based on what is defined in the claims.

Claims

1. A large-scale data fine-grained authorization method based on graph structure, characterized in that: The following steps are involved: 1) Obtain user, role, resource type, and authorization-related database tables and integrate them into a single-user composite behavior log, which contains behavior tags and time information; 2) Build a user access control list through single-user composite behavior logs to predict user permission requirements and access patterns; 3) Build policy access control lists based on company policies and personnel documents; 4) Integrate the user access control list and the policy access control list to obtain the access control list; 5) Building a policy graph based on the entity information in the access control list and the relationship information between entities; 6) Based on the user's request to access resources, a policy map query is performed to obtain the user's authorization status for resources.

2. The method according to claim 1, characterized in that The authorization-related database tables in step 1) include the user's login and logout logs, file operation logs, removable device plug-in and unplug logs, and upload and download behavior logs; The steps to integrate and form a single user's composite behavior log include: Classify or enumerate the data content in the original log by category, retain the user ID and time information of each log entry, and simplify the repeated behaviors of the same user on the same data into a set of behavior labels; Different types of behavior logs from the same user are aggregated according to the user ID and rearranged in chronological order to form a single-user composite behavior log.

3. The method according to claim 1, characterized in that The steps of constructing the user access control list in step 2) include: Convert the time information in the single user's composite behavior log into location information so that the behavior tag set contains the time dimension and obtains the user behavior feature sequence; Build a user adaptive mechanism to dynamically adjust and optimize user authorization policies to match actual user behavior; The user behavior feature sequence is processed according to the user adaptive mechanism to generate a user access control list.

4. The method according to claim 3, characterized in that The steps of obtaining the user behavior feature sequence in step 2) include: Divide a continuous period of time into multiple time periods of preset granularity, and set an index and a starting position offset for each time period; Classify or enumerate the attributes in the behavior tag set and connect them to generate a behavior set; According to the behavior labels, the behavior types in each time period are counted to obtain the user behavior feature sequence.

5. The method according to claim 3, characterized in that The adaptive mechanism in step 2) includes two sub-mechanisms: Behavior pattern analysis mechanism: Analyze the user's behavior sequence over a period of time and identify user operation habits and access patterns; Authorization policy optimization mechanism: Use machine learning algorithms to analyze user behavior data, extract potential behavior patterns, and optimize existing authorization policies.

6. The method according to claim 1, characterized in that The step of constructing the policy access control list in step 3) includes: performing text segmentation and part-of-speech tagging on company policies and personnel department documents to obtain pre-processed text; Extract keywords from preprocessed text and identify entity information; Extract the relationships between roles and permissions, and between people and roles from the identified entities; Based on the labeled dataset of user access control lists, a natural language processing model is trained to extract the permission rules in the policy; Generate a policy access control list based on the obtained entity information, relationships and permission rules.

7. The method according to claim 1, characterized in that The steps of constructing the strategy map in step 5) include: Determine four types of nodes based on the entities in the access control list: users, roles, operations, and resources; Based on the relationships between entities in the access control list, two types of edges are constructed between nodes: role inheritance relationships and access permission relationships; Positive authorization and negative authorization are introduced. Positive authorization means that a certain operation is allowed, while negative authorization means that an operation is prohibited. The edge connecting the role node and the operation node is marked to indicate whether it corresponds to positive authorization or negative authorization. Define the policy graph structure and add authorization conditions and attribute information: If there is an inheritance or inclusion relationship between role categories, the prohibition policy is inherited from the higher-level category and the authorization policy is inherited from the lower-level category to obtain the forward path and reverse path between role nodes; Redundant edges are deleted to obtain a policy graph of a category-based access control policy with authorization or prohibition; the category-based access control policy includes the following relationship categories: category assignment relationship, permission category relationship, prohibited category relationship, authorization relationship, prohibited relationship and undefined relationship.

8. The method according to claim 1, characterized in that The steps of querying the strategy graph in step 6) include: According to the user request, determine the node corresponding to the user in the strategy graph as the query starting point; Use the graph query algorithm to start from the role node and traverse the paths along the edges in the strategy graph to find the paths from the role node to the operation node and from the operation node to the resource node. Check the edge type on the traversal path to confirm whether the edge connecting the role node and the operation node is marked as positive authorization or negative authorization; if the path contains positive authorization, the user is authorized to perform the current operation; if it contains negative authorization, the current operation is prohibited; if the path contains specific conditions, verify whether the user request meets these conditions; If the user role has an inheritance relationship, continue the query along the forward path or reverse path; After the query is completed, the corresponding query results are returned according to the authorization or prohibition information on the path, including authorization passed, authorization denied, or undefined authorization.

9. The method according to claim 1, characterized in that Step 6) When performing a policy graph query, use the graph database and graph algorithm to perform permission query and path search.

10. A large-scale data fine-grained authorization device based on a graph structure, used to implement the method described in any one of claims 1 to 9, characterized in that: include: The data preprocessing module is used to obtain user, role, resource type and authorization-related database tables and integrate them into a single-user composite behavior log, which contains behavior tags and time information; Adaptive access control list construction module, used to build user access control lists through single-user composite behavior logs, predict user permission requirements and access patterns; build policy access control lists based on company policies and personnel documents; integrate user access control lists and policy access control lists to obtain access control lists; The graph-based fine-grained access control module is used to build a policy graph based on the entity information and the relationship information between entities in the access control list; according to the user's access resource request, the policy graph query is performed to obtain the user's authorization status for the resource.

Images