Generative data analysis security permission protection method

Abstract

The invention relates to a generative data analysis security permission protection method, which comprises the following steps of: acquiring a problem of a user, and converting the problem into a first structured query statement; and performing permission judgment based on the user role and the rule in the data authorization table to ensure that the user has the right to access related data. If the user permission verification is passed, determining a filtering rule according to at least part of elements in the data access element set, and transforming the first structured query statement; and inputting the transformed second structured query statement into a pre-trained large language model, and outputting an answer in a natural language form. Unauthorized data access is prevented by judging the operation authority; structured query statements are transformed through filtering rule result word strings, limited access of sensitive fields can be prohibited, and sensitive data are protected; the query result is converted into natural language description by using a pre-trained large language model, so that non-technical users can also understand complex data analysis results.

Description

Technical Field

[0001] This application relates to the field of data analysis, and in particular to a method for protecting security permissions in generative data analysis. Background Technology

[0002] Generative data analytics is an analytical method that uses machine learning and artificial intelligence techniques to generate new data or content from existing data. With technological advancements, data security and privacy protection have become increasingly important. In the field of data analytics, with the development of big data and artificial intelligence technologies, research based on large models is deepening. Particularly in the field of natural language processing, the demand for using large models to generate SQL statements from natural language to perform data analysis is growing. This method allows users to execute database queries using natural language descriptions, improving the convenience and efficiency of data analysis.

[0003] However, existing technologies have significant shortcomings, such as the inability to effectively control data access permissions, difficulty in preventing unauthorized data access, inadequate protection of sensitive data, and difficulty in integrating with low-code / no-code platforms, which limits data security. Summary of the Invention

[0004] Therefore, it is necessary to provide a method for protecting the security permissions of generative data analysis in response to the above-mentioned technical problems.

[0005] This application provides a method for security access protection in generative data analysis. The method includes: Obtain user questions; where user questions are described using natural language; The transformation algorithm transforms user questions described in natural language into a first structured query statement, and determines a set of data access elements based on the first structured query statement. The set of data access elements includes multiple elements. Determine operation permissions based on at least some of the elements in the data access element set; If the operation permission determination is satisfied, then based on at least some of the elements in the data access element set, the first filtering rule result string and the second filtering rule result string are determined, and the first structured query statement is modified based on the first filtering result string and the second filtering result string to obtain the updated second structured query statement. The second structured query is input into a pre-trained large language model to obtain the answer described in natural language.

[0006] In one embodiment, determining a first filtering rule result string and a second filtering rule result string based on at least a portion of the elements in the data access element set includes: Obtain pre-configured data range limitation rules, search for data range limitation rules based on at least some elements in the data access element set, and obtain the first filtering rule and the second filtering rule; The first filtering rule result string is determined according to the first filtering rule, and the second filtering rule result string is determined according to the second filtering rule.

[0007] In one embodiment, a pre-configured data range limitation rule is obtained, and the data range limitation rule is queried based on at least a portion of the elements in the data access element set to obtain a first filtering rule and a second filtering rule, including: Retrieve the pre-configured data row range limit table and data column range limit table; Based on at least some of the elements in the data access element set, query the data row range limitation table to obtain the first filtering rule; The second filtering rule is obtained by querying the data column range limitation table based on at least some of the elements in the data access element set.

[0008] In one embodiment, determining the first filtering rule result string according to a first filtering rule and determining the second filtering rule result string according to a second filtering rule includes: Parse the first filtering rule, replace the corresponding variables in the first filtering rule with the data corresponding to the row elements in the data access element set, and obtain the result string of the first filtering rule; Parse the second filtering rule, replace the corresponding variables in the second filtering rule with the data corresponding to the column elements in the data access element set, and obtain the result string of the second filtering rule.

[0009] In one embodiment, the first structured query statement is modified based on the first filtered result string and the second filtered result string to obtain an updated second structured query statement, including: The result string of the first filtering rule is appended to the WHERE clause of the first structured query statement, and the result string of the second filtering rule is applied to the SELECT clause of the first structured query statement to replace the relevant columns in the SELECT clause, resulting in the updated second structured query statement.

[0010] In one embodiment, performing an operation permission determination based on at least a portion of the elements in the data access element set includes: performing a first operation permission determination and a second operation permission determination based on at least a portion of the elements in the data access element set; wherein, the first operation permission determination is based at least on the user's role, and the second operation permission determination is based at least on the association rules in the data authorization table. Perform a first operation permission determination based on at least some of the elements in the data access element set, including: Obtain the related chain; Determine the user role corresponding to the user identifier from the association chain, obtain the user operation permissions corresponding to the user role from the association chain, and determine the data access elements matching the user identifier based on the user operation permissions; Determine whether the first operation permission judgment is satisfied based on the matched data access elements and at least some of the elements in the data access element set.

[0011] In one embodiment, performing a second operation permission determination based on at least a portion of the elements in the data access element set includes: Obtain the data authorization table, and match the data authorization table with the table elements and access behavior elements in the data access element set to obtain the association rules; The determination of whether the second operation permission is met is made by parsing the association rules.

[0012] In one embodiment, determining whether the second operation permission is satisfied by parsing association rules includes: The association rules are parsed to obtain the first parameter, the second parameter, and the function. The first parameter is defined to represent the data corresponding to the request object, and the second parameter is defined to represent the data corresponding to the user session object. The data corresponding to the user session object can be customized, and the data corresponding to the request object is determined based on the row elements in the data access element set. The function determines whether the first parameter matches the second parameter; if so, the second operation weight condition is satisfied.

[0013] In one embodiment, the method further includes: If the subquery included in the first structured query statement is greater than the query threshold and / or the length of the first structured query statement is greater than the length threshold, multiple sets of data access elements are determined based on the first structured query statement; wherein, for the same set of data access elements, a first operation permission determination and a second operation permission determination are performed based on at least some of the elements in the set of data access elements, a first filtering rule result string and a second filtering rule result string are determined based on at least some of the elements in the set of data access elements, and the first structured query statement is modified based on the first filtering rule result string and the second filtering rule result string.

[0014] In one embodiment, a transformation algorithm is used to convert a user question described in natural language into a first structured query statement, and a set of data access elements is determined based on the first structured query statement, including: Based on pre-trained large language models and / or parsing algorithms, user questions described in natural language are transformed into first structured query statements; Parse the first structured query statement into an abstract syntax tree; By reading the abstract syntax tree, the set of data access elements is determined.

[0015] The aforementioned generative data analysis security permission protection method obtains the user's question, transforms it into a first structured query statement, and determines a set of data access elements based on the first structured query statement. Further, it determines whether operation permissions are satisfied based on at least some elements in the data access element set, and if satisfied, determines a first filtering rule result string and a second filtering rule result string based on at least some elements in the data access element set. The first structured query statement is then modified using the first and second filtering rule result strings, and an answer is generated based on the modified first structured query statement. This method effectively controls data access permissions by determining operation permissions, preventing unauthorized data access; it also prohibits restricted access to sensitive fields and protects sensitive data by modifying the structured query statement using filtering rule result strings; and it uses a pre-trained large language model to convert the query results into natural language descriptions, enabling non-technical users to understand complex data analysis results. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating a method for protecting security permissions in generative data analytics in one embodiment. Figure 2 This is a flowchart illustrating the process of determining the first filtering rule string and the second filtering rule string in one embodiment. Figure 3 This is a flowchart illustrating the process of determining the first and second filtering rules in one embodiment. Figure 4 This is a flowchart illustrating the process of determining the result strings of the first and second filtering rules in another embodiment; Figure 5 This is a flowchart illustrating the process of determining whether the first operation permission is satisfied in one embodiment; Figure 6 This is a flowchart illustrating the process of determining whether the second operation permission is satisfied in one embodiment; Figure 7 This is a flowchart illustrating the process of determining whether a second operation permission is satisfied by parsing association rules in one embodiment. Figure 8 This is a flowchart illustrating the process of determining a set of data access elements in one embodiment; Figure 9 This is a flowchart illustrating a method for protecting security permissions in generative data analytics, as described in another embodiment. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application. Unless otherwise defined, the technical or scientific terms used in this application should have the general meaning understood by one of ordinary skill in the art to which this application pertains. Words such as "a," "an," "an," "the," and "these" used in this application do not indicate quantitative limitations; they can be singular or plural. Terms such as "first," "second," and "third" used in this application are merely for distinguishing similar objects and do not represent a specific ordering of the objects.

[0018] In one embodiment, such as Figure 1 As shown, a method for protecting security permissions in generative data analysis is provided, including the following steps: Step 101: Obtain user questions; whereby user questions are described using natural language; Specifically, it involves acquiring user questions, where users ask questions in natural language, such as: "What were the sales figures for each department in the first quarter of 2023?" Step 102: Based on the transformation algorithm, the user question described in natural language is transformed into a first structured query statement. The data access element set is determined according to the first structured query statement. The data access element set includes multiple elements. Specifically, a transformation algorithm refers to a series of computational steps or methods used to convert a user's natural language question into a structured query statement that a computer can understand and execute. Users ask questions in natural language, such as inquiries about sales data or employee information; these questions are typically expressed in everyday language, rather than technical or database query language. The output of the transformation algorithm is the first structured query statement used to retrieve data from the database. Once the natural language question has been transformed into a structured query statement, this query statement is analyzed to determine the set of data access elements. The set of data access elements can include: table elements, row elements, column elements, and access behavior elements.

[0019] As exemplified in step 101, a user poses a question in natural language, such as, "What was the sales revenue of each department in the first quarter of 2023?" Here, NLP technology can be used to parse the user's natural language question, identifying key information including the time frame (first quarter of 2023), business metrics (sales revenue), and data granularity (each department). The user's query intent (sales revenue) is identified and slots (time frame and department) are filled, preparing for the generation of the first structured query statement. NLP technology can identify keywords and entities in the user's question, such as names, locations, organizations, and time expressions. These entities are crucial for constructing accurate query statements. Based on a transformation algorithm, the user's question is segmented, and each word is labeled with its corresponding part of speech (noun, verb, adjective, etc.). The time entity (first quarter of 2023), department entity (each department), and business metric entity (sales revenue) are identified. The grammatical structure of the sentence is analyzed to determine the dependencies between each entity and the predicate (query action). The semantic role of each entity in the query is determined; for example, the time frame serves as a constraint, the department as a grouping criterion, and the sales revenue as the aggregation target.

[0020] Generate a first structured query statement (SQL) based on the identified intent and the filled slots. For example: select department, sum(sales) from sales_data where quarter = '2023q1' group by department; Here, `sales_data` is the assumed database table name, `department` and `sales` are fields in the table, and `quarter` is the field representing the quarter. Based on the first structured query, the set of data access elements is determined. In this example, the set of data access elements includes: Table element: The "sales revenue per department" in the user's question corresponds to the sales_data table in the database.

[0021] Row elements: "Department" corresponds to the "department" field, representing the name or identifier of the department; "Sales" corresponds to the "sales" field, representing the sales amount.

[0022] The column element "Q1 2023" corresponds to quarter = '2023Q1' in the WHERE clause, used to filter data rows for the first quarter of 2023.

[0023] Access behavior element: "How much" indicates that the query intent is an aggregation operation, that is, to calculate the total sales of each department.

[0024] Step 103: Perform operation permission determination based on at least some of the elements in the data access element set; Specifically, operation permission determination refers to the process of verifying whether a user has the right to perform a specific operation (such as reading, writing, updating, or deleting). Permission determination is performed using at least some elements from a set of data access elements, which may include table elements and behavioral access elements. It checks whether the user's role allows access to the requested data, or whether the user's attributes conform to the rules defined in the data authorization table. If the operation permission determination is successful, the data access operation is allowed to continue; if the operation permission determination fails, the access request is denied.

[0025] Step 104: If the operation permission determination is satisfied, then based on at least some of the elements in the data access element set, determine the first filter rule result string and the second filter rule result string, and modify the first structured query statement based on the first filter result string and the second filter result string to obtain the updated second structured query statement. Specifically, if the operation permission determination is met, a first filtering rule string and a second filtering rule string can be determined based on the row and column elements in the data access element set. The first filtering rule result string (which can be a row filtering rule result string) can be determined based on the row elements (such as user department, role, etc.) in the data access element set. The row filtering rule is then converted into part of an SQL statement, typically a condition in the WHERE clause. The second filtering rule result string (which can be a column filtering rule result string) can be determined based on the column elements (such as sensitive fields) in the data access element set. The column filtering rule is then used to modify the SELECT clause to control which columns can be accessed or to perform anonymization on certain columns. The first filtering rule result string is appended to the WHERE clause of the first structured query statement to restrict the query results to only include data rows that the user is authorized to access. The result string of the second filtering rule is applied to the select clause of the first structured query statement to replace or modify relevant columns, ensuring that only authorized data columns are retrieved and that sensitive data is appropriately processed. Based on the result strings of the first and second filtering rules, the first structured query statement is modified to obtain a new structured query statement, namely the second structured query statement.

[0026] Step 105: Input the second structured query statement into the pre-trained large language model to obtain the answer described in natural language.

[0027] Specifically, the second structured query statement is input into a pre-trained large language model, which is pre-trained to convert the second structured query statement into a natural language description of the answer.

[0028] The aforementioned method for protecting security permissions in generative data analysis involves obtaining the user's question and transforming it into a first structured query statement. Permissions are then determined based on user roles and rules in the data authorization table to ensure the user has the right to access relevant data. If the user's permissions are verified, filtering rules are determined based on at least some elements in the data access element set, modifying the first structured query statement. The modified second structured query statement is then input into a pre-trained large language model, which outputs the answer in natural language. This method effectively controls data access permissions and prevents unauthorized data access by combining role-based permission determination with rules in the data authorization table. Modifying the structured query statement using the filtering rule result string can prohibit restricted access to sensitive fields, protecting sensitive data. The pre-trained large language model converts the query results into natural language descriptions, enabling non-technical users to understand complex data analysis results.

[0029] In one embodiment, such as Figure 2 As shown, determining the first filter rule result string and the second filter rule result string based on at least some elements in the data access element set includes the following steps: Step 201: Obtain the pre-configured data range limitation rules, and search for the data range limitation rules based on at least some of the elements in the data access element set to obtain the first filtering rule and the second filtering rule; Specifically, the scope is limited through pre-configured data scope limitation rules. These rules are a set of predefined rules used to control access permissions for different users or user groups to data. These rules can be set based on user roles, departments, or other attributes. The data access element set refers to the key information extracted from user questions, which defines the scope and nature of the data query. Based on the table elements and access behavior elements in the data access element set, the pre-configured data scope limitation rules can be queried to obtain the first and second filtering rules. The first filtering rule typically refers to a row filtering rule, which determines which data rows are accessible to the user based on the data access element set. For example, it might restrict users to accessing only data from their own department. The second filtering rule typically refers to a column filtering rule, which determines which data columns are accessible to the user based on the data access element set. For example, it might specify that certain sensitive fields are not visible to a specific user or a specific question from a user.

[0030] Step 202: Determine the result string of the first filtering rule according to the first filtering rule, and determine the result string of the second filtering rule according to the second filtering rule.

[0031] Specifically, the purpose of the first filtering rule (which can be a row filtering rule) is to restrict the data rows that a user can access. This can be determined based on the user's role, department, or other attributes. Based on the first filtering rule, a first filtering rule result string is generated, which will be used to restrict the query results to only include data rows that the user is authorized to access.

[0032] The purpose of the second filtering rule (which can be a column filtering rule) is to restrict the data columns that users can access. This may involve hiding sensitive information or anonymizing certain data. Based on the second filtering rule, a second filtering rule string is generated. This string will be used to restrict the query results to only display the data columns that the user is authorized to view, or to anonymize sensitive data.

[0033] In this embodiment, pre-configured data range limitation rules are obtained, and corresponding first and second filtering rules are found based on table elements and access behavior elements in these element sets. The first and second filtering rule result strings are then determined according to the first and second filtering rules. This method effectively enhances data access security, controls access permissions for data rows and columns, and prevents unauthorized access and data leakage.

[0034] In one embodiment, such as Figure 3 As shown, the process of obtaining pre-configured data range limitation rules, querying the data range limitation rules based on at least a portion of the elements in the data access element set, and obtaining the first filtering rule and the second filtering rule includes the following steps: Step 301: Obtain the pre-configured data row range limitation table and data column range limitation table; Specifically, pre-configured data scope restriction rules can be set in data row scope restriction tables and data column scope restriction tables. Data row scope restriction tables define which users or user groups can access specific data rows in the database. These rules are based on user identity, role, department, or other attributes to ensure that users can only access data corresponding to their permission level. Data column scope restriction tables define which users or user groups can access specific data columns in the database. This may include access restrictions on sensitive information; for example, some users may not be able to access columns containing personally identifiable information, or the data in certain columns may require anonymization.

[0035] Step 302: Based on at least some of the elements in the data access element set, query the data row range limitation table to obtain the first filtering rule; Specifically, the first filtering rule can be obtained by querying the data row range limitation table based on the table elements and access behavior elements in the data access element set. The first filtering rule, also known as the row filtering rule, is derived from the data row range limitation table based on the query results. These rules define the restrictions on the data rows that a user can access. For example, if the data row range limitation table specifies that users in a particular department can only access data from their department, then the first filtering rule will include a condition that restricts the query results to returning only data rows from that user's department.

[0036] Step 303: Based on at least some of the elements in the data access element set, query the data column range limitation table to obtain the second filtering rule.

[0037] Specifically, the second filtering rule can be obtained by querying the data column range limitation table based on the table elements and access behavior elements in the data access element set. The second filtering rule, also known as the column filtering rule, is derived from the data column range limitation table based on the query results. These rules define the restrictions on the data columns that users can access, including which columns are visible, which columns need to be anonymized, and which columns are completely hidden. For example, if the data column range limitation table specifies that users with certain roles cannot access columns containing sensitive information, then the second filtering rule will include a condition to ensure that these columns are not included in the query results or are replaced with anonymized values.

[0038] In this embodiment, pre-configured data range limitation rules are obtained, and these rules are queried based on table elements and access behavior elements in the data access element set to determine the first and second filtering rules. Specifically, the method obtains a pre-configured data row range limitation table and a data column range limitation table, and then queries these two tables respectively to obtain the filtering rules for rows and columns. This method can precisely control data access, ensuring that only authorized users can access specific data rows and columns, thereby enhancing data security and preventing unauthorized data access and leakage of sensitive information.

[0039] In one embodiment, determining the result string of the first filtering rule according to the first filtering rule and determining the result string of the second filtering rule according to the second filtering rule includes the following steps: Step 401: Parse the first filtering rule, replace the corresponding variable in the first filtering rule with the data corresponding to the row element in the data access element set, and obtain the result string of the first filtering rule; Specifically, the first filtering rule defines the conditions that can restrict user access to data rows. This rule may contain variables or placeholders, which need to be replaced with actual data values. Row elements refer to information directly related to data row access permissions, such as the user's department ID or user role. The variables in the first filtering rule are replaced with the data corresponding to the row elements in the data access element set. After the replacement, the specific variables in the first filtering rule are replaced with the data corresponding to the actual row elements, resulting in the first filtering rule result string.

[0040] Step 402: Parse the second filtering rule, replace the corresponding variables in the second filtering rule with the data corresponding to the column elements in the data access element set, and obtain the result string of the second filtering rule.

[0041] Specifically, the second filtering rule refers to those rules that define the range of data columns a user can access. These rules may exist as some form of expression or template, containing variables or placeholders, which need to be replaced with actual data. In the second filtering rule, variables represent data that needs to be dynamically determined, such as user roles, data sensitivity levels, or other security-related attributes. Column elements refer to those elements that can determine the access permissions of data columns, such as user roles, data categories, etc. These variables are replaced with the actual data corresponding to the column elements in the data access element set. After the replacement, the specific variables in the second filtering rule are replaced by the actual data corresponding to the column elements, forming the result string of the second filtering rule.

[0042] In this embodiment, the first and second filtering rule result strings are determined by parsing the first and second filtering rules and replacing the variables in these rules with specific data from the data access element set. Specifically, for the first filtering rule, the system replaces its variables with the data corresponding to the row elements to generate the first filtering rule result string; for the second filtering rule, the system replaces its variables with the data corresponding to the column elements to generate the second filtering rule result string. This method ensures that data access is strictly controlled within the authorized scope, enhances data security, prevents unauthorized access, protects sensitive data, ensures data privacy, and maintains data integrity.

[0043] In one embodiment, the first structured query statement is modified based on the first filtered result string and the second filtered result string to obtain the updated second structured query statement, including: The result string of the first filtering rule is appended to the WHERE clause of the first structured query statement, and the result string of the second filtering rule is applied to the SELECT clause of the first structured query statement to replace the relevant columns in the SELECT clause, resulting in the updated second structured query statement.

[0044] Specifically, suppose the first structured query is: `select * from employees where department_id = 5;` The first filter rule result string restricts access to data rows based on the user's role or attribute (such as department ID). For example, if a user can only access data within their department, the first filter rule result string might be: anddepartment_id = :user_department_id Where `user_department_id` is a parameter whose value will be replaced with the current user's department ID during query execution. The result string of the first filtering rule is appended to the WHERE clause of the first structured query to ensure that only rows meeting specific conditions are retrieved. The modified WHERE clause might look like this: `WHERE department_id = 5 AND department_id = :user_department_id`.

[0045] The second filter rule result string restricts access to data columns based on data sensitivity or user permissions. For example, if a user's permissions do not allow viewing data with salaries exceeding a certain amount, the second filter rule result string might be: `case when salary>100000 then 'confidential' else salary end as salary`.

[0046] This expression replaces data with salaries exceeding 100,000 with 'confidential'. The result string from the second filtering rule is then applied to the select clause of the first structured query to replace or modify relevant columns. The modified select clause might look like this: `select name, case when salary>100000 then 'confidential'else salary end as salary from employees`.

[0047] Combining the modified WHERE and SELECT clauses, we obtain the updated second structured query statement: `SELECT name, CASE WHEN salary>100000 THEN 'confidential' ELSE salary ENDAS salary FROM employees WHERE department_id = 5 AND department_id = :user_department_id;` In this embodiment, the method appends the result string of the first filtering rule to the WHERE clause of the first structured query statement; it then applies the result string of the second filtering rule to the SELECT clause, replacing or modifying relevant columns to obtain an updated second structured query statement. This method enhances the security of the query statement, ensuring that only authorized data can be retrieved, thus preventing data leakage and unauthorized access.

[0048] In one embodiment, the following data access permission rules (data row range restriction table, data column range restriction table) are pre-configured:

[0049]

[0050] The user requested to execute the SQL query: "select id, name, org, addr from archive".

[0051] There are data row range scope tables (data_row_scope) and data column range scope tables (data_col_scope), which contain pre-configured row and column filtering rules.

[0052] The data access element set includes: table element `archive`, column elements `id`, `name`, `org`, `addr`, and access behavior element `select`. Based on the elements in the data access element set, appropriate row and column filtering rules are matched from the data range-limited table.

[0053] The row filtering rule is parsed as org = $session.org, where $session.org represents the organization code stored in the user session. Assuming the current user's organization code is 0305, the row filtering condition would be org = '0305'.

[0054] The function `col_filter($session.user, $res)` parses the column filtering rules, where `$session.user` represents the user identifier and `$res` represents the data resources (i.e., the `archive` table and the `select` access behavior). Assume the `col_filter` function identifies the `addr` field as a sensitive field and filters it based on the user's permission configuration.

[0055] Modify the first structured query statement by applying row and column filtering rules. Add the row filtering condition org = '0305' to the WHERE clause. Apply the column filtering condition to the SELECT clause, removing the sensitive field addr.

[0056] The final generated second structured query statement is: "select id, name, org from archivewhere org = '0305'".

[0057] In one embodiment, such as Figure 5 As shown, performing operation permission determination based on at least some elements in the data access element set includes: performing a first operation permission determination and a second operation permission determination based on at least some elements in the data access element set; wherein, the first operation permission determination is based at least on the user's role, and the second operation permission determination is based at least on the association rules in the data authorization table.

[0058] Specifically, the first operation permission determination involves checking the user role requesting data access and determining whether that role has the permission to perform a specific operation. This typically involves table elements and access behavior elements in the data access element set to verify whether the user's role is authorized to access specific data or perform a specific operation. The second operation permission determination involves querying a data authorization table based on the table elements and access behavior elements in the data access element set. The association rules in the data authorization table are then used to further refine the permission determination. The data authorization table contains specific data access rules, with the association rules in the second operation permission determination being more flexible and customizable to different business needs. These rules typically include expressions composed of functions, operators, variable parameters, and constants. Functions can be built-in functions or custom extended functions, and variable parameters can reference content from the request or user session. These rules define which users or roles can access a specific dataset. The system matches the information in the data access element set with the rules in the data authorization table to determine if there are any rules allowing the current user to access the requested data. For the first operation permission determination, it checks whether the user's role matches any rules that allow access. If the user's role is authorized, the request is approved. For the second permission check, the association rules in the data authorization table are parsed. These rules may contain conditional expressions, which the system evaluates to determine authorization. If both the first and second permission checks are passed, data access is allowed; if either check fails, the access request is denied. By combining role-based permission checks with rules in the data authorization table, data access permissions are effectively controlled, preventing unauthorized data access.

[0059] Furthermore, performing a first operation permission determination based on at least a portion of the elements in the data access element set includes the following steps: Step 501: Obtain the related chains; Specifically, configure user role association tables, role permission association tables, and data access operation permission association tables to form an association chain: user -> role -> operation permission -> data access element.

[0060] Step 502: Determine the user role corresponding to the user identifier from the association chain, obtain the user operation permissions corresponding to the user role from the association chain, and determine the data access elements matching the user identifier based on the user operation permissions; Specifically, a relational chain refers to a series of logically connected elements that collectively define the relationship between a user and the data they are authorized to access. First, the relational chain determines the user role corresponding to the user identifier, which can be the user's login name, employee ID, or other unique identifier. After determining the user's role, the corresponding user operation permissions are retrieved from the relational chain. These permissions define which operations the user can perform on the data, such as reading, writing, updating, or deleting. Based on these user operation permissions, data access elements matching the user identifier are determined. These data access elements refer to the specific data involved in the user's request, such as a specific database table, field, or data row. Finally, the data access elements requested by the user are matched against the user's role permissions to verify whether the user has the right to access the requested data.

[0061] Step 503: Determine whether the first operation permission judgment is satisfied based on the matched data access elements and at least some of the elements in the data access element set.

[0062] Specifically, in the steps described above, the data access elements requested by the user have been matched with predefined user role permissions to identify specific data and operations related to the user's request. The first operation permission determination is based on the user's role or identity to determine whether they have the right to perform specific data operations. It checks whether the matched data access elements conform to the user's role permissions. Based on the user's role permissions and the table elements, row elements, column elements, and access behavior elements in the data access element set, it can be determined whether the user has the right to perform the requested operation.

[0063] In this embodiment, a relational chain is obtained, which associates users, user roles, and user operation permissions. The user role corresponding to the user identifier is determined from the relational chain, and the user operation permissions corresponding to that user role are obtained. Based on the user operation permissions, data access elements matching the user identifier are determined. By comparing the matching data access elements with table elements, row elements, column elements, and access behavior elements in the data access element set, it is determined whether the first operation permission judgment is satisfied. This method ensures that only authorized users can access specific data resources, thereby effectively preventing unauthorized access and data leakage, enhancing data security, and improving the organization's management and control capabilities over data access.

[0064] In one embodiment, such as Figure 6 As shown, performing a second operation permission determination based on at least a portion of the elements in the data access element set includes the following steps: Step 601: Obtain the data authorization table, and match the data authorization table with the table elements and access behavior elements in the data access element set to obtain the association rules; Specifically, a data authorization table is obtained, which may include table elements and access behavior elements. The table elements and access behavior elements in the data access element set are then matched against rules in the data authorization table. This matching process aims to identify rules that match the data access permissions, i.e., association rules. Association rules are used for permission determination.

[0065] Step 602: Determine whether the second operation permission is satisfied by parsing the association rules.

[0066] Specifically, parsing association rules often involves analyzing the rule's structure and logic to understand the conditions and restrictions it imposes. Based on the specific conditions in the association rule, it's determined whether a user has the permission to perform a specific operation. If the user's identity and request match the attributes and conditions defined in the rule, then the user passes the second operation permission check. If the user meets the second operation permission check, then the user is allowed to perform the requested data operation.

[0067] In this embodiment, a data authorization table is obtained. Table elements and access behavior elements from the data access element set are matched against the data authorization table to obtain corresponding association rules. The association rules are parsed to determine whether the second operation permission is satisfied. This method enhances control over data access, ensuring that only users who meet specific rules can perform corresponding data operations, thereby improving data security.

[0068] In one embodiment, such as Figure 7 As shown, determining whether the second operation permission is satisfied by parsing the association rules includes the following steps: Step 701: Parse the association rules to obtain the first parameter, the second parameter, and the function; where the first parameter is defined as the data corresponding to the request object, the second parameter is defined as the data corresponding to the user session object, the data corresponding to the user session object can be customized, and the data corresponding to the request object is determined based on the row elements in the data access element set; Specifically, the association rules are parsed to extract the first and second parameters, along with a function. The first parameter represents the data corresponding to the request object, i.e., the attributes of the data the user requests to access. The data corresponding to the request object is determined based on the row elements in the data access element set. The second parameter represents the data corresponding to the user session object, i.e., the user's attributes, which can be user-defined. The function is a logical expression or code block used to evaluate the relationship between the first and second parameters. The function defines how to compare these two parameters and determine whether the access control conditions are met.

[0069] Step 702: Determine whether the first parameter matches the second parameter through a function. If so, the second operation weight condition is satisfied.

[0070] Specifically, the function in the association rule is executed to determine whether the first parameter (the data of the request object) matches the second parameter (the data of the user session object). If the function evaluates to true, meaning the user meets the conditions defined by the association rule, then the user passes the second operation permission determination.

[0071] In this embodiment, the determination of whether the second operation permission is satisfied is achieved by parsing association rules. This includes parsing the association rules to extract a first parameter, a second parameter, and a function. The first parameter represents the data corresponding to the requested object, which is determined based on row elements in the data access element set. The second parameter represents the data corresponding to the user session object, which can be user-defined. The method uses a function to verify whether the first parameter matches the second parameter. If they match, the user is determined to have satisfied the second operation permission. This method provides a flexible permission verification mechanism, allowing the system to dynamically evaluate permissions based on the specific data of the user session and the requested object, thereby enhancing data security. In this way, only users who meet specific conditions can access or operate data, effectively preventing unauthorized access and data leakage, and ensuring the protection of sensitive information.

[0072] In one embodiment, the following association rules are pre-configured in the data authorization table:

[0073] The user's question is retrieved: "How many files does the xxx business hall have?"; Based on the transformation algorithm, the user's question is transformed into the first structured query statement: "select count(*) from archive where org='030502'", where the organization code of the xxx business hall is 030502; The data access element set is determined based on the first structured query statement. This data access element set includes: table element archive, access behavior element select, row element org='030502', and column element *. Matching the `data_grant` table entry, the associated rule is found. In this example, the rule expression is `org_include($session.org, $req.org)`. This rule applies to a specific business scenario where users are only allowed to query files under their own organization. The parsed row filtering rule is `org_include($session.org, $req.org)`, where `$req` is the request object, `$session` is the user session object, `$req.org` refers to the `org` field of the request object, `$session.org` refers to the `org` field of the session object, and `org_include` is a function (a low-code function code extension; its specific code meaning is prefix inclusion). `allow = org_include($session.org, $req.org)`. Where `$req.org` is 030502. If `$session.org` is 0305 or 030502, then `allow = true`; if `$session.org` is 0306 or 030501, then `allow = false`. The allow value, calculated based on the rules, determines whether the second operation permission is allowed.

[0074] In one embodiment, the method further includes: if the subquery included in the first structured query statement is greater than a query threshold and / or the length of the first structured query statement is greater than a length threshold, determining multiple data access element sets based on the first structured query statement; wherein, for the same data access element set, performing a first operation permission determination and a second operation permission determination based on at least some elements in the data access element set, determining a first filtering rule result string and a second filtering rule result string based on at least some elements in the data access element set, and modifying the first structured query statement based on the first filtering rule result string and the second filtering rule result string.

[0075] Specifically, the complexity of the first structured query statement is detected, especially whether the number of subqueries exceeds a set query threshold and whether the length of the query statement exceeds a set length threshold. If the complexity of the query statement exceeds the preset threshold, multiple data access element sets are determined based on the first structured query statement. Each set represents a part of the query statement and can be independently subject to permission determination and filtering rules. For each independent data access element set, the system performs a first operation permission determination and a second operation permission determination. Based on the table elements and access behavior elements in each data access element set, the system determines a first filtering rule result string and a second filtering rule result string. The first structured query statement is modified according to the determined filtering rule result strings, including appending the first filtering rule result string to the WHERE clause and applying the second filtering rule result string to the SELECT clause to replace or modify relevant columns. After the above modifications, the query statement corresponding to each data access element set will be updated, generating its corresponding second structured query statement.

[0076] In this embodiment, when the number of subqueries in a query statement exceeds a preset query threshold or the length of the query statement exceeds a preset length threshold, multiple sets of data access elements are determined based on the first structured query statement. For each set, a first operation permission determination and a second operation permission determination are performed. Based on these element sets, a first filtering rule result string and a second filtering rule result string are determined, thereby modifying the first structured query statement. This method improves the security and efficiency of data processing. By subdividing queries and strengthening permission verification, it effectively prevents data leakage and unauthorized access, optimizes query performance, ensures the security of data processing, and enhances the system's ability to handle complex queries while ensuring data security.

[0077] In one embodiment, such as Figure 8 As shown, the transformation algorithm converts user questions described in natural language into a first structured query statement, and determines the set of data access elements based on the first structured query statement, including the following steps: Step 801: Based on a pre-trained large language model and / or parsing algorithm, the user's question described in natural language is transformed into a first structured query statement; Specifically, the questions users ask in natural language can be complex, containing multiple intents and requests. For example, a user might ask, "What were the sales figures for each department in the first quarter of 2023?" Pre-trained large language models and / or parsing algorithms are used to understand the user's natural language question and translate it into a first-order structured query (SQL) statement that the database can understand. Pre-trained large language models are an application of artificial intelligence technology that can understand, interpret, and generate natural language text; parsing algorithms are a series of computer programs that can recognize and process the structure of natural language text.

[0078] Step 802: Parse the first structured query statement into an abstract syntax tree; Specifically, an Abstract Syntax Tree (ABST) is a data structure that represents the syntactic structure of a programming or query language (such as SQL) in tree form. In the tree, each node represents a part of the query statement, such as an expression, an operator, or a database object (such as a table or field). A parser can be used to transform a first structured query statement into an ABST. A parser is a specially designed software component that understands and processes the syntax of the SQL language. The parser reads the text of the SQL query statement and breaks it down into its components according to the syntactic rules of the SQL language. These components are organized into a tree structure according to logical and syntactic relationships. The process of building the ABST begins with the root of the query statement, typically keywords such as select, insert, update, or delete. Then, the parser builds nodes layer by layer downwards, each node representing a component of the query statement, such as a field name, table name, or conditional expression.

[0079] Step 803: Determine the set of data access elements by reading the abstract syntax tree.

[0080] Specifically, the nodes of the abstract syntax tree (BST) are traversed to identify and extract information relevant to data access. This process involves a deep understanding of the structure and content of the BST, identifying nodes in the BST that correspond to tables, fields, and other database objects used in the query. Any conditional expressions used in the query are extracted, defining the filtering rules for data rows. Based on the information in the BST, the system constructs a set of data access elements containing all the key information needed to execute the query.

[0081] In this embodiment, a conversion algorithm is used to transform the user's question in natural language into a first structured query statement. This conversion is then achieved through a parsing algorithm or a pre-trained large language model. The converted query statement is parsed into an abstract syntax tree, and the data access element set is determined by reading the structure of this tree, including key information such as table names, field names, and query conditions. This method improves the accuracy of the natural language to structured query conversion and enhances the control and security of data access. By accurately extracting data access elements, the system can more effectively perform permission verification and data filtering, ensuring that only authorized users can access specific data, thereby preventing data leakage and unauthorized access.

[0082] In one embodiment, such as Figure 9 The diagram shown is a flowchart of the entire method, which includes the following steps: Step 901: Obtain user questions; Step 902: Transform the user question using a pre-trained large language model and / or parsing algorithm; Step 903: Obtain the first structured query statement; Step 904: Parse the first structured query statement; Step 905: Determine the set of data access elements; Step 906: Perform a first operation permission determination and a second operation permission determination based on at least some of the elements in the data access element set; Step 907: Using at least some of the elements in the data access element set, determine the first filter rule result string and the second filter rule result string; Step 908: Modify the first structured query statement using the result strings of the first and second filtering rules; Step 909: Obtain the updated second structured query statement; Step 910: Input the second structured query statement into the pre-trained large language model; Step 911: Obtain the answer described in natural language.

[0083] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0084] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for protecting security permissions for generative data analysis, characterized in that: The method comprises: Obtaining a user question; wherein the user question is described in natural language; Converting the user question described in natural language into a first structured query statement based on a conversion algorithm, and determining a data access element set according to the first structured query statement, wherein the data access element set includes a plurality of elements; Performing operation authority determination based on at least some elements in the data access element set; If the operation authority determination is satisfied, a first filtering rule result string and a second filtering rule result string are determined based on at least some elements in the data access element set, and the first structured query statement is modified based on the first filtering result string and the second filtering result string to obtain an updated second structured query statement; The second structured query statement is input into a pre-trained large language model to obtain an answer described in natural language.

2. The method for protecting security permissions according to claim 1, characterized in that: Determining a first filtering rule result string and a second filtering rule result string based on at least some elements in the data access element set includes: Acquire a pre-configured data range limitation rule, search for the data range limitation rule based on at least some elements in the data access element set, and obtain a first filtering rule and a second filtering rule; A first filtering rule result string is determined according to the first filtering rule, and a second filtering rule result string is determined according to the second filtering rule.

3. The method for security permission protection according to claim 2, characterized in that: Obtaining a preconfigured data range limitation rule, querying the data range limitation rule based on at least some elements in the data access element set, and obtaining a first filtering rule and a second filtering rule, including: Obtain a pre-configured data row range restriction table and a data column range restriction table; Based on at least some elements in the data access element set, query the data row range limitation table to obtain the first filtering rule; The data column range limitation table is queried based on at least some of the elements in the data access element set to obtain the second filtering rule.

4. The method for protecting security permissions according to claim 2 or 3, characterized in that: Determining a first filtering rule result string according to the first filtering rule, and determining a second filtering rule result string according to the second filtering rule, includes: Parsing the first filtering rule, replacing corresponding variables in the first filtering rule with data corresponding to row elements in the data access element set, and obtaining the first filtering rule result string; The second filtering rule is parsed, and corresponding variables in the second filtering rule are replaced with data corresponding to column elements in the data access element set to obtain a result string of the second filtering rule.

5. The method according to any one of claims 1 to 3, characterized in that: The first structured query statement is modified based on the first filtering result string and the second filtering result string to obtain an updated second structured query statement, including: The first filtering rule result string is appended to the where clause of the first structured query statement and the second filtering rule result string is applied to the select clause of the first structured query statement to replace the relevant columns in the select clause, thereby obtaining an updated second structured query statement.

6. The method according to claim 1, characterized in that Performing operation authority determination based on at least some of the elements in the data access element set includes: performing a first operation authority determination and a second operation authority determination based on at least some of the elements in the data access element set; wherein the first operation authority determination is performed based on at least a user role, and the second operation authority determination is performed based on at least an association rule in a data authorization table; Performing a first operation permission determination based on at least some of the elements in the data access element set includes: Get the association chain; Determine a user role corresponding to the user identifier from the association chain, obtain a user operation authority corresponding to the user role from the association chain, and determine a data access element matching the user identifier based on the user operation authority; Determine whether a first operation authority determination is satisfied based on the matched data access element and at least some elements in the data access element set.

7. The method according to claim 6, characterized in that Performing a second operation permission determination based on at least some of the elements in the data access element set includes: Acquire a data authorization table, match the data authorization table based on table elements and access behavior elements in the data access element set, and obtain association rules; Whether the second operation authority is satisfied is determined by parsing the association rule.

8. The method according to claim 7, characterized in that Determining whether the second operation authority is satisfied by parsing the association rule includes: Parsing the association rule to obtain a first parameter, a second parameter and a function; wherein the first parameter is defined as data used to represent the request object, the second parameter is defined as data used to represent the user session object, the data corresponding to the user session object is customizable, and the data corresponding to the request object is determined based on the row element in the data access element set; The function is used to determine whether the first parameter matches the second parameter, and if so, the second operation right determination is satisfied.

9. The method according to claim 1, characterized in that: The method further comprises: If the subquery included in the first structured query statement is greater than the query threshold and / or the length of the first structured query statement is greater than the length threshold, multiple data access element sets are determined according to the first structured query statement; wherein, for the same data access element set, a first operation permission determination and a second operation permission determination are performed based on at least some of the elements in the data access element set, a first filter rule result string and a second filter rule result string are determined based on at least some of the elements in the data access element set, and the first structured query statement is modified based on the first filter rule result string and the second filter rule result string.

10. The method according to claim 1, characterized in that The method includes converting a user question described in natural language into a first structured query statement based on a conversion algorithm, and determining a data access element set according to the first structured query statement, including: Converting the user question described in natural language into the first structured query statement based on a pre-trained large language model and / or a parsing algorithm; Parsing the first structured query statement into an abstract syntax tree; The data access element set is determined by reading the abstract syntax tree.

Images