A large-scale data fine-grained authorization method and device based on a graph structure

Abstract

The application discloses a large-scale data fine-grained authorization method and device based on a graph structure and belongs to the field of access control. In order to solve the problem of coarse authorization management in a big data environment, the application adopts the main steps of data preprocessing, user adaptive access control list construction, policy access control list generation, strategy graph construction and authorization query. The application achieves flexible and fine permission management through a graph structure, can dynamically adapt to changes in permission requirements, provides efficient and scalable access control, is convenient for maintaining complex permission relationships and improves the management precision and efficiency in a large-scale data scene.

Description

Technical Field

[0001] This invention belongs to the field of access control, and particularly relates to a method and apparatus for fine-grained authorization of large-scale data based on graph structures. Background Technology

[0002] In modern information systems, data security and privacy protection have become paramount. With the rapid growth in data volume and increasing complexity, traditional access control methods face growing challenges. Particularly for large-scale datasets, achieving fine-grained authorization management to ensure each user can only access their authorized data becomes a critical issue.

[0003] Traditional access control methods mainly include Access Control Lists (ACLs), Role-Based Access Control (RBAC), and Attribute-Based Access Control (ABAC). However, these methods have drawbacks when dealing with fine-grained access authorization for large datasets. For example, ACLs are complex and inefficient when managing a large number of users and resources; while RBAC simplifies permission management through roles, it lacks fine-grained control; and although ABAC is flexible, the complexity of its attributes and rules increases the system's management burden. Summary of the Invention

[0004] The purpose of this invention is to achieve large-scale fine-grained permission management through graph structure, so as to solve the problem of coarse-grained authorization management in existing access control methods.

[0005] The technical solution adopted by the present invention to achieve the above objectives is as follows:

[0006] A fine-grained authorization method for large-scale data based on graph structures includes the following steps:

[0007] 1) Obtain user, role, resource type and authorization-related database tables, and integrate them into a single-user composite behavior log, which includes behavior tags and time information;

[0008] 2) Construct user access control lists using single-user composite behavior logs to predict user permission requirements and access patterns;

[0009] 3) Construct a policy access control list based on company policies and personnel documents;

[0010] 4) Integrate user access control lists and policy access control lists to obtain access control lists;

[0011] 5) Construct a strategy graph based on the entity information and the relationships between entities in the access control list;

[0012] 6) Based on the user's resource access request, perform a policy graph query to obtain the user's authorization status for the resource.

[0013] Furthermore, in step 1), the authorized database tables include user login / logout logs, file operation logs, removable device plug-in / plug-out logs, and upload / download behavior logs.

[0014] Furthermore, step 1) involves integrating these elements to form a single-user composite behavior log, which includes:

[0015] The data content in the original log is classified or enumerated by category, and the user ID and time information of each log entry are retained. Repeated behaviors of the same user on the same data are simplified into a set of behavior tags.

[0016] Based on the user ID, different types of behavior logs from the same user are aggregated and rearranged in chronological order to form a single-user composite behavior log.

[0017] Furthermore, step 2) involves constructing the user access control list, which includes:

[0018] Convert the time information in the single-user composite behavior log into location information, so that the behavior tag set includes the time dimension, and obtain the user behavior feature sequence.

[0019] Build a user adaptive mechanism to dynamically adjust and optimize user authorization policies to match actual user behavior;

[0020] The user behavior feature sequence is processed according to the user adaptation mechanism to generate a user access control list.

[0021] Furthermore, step 2) involves obtaining the user behavior feature sequence, which includes:

[0022] Divide a continuous period of time into multiple time periods with a preset granularity, and set an index and a starting position offset for each time period;

[0023] Classify or enumerate the attributes in the set of behavior tags, and then concatenate them to generate a set of behaviors.

[0024] Based on the behavioral tags, the types of behavior within each time period are counted to obtain a sequence of user behavior characteristics.

[0025] Furthermore, the adaptive mechanism in step 2) comprises two sub-mechanisms:

[0026] Behavioral pattern analysis mechanism: Analyzes user behavior sequences over a period of time to identify user operating habits and access patterns;

[0027] Authorization strategy optimization mechanism: Use machine learning algorithms to analyze user behavior data, extract potential behavior patterns, and optimize existing authorization strategies.

[0028] Furthermore, step 3) involves constructing the policy access control list, which includes:

[0029] The company's policies and HR department documents are segmented and tagged with parts of speech to obtain preprocessed text.

[0030] Extract keywords from preprocessed text and identify entity information;

[0031] Extract the relationships between roles and permissions, and between personnel and roles, from the identified entities;

[0032] Based on the labeled dataset in the user access control list, a natural language processing model is trained to extract the permission rules in the policy;

[0033] Based on the obtained entity information, relationships, and permission rules, a policy access control list is generated.

[0034] Furthermore, the steps in step 5) to construct the strategy graph include:

[0035] Based on the entities in the access control list, four types of nodes are identified: users, roles, operations, and resources;

[0036] Based on the relationships between entities in the access control list, construct two types of edges between nodes: role inheritance relationships and access permission relationships;

[0037] Introduce positive and negative authorization. Positive authorization means that an operation is allowed, while negative authorization means that the operation is prohibited. Mark the corresponding positive or negative authorization on the edge connecting the role node and the operation node.

[0038] Define the strategy graph structure and add authorization conditions and attribute information:

[0039] If there is an inheritance or inclusion relationship between role categories, the prohibition policy is inherited from the higher-level category and the authorization policy is inherited from the lower-level category to obtain the forward and reverse paths between role nodes;

[0040] Remove redundant edges to obtain a policy graph with class-based access control policies that allow or deny access.

[0041] Furthermore, the category-based access control policy in step 5) includes the following relationship categories: category assignment relationship, permission category relationship, disabled category relationship, authorization relationship, disabled relationship, and undefined relationship.

[0042] Furthermore, the steps for performing a strategy graph query in step 6) include:

[0043] Based on the user's request, determine the node in the strategy graph corresponding to the user as the query starting point;

[0044] The graph query algorithm starts from the role node and traverses the path along the edges of the strategy graph to find the path from the role node to the operation node and the path from the operation node to the resource node.

[0045] Check the edge types on the traversal path to confirm whether the edges connecting the role node and the operation node are marked as positive or negative authorization; if the path contains positive authorization, the user is authorized to execute the current operation; if it contains negative authorization, the current operation is prohibited; if the path contains specific conditions, verify whether the user request meets these conditions.

[0046] If user roles have an inheritance relationship, continue the query along the forward or reverse path;

[0047] After the query is completed, the corresponding query results are returned based on the authorization or prohibition information on the path, including authorization approved, authorization denied, or authorization not defined.

[0048] Furthermore, in step 6), when performing a strategy graph query, a graph database and graph algorithms are used for permission queries and path searches.

[0049] A large-scale data fine-grained authorization device based on graph structure, comprising:

[0050] The data preprocessing module is used to obtain user, role, resource type and authorization-related database tables, and integrate them into a single-user composite behavior log, which includes behavior tags and time information;

[0051] The adaptive access control list building module is used to build user access control lists from single-user composite behavior logs, predict user permission requirements and access patterns; build policy access control lists based on company policies and personnel documents; and integrate user access control lists and policy access control lists to obtain the access control list.

[0052] The graph-based fine-grained access control module is used to construct a policy graph based on entity information and relationships between entities in the access control list; and to query the policy graph based on the user's resource access request to obtain the user's authorization status for the resource.

[0053] The technical effects achieved by this invention are as follows:

[0054] 1. This invention provides a flexible permission management model by modeling the relationship between users, resources, roles, and permissions as a graph structure. This model can adapt to complex permission requirements and changing scenarios, making permission management more flexible and highly scalable.

[0055] 2. This invention enables refined access control down to the object, attribute, instance, and specific data unit level, significantly improving the precision of resource management. By defining different types of nodes and edges and adding access control attributes to the edges, this invention can precisely manage and verify complex permission relationships, achieving high-precision access control.

[0056] 3. This invention utilizes the query and traversal capabilities of graph databases to effectively handle complex relationships and multi-level join queries. Graph databases are suitable for handling users, roles, resources, and the complex relationships between them, and can provide efficient storage and query performance even with large-scale datasets, thus ensuring the scalability and performance of the system in large-scale scenarios.

[0057] 4. This invention can dynamically adjust to adapt to constantly changing permission requirements and data structures, and can be scaled to large-scale datasets, exhibiting excellent scalability. This enables the system to maintain high efficiency and stable performance even in big data scenarios.

[0058] 5. This invention uses a graph structure to intuitively represent permission relationships, facilitating permission management and maintenance by system administrators. The nodes and edges of the graph clearly illustrate the relationships between users, roles, resources, and their permissions, thereby improving the operability and maintainability of permission management.

[0059] 6. This invention utilizes the query and path search functions of a graph database to quickly and efficiently verify permissions. The query algorithm can accurately calculate a user's permission status in a specific scenario, thereby achieving fine-grained access control for large-scale data.

[0060] 7. This invention solves the problem of coarse authorization management in big data scenarios by adopting a fine-grained access control strategy based on graph structure. It can deeply explore the relationship between users and permissions, and effectively solve the shortcomings of existing authorization schemes in terms of fine-grained user management.

[0061] 8. This invention can learn and analyze authorization features related to identity, time, etc., thereby dynamically adjusting the authorization strategy. This gives the solution a high degree of scenario generalization ability, enabling it to adapt to the permission requirements of different application scenarios, further enhancing the solution's intelligence and adaptability. Attached Figure Description

[0062] Figure 1 This diagram illustrates a large-scale data fine-grained authorization process based on a graph structure, according to an embodiment of the present invention.

[0063] Figure 2 This is a schematic diagram of the licensing strategy according to another embodiment of the present invention. Detailed Implementation

[0064] To make the various technical features, advantages, or effects of the present invention more apparent and understandable, a detailed description is provided below in conjunction with the accompanying drawings.

[0065] This invention proposes a method and apparatus for fine-grained authorization of large-scale data based on graph structures. It mainly achieves fine-grained authorization by extracting authorization features and creating an access control policy graph based on graph structures. The apparatus includes: a data preprocessing module, an adaptive access control list construction module, and a graph-based fine-grained access control module. The data preprocessing module is mainly used to obtain single-user composite behavior logs; the adaptive access control list construction module is mainly used to build a user adaptive mechanism, finding the authorization or prohibition for each user and the corresponding file data and operation behavior; the graph-based fine-grained access control module mainly consists of authorization graph construction and querying. This method and apparatus perform the same processing steps, such as... Figure 1 As shown below, each step will be explained in detail.

[0066] 1. Data Preprocessing

[0067] Retrieve system users, roles, resource types, and authorization-related database tables for each type. These authorization-related database tables include user login / logout logs, file operation logs, removable device plug-in / plug-out logs, and upload / download logs.

[0068] The above behavior logs are integrated into a unified single-user composite behavior log, which includes the tag and corresponding timestamp for each behavior log, as well as internal company policies and regulations and personnel documents from the human resources department. The steps for integrating these into a single-user composite behavior log include:

[0069] 1) Classify or enumerate the access data content in the original behavior log, retain the user ID and time in each user behavior log entry, and simplify the operation behavior on the object resource in the log into behavior tags. Specifically, connect the same behavior (including access, modification, deletion, etc.) on the same data content together to obtain a set of behavior tags.

[0070] 2) Aggregate different types of behavior logs from the same user based on the user ID, and rearrange them in chronological order to obtain a single-user composite behavior log.

[0071] 2. Extraction of Authorization Information

[0072] 2-1. Construct a user access control list based on single-user composite behavior logs. Learn and predict user permission requirements and access patterns from historical access records in the single-user composite behavior logs. The steps include:

[0073] 1) Convert the time information of the behavior log into location information, so that the behavior tag set includes behavior time information, thus obtaining the user behavior feature sequence. The method for converting time information into location information is as follows: First, divide a continuous period, for example, 24 hours, into T time periods with a granularity of G, where each time period ranges from [0:00+b+G]. t ,0:00+b+G (t+1) ], where t is the index of the time period and b is the offset of the start point of the time period. TG = 24h = 1440m = 86400s. Then, by classifying or enumerating each attribute in the behavioral tag set, the corresponding behavioral set is obtained after concatenation. Finally, the behavioral tags for each time period are statistically analyzed. The statistically analyzed behavioral types mainly include login / logout, plugging / unplugging of removable devices, sending and receiving emails, and file operations (including access, modification, deletion, etc.).

[0074] 2) Construct a user adaptation mechanism to find the authorized or prohibited data and corresponding operation behaviors for each user. This user adaptation mechanism aims to dynamically adjust and optimize the user authorization policy to ensure that it matches the user's actual behavior and needs. This includes (1) a behavior pattern analysis mechanism, which analyzes the user's behavior sequence over a period of time to identify the user's operation habits and access patterns; and (2) an authorization policy optimization mechanism, which uses machine learning algorithms to automatically analyze a large amount of user behavior data, extract potential behavior patterns, and optimize and adjust the existing authorization policy. The system can identify common user group behaviors and generate more suitable access control policies for these groups.

[0075] 3) Process the user behavior feature sequence according to the user adaptation mechanism and construct a user access control list. This list contains user behavior classification count values ​​for different time periods, that is, the results of counting different behavior labels of users in different time periods, providing behavior type information and behavior time information for subsequent access control.

[0076] 2-2. Construct policy access control lists based on HR documents and company policies: Develop higher-priority user access control lists based on internal organizational regulations. Use natural language processing technology to extract permission rules and information from unstructured company policies and documents. Specific steps can be divided into:

[0077] 1) Preprocessing: perform text segmentation and part-of-speech tagging on the policy documents.

[0078] 2) Information extraction, including extracting keywords from the text and performing named entity recognition to extract entity content such as job roles, permissions, and data information from the text.

[0079] 3) Relation extraction: Extract the relationships between people and roles, and between roles and permissions from the identified entities, and use dependency parsing or syntactic analysis to determine the relationships.

[0080] 4) Model training: Train the NLP model and use a deep learning framework to label and distinguish permissions for internal personnel using the labeled dataset obtained from the user access control list.

[0081] 2-3. Revise the access control list generated from the above two lists to create the diagram. Since policies and existing access control records cannot cover all requirements, some authorization policies that were not considered are revised, and the existing policy access control lists are integrated and updated to obtain the revised access control list.

[0082] 3. Construct a strategy graph

[0083] 3-1. Determine the nodes of the graph based on the authorization relationships in the access control list. The node types include:

[0084] (1) P: represents the individual users in the system, i.e. the set of user subjects.

[0085] (2) C represents a set of user categories with the same permissions, which means user roles.

[0086] (3) A represents the operation performed by the user on the resource, such as reading, writing, modifying, deleting, etc.

[0087] (4) R represents the set of object resources, including data objects in the system, such as databases, tables, documents, files, etc.

[0088] For P, C, and R type nodes, each entity is a node; for A type, each entity can have multiple nodes.

[0089] 3-2. Determine the relationships between entities, i.e., the edges of the graph, based on the authorization relationships in the access control list. This includes two types:

[0090] (1) The inheritance relationship between user roles, that is, the edges connecting user nodes and role nodes, and connecting roles and role nodes, are used to represent the transfer of permissions;

[0091] (2) Access permission relationships, i.e., the edges connecting role nodes and operation nodes, indicate that a role has the permission to perform specific operations (such as read, write, modify, delete, etc.). These edges clarify the functional permissions of a role for specific resources in the system. Execution permission relationships (i.e., the edges connecting operations and object resources) clarify the permission level of a specific operation on the resource.

[0092] Construct a strategy graph based on the nodes and edges above. Consider an authorization policy that includes positive and negative authorization, where negative authorization represents prohibition. Due to the introduction of negative authorization, when there is an edge connecting a type C node and a type A node, it must be specified whether this corresponds to authorization or prohibition.

[0093] Define a policy graph: a tuple Where V is the set of nodes, E is the set of undirected edges, and lv is the node labeling function: for each node v in the set of nodes V, lv(v).ent∈P∪C∪A∪R, that is, the node represented by node v belongs to one of the four major node types. le is the edge labeling function: for an edge e in the set of edges E connecting nodes v1 and v2, let le(e).adj={v1,v2}, this is the labeling function of edge e, used to record which two nodes v1 and v2 it connects, where v1,v2∈V, and v1≠v2.

[0094] The record label of a node contains a field of type T, where T∈{P,C,A,R}. If lv(v).ent=p∈P, then lv(v).type=P (indicating that the node type is a principal user). Similarly, C and R represent category and resource, respectively.

[0095] The edge type is determined by the types of its adjacent nodes. For example, if le(e).adj = {v1, v2}, then type(e) = (lv(v1).type, lv(v2).type). Taking lv(v1).type = C, lv(v2).type = A as an example, e1 is the edge connecting v1 and v2, and type(e1) = (C, A), indicating that this edge connects a user and a role. The edge type (T1, T2) can be simply represented as T1T2, where CA is the edge type connecting a C-type node and an A-type node. Because the edges are undirected, there is no distinction between types T1T2 and T2T1. To handle policies that include prohibition, consider adding an additional field, authorization, to the label of edges of type CA, with values ​​{α, β}, representing positive and negative authorization (i.e., authorizing and prohibiting operations), respectively. To further refine control, more attributes can be added to access permission edges, such as time limits, location, device type, and conditional expressions, to precisely control permissions in specific contexts. This allows for further segmentation and management of authorization strategies. Edge conditions are labeled with γ; if γ is satisfied, authorization or prohibition is performed according to {α,β}. That is, edge types CA are labeled with {α,β} and γ, and edges of type CA are divided into two corresponding sets CA. α,γ and CA β,γ , to indicate whether the edge is authorized or prohibited under condition γ.

[0096] In the strategy graph G, a path of length n between two nodes v0 and v1 is a sequence v0, v1, ..., vn The nodes are different, meaning the graph is acyclic. For 1 ≤ i ≤ n, for some edges e, {v i-1 ,v i} = le(e).adj.

[0097] When categories have inheritance or inclusion relationships (such as managers and ordinary employees), inheritance from the higher-level category is prohibited, while inheritance from the lower-level category is permitted. Forward and reverse paths between type C nodes are defined as follows: and These represent the paths traversing from higher-level categories to lower-level categories and from lower-level categories to higher-level categories, respectively. Paths between nodes of the same level that are not inclusive are not distinguished by their forward or reverse direction.

[0098] For a well-formed graph with no redundant edges and a prohibition policy The goal is to extract category-based access control (CBAC) policies with authorization or prohibition attributes from a policy graph, thereby extracting permission policies assigned to user categories, rather than individual users. The policy graph contains a countable set of categories. A countable group of subjects Countable set of actions Countable sets of resources The following relationships exist within the strategy:

[0099] 1) Category assignment relationship:

[0100] 2) Relationship between permission categories: If for resources Actions on Satisfy in category If it is executable, then there is

[0101] 3) Disable category relationships: If for resources Actions on Satisfy in category If execution is prohibited above, then there is

[0102] 4) Authorization Relationship: If for the subject Executable in resources Actions on Then there is

[0103] 5) Disable relationships: If for the subject Prohibit execution in resources Actions on Then there is

[0104] 6) Undefined relationship: That is, undefined subject-operation-object resource behavior, for the subject In resources Actions on Undefined authorization status.

[0105] For each strategy graph Extraction Strategy Will Represented as a tuple:

[0106]

[0107] in: These are the subject, category, action, resource, context identifier, and containment relationship in the strategy diagram. Therefore:

[0108]

[0109]

[0110] 3. Authorization Inquiry

[0111] Based on the user's access request, the authorization status of a resource is queried through graph query, and then the permissions are verified.

[0112] The purpose of graph queries is to analyze policies by obtaining policy information while constructing the query, and to calculate the authorization of CBAC policies from the graph representation. Relationships. If there is no containment relationship between categories and no other access condition restrictions, it can be simplified to a single entity: all paths of length 3 from the P-type node to the R-type node can be efficiently used to calculate the authorization. Relationships. The authorization status query when a user requests access to a resource can be answered using graph theory methods: for a given node v representing category C of the user, the type starting from v can be calculated. CA A,C The AR algorithm uses all paths to obtain the relevant set of allowed actions. The last two nodes of each path define one action allowed for that category of service. The complexity is a polynomial of the policy size, or more precisely, a polynomial of the size of the subgraphs traversed in the policy graph.

[0113] When a user requests access to a resource, permissions are verified through graph queries. Graph databases (such as Neo4j) and graph algorithms are used to perform permission queries and path searches. Permission queries are used to query the role and corresponding permissions of user nodes, while path searches are used to search for the path between the user and data entities based on the graph structure to determine permissions.

[0114] Another embodiment of the invention, for example Figure 2 As shown, the specific implementation is as follows:

[0115] 1) Obtain single-user composite behavior logs, including user login / logout behavior, removable device plugging / unplugging behavior, file operation behavior, etc. The logs contain behavior tags and corresponding timestamps.

[0116] 2) Construct a user access control list based on the logs. Use user behavior feature sequences to construct s =<uid,time,action,resources> Where uid is the user ID, time is the time granularity, action is the operation performed, such as read, modify, delete, etc. resources are resource data, i.e., objects.

[0117] 3) Construct access control lists based on HR documents and company policies, extract job identity information corresponding to different user IDs, and formulate policy-based access control lists in conjunction with company regulations, such as time restrictions: prohibiting data access outside of working hours, etc. Information extraction first involves identifying named entities from the text, which can be done using BiLSTM+Attention for entity recognition and relation extraction.

[0118] 4) Since existing logs and company policies may overlook some authorization conditions or contain errors, an audit is required after the system is built. An access control list for constructing the graph is generated based on the two lists mentioned above and then refined to obtain s =<uid,role,condition,action,resources> The condition contains information such as time conditions.

[0119] 5) Constructing the Authorization Policy Graph. Constructing the authorization graph involves defining nodes and relationships, as well as creating and managing the graph database. Nodes include users, roles, actions, and resources. The graph database is used to create nodes and represent authorization relationships, defining attributes and vectors on permission edges. For example, an attribute can be added to represent the type of authorization (allow or deny), as well as other conditions (such as time range, IP address, etc.). Using the Neo4j graph database as an example:

[0120]

[0121] 6) Query and management permissions. When a user requests access to a data entity, the system parses the user's requested operation and the target data entity.

[0122] User request parsing: Identify the requesting user, identify the operation request, and identify the target object.

[0123] Permission verification: Verify whether a user has the permission for the requested operation using graph queries, and check the access permissions of the specific data fields represented by the vectors. Example: Use the Cypher query language to check whether a user has permission to read a document.

[0124]

[0125] Access control: Allow or deny user access requests based on permission verification results.

[0126] In practical applications, Cypher's additional features can be used to optimize query performance, such as indexing and query planning optimization. It can also be combined with Neo4j's transaction management and data consistency guarantees to manage and manipulate data. Using these methods, complex permission queries can be performed with the Neo4j graph database to check whether a user has access rights to a specific document or resource.

[0127] Although the present invention has been disclosed above with reference to embodiments, it is not intended to limit the present invention. Appropriate modifications or equivalent substitutions made by those skilled in the art to the technical solutions of the present invention should be covered within the protection scope of the present invention, which is defined by the claims.

Claims

1. A method for fine-grained authorization of large-scale data based on graph structures, characterized in that, Includes the following steps: 1) Obtain user, role, resource type and authorization-related database tables, and integrate them into a single-user composite behavior log, which includes behavior tags and time information; 2) Construct user access control lists using single-user composite behavior logs to predict user permission requirements and access patterns; 3) Construct a policy access control list based on company policies and personnel documents; 4) Integrate user access control lists and policy access control lists to obtain access control lists; 5) Construct a strategy graph based on the entity information and the relationships between entities in the access control list; 6) Based on the user's resource access request, perform a policy graph query to obtain the user's authorization status for the resource.

2. The method as described in claim 1, characterized in that, In step 1), the relevant database tables for authorization include user login / logout logs, file operation logs, removable device plug-in / plug-out logs, and upload / download behavior logs; The steps involved in integrating and forming a single-user composite behavior log include: The data content in the original log is classified or enumerated by category, and the user ID and time information of each log entry are retained. Repeated behaviors of the same user on the same data are simplified into a set of behavior tags. Based on the user ID, different types of behavior logs from the same user are aggregated and rearranged in chronological order to form a single-user composite behavior log.

3. The method as described in claim 1, characterized in that, Step 2) involves constructing a user access control list, including: Convert the time information in the single-user composite behavior log into location information, so that the behavior tag set includes the time dimension, and obtain the user behavior feature sequence. Build a user adaptive mechanism to dynamically adjust and optimize user authorization policies to match actual user behavior; The user behavior feature sequence is processed according to the user adaptation mechanism to generate a user access control list.

4. The method as described in claim 3, characterized in that, Step 2) involves obtaining the user behavior feature sequence, including: Divide a continuous period of time into multiple time periods with a preset granularity, and set an index and a starting position offset for each time period; Classify or enumerate the attributes in the set of behavior tags, and then concatenate them to generate a set of behaviors. Based on the behavioral tags, the types of behavior within each time period are counted to obtain a sequence of user behavior characteristics.

5. The method as described in claim 3, characterized in that, Step 2) The adaptive mechanism includes two sub-mechanisms: Behavioral pattern analysis mechanism: Analyzes user behavior sequences over a period of time to identify user operating habits and access patterns; Authorization strategy optimization mechanism: Use machine learning algorithms to analyze user behavior data, extract potential behavior patterns, and optimize existing authorization strategies.

6. The method as described in claim 1, characterized in that, Step 3) involves constructing a policy access control list, which includes: performing text segmentation and part-of-speech tagging on company policies and HR department documents to obtain preprocessed text; Extract keywords from preprocessed text and identify entity information; Extract the relationships between roles and permissions, and between personnel and roles, from the identified entities; Based on the labeled dataset in the user access control list, a natural language processing model is trained to extract the permission rules in the policy; Based on the obtained entity information, relationships, and permission rules, a policy access control list is generated.

7. The method as described in claim 1, characterized in that, Step 5) involves constructing the strategy graph, which includes: Based on the entities in the access control list, four types of nodes are identified: users, roles, operations, and resources; Based on the relationships between entities in the access control list, construct two types of edges between nodes: role inheritance relationships and access permission relationships; Introduce positive and negative authorization. Positive authorization means that an operation is allowed, while negative authorization means that the operation is prohibited. Mark the corresponding positive or negative authorization on the edge connecting the role node and the operation node. Define the strategy graph structure and add authorization conditions and attribute information: If there is an inheritance or inclusion relationship between role categories, the prohibition policy is inherited from the higher-level category and the authorization policy is inherited from the lower-level category to obtain the forward and reverse paths between role nodes; Redundant edges are removed to obtain a policy graph with category-based access control policies that grant or deny permissions. The category-based access control policies include the following relationship categories: category assignment relationship, permission category relationship, disable category relationship, grant relationship, disable relationship, and undefined relationship.

8. The method as described in claim 1, characterized in that, Step 6) includes the following steps for performing a strategy graph query: Based on the user's request, determine the node in the strategy graph corresponding to the user as the query starting point; The graph query algorithm starts from the role node and traverses the path along the edges of the strategy graph to find the path from the role node to the operation node and the path from the operation node to the resource node. Check the edge types on the traversal path to confirm whether the edges connecting the role node and the operation node are marked as positive or negative authorization; if the path contains positive authorization, the user is authorized to execute the current operation; if it contains negative authorization, the current operation is prohibited; if the path contains specific conditions, verify whether the user request meets these conditions. If user roles have an inheritance relationship, continue the query along the forward or reverse path; After the query is completed, the corresponding query results are returned based on the authorization or prohibition information on the path, including authorization approved, authorization denied, or authorization not defined.

9. The method as described in claim 1, characterized in that, Step 6) When performing a strategy graph query, use a graph database and graph algorithms to perform permission queries and path searches.

10. A large-scale data fine-grained authorization device based on graph structure, used to implement the method according to any one of claims 1-9, characterized in that, include: The data preprocessing module is used to obtain user, role, resource type and authorization-related database tables, and integrate them into a single-user composite behavior log, which includes behavior tags and time information; The adaptive access control list building module is used to build user access control lists from single-user composite behavior logs, predict user permission requirements and access patterns; build policy access control lists based on company policies and personnel documents; and integrate user access control lists and policy access control lists to obtain the access control list. The graph-based fine-grained access control module is used to construct a policy graph based on entity information and relationships between entities in the access control list; and to query the policy graph based on the user's resource access request to obtain the user's authorization status for the resource.

Images