Image big data access control method and system based on security attribute intelligent extraction

Abstract

The invention relates to the technical field of big data resource access control, in particular to an image big data access control method and system based on security attribute intelligent extraction. The method comprises the following steps: setting an access control strategy for acquiring attributes of access control subjects, image data sets corresponding to the access control subjects, group types of access users and role management of the access users; selecting a plurality of images from each type of image data set to construct a security attribute knowledge base, taking the remaining images in each type of image data set as accessible images, and constructing an image database; and querying and obtaining an image data security attribute corresponding to the target access request from the security attribute knowledge base, and obtaining a corresponding access control strategy based on the obtained image data security attribute so as to perform access control on the target access request by using the strategy. According to the method, hierarchical dynamic attribute management is formulated on the basis of image classes, and access control of big data such as images is realized in combination with an ABAC access control strategy, so that the security of the big data such as the images is effectively guaranteed.

Description

Technical Field

[0001] The present invention relates to the technical field of big data resource access control, and in particular to an image big data access control method and system based on intelligent extraction of security attributes. Background Art

[0002] With the advent of the digital economy, data has become another production factor after land, labor, and capital. Making full use of the value inherent in big data can improve resource utilization efficiency and bring huge social and economic benefits. However, while creating value and bringing convenience, big data also creates security risks. In recent years, data leakage and abuse incidents have occurred frequently, posing a huge threat to user privacy security, corporate commercial interests, and social public services. In order to ensure data security and safeguard normal production, operation, and social order, it is urgent to restrict access to data.

[0003] The existing methods of access control for big data resources mainly include discretionary access control (DAC), mandatory access control (MAC), task-based access control (TBAC), role-based access control (RBAC) and attribute-based access control (ABAC). Among them, attribute-based access control (ABAC) is more suitable for dynamic access control requirements in big data environments due to its strong flexibility and simple policy formulation. High-quality attributes are the key to the effective implementation of ABAC. The attribute extraction and management process of structured data is simple and can basically meet the requirements of ABAC. The difficulty of implementing access control under big data conditions lies in the attribute extraction of unstructured data. Images are typical unstructured data. The extraction of their security attributes has long relied on manual annotation, which is difficult to meet the requirements in terms of efficiency and accuracy, making it difficult to implement access control for image data.

[0004] The success of deep learning in image content representation has brought hope to the research on automatic extraction of security attributes of image data. Using deep learning-based image classification, object detection, and title generation methods, image content information can be automatically obtained as security attributes of image data to support access control. However, due to the defects of existing deep learning methods, there are still two problems in the extraction of security attributes of image data based on deep learning: First, the existing attribute structure is simple, lacks sufficient flexibility and dynamic adjustment capabilities, and is difficult to match actual application scenarios. Taking image classification as an example, the settings of various categories are mutually exclusive and equal, while there are complex hierarchical relationships between object categories in real application scenarios. The existing category settings cannot match most actual needs and are only applicable to very few special scenarios. The problem of lack of dynamics in attribute structure stems from the limitations of deep learning theory. Existing deep learning methods belong to supervised learning and do not have effective continuous learning capabilities. Secondly, the high cost of training deep learning models limits the use of such methods. Deep learning requires the support of a large amount of labeled data, and data labeling is done manually, which has a high labeling cost; another reason for the high training cost is the fragility of the deep learning algorithm itself, which is reflected in the lack of domain adaptation and generalization capabilities. When the use environment changes slightly, a lot of repeated training is required. Summary of the invention

[0005] To this end, the present invention provides an image big data access control method and system based on intelligent extraction of security attributes, which solves the problem that image data security attributes are limited in the implementation of access control, realizes hierarchical dynamic attribute management of big data access control based on image classes, and effectively ensures the security of big data.

[0006] According to the design scheme provided by the present invention, on the one hand, a method for image big data access control based on intelligent extraction of security attributes is provided, comprising:

[0007] According to the data access control application scenario, the access control subject attributes and the image data sets corresponding to each access control subject are obtained, and the access control policies for each access user group type and access user role management are set based on the access control subject attributes and access object attributes;

[0008] Based on the image data sets corresponding to each access control subject, a number of images are selected from each type of image data set to construct a security attribute knowledge base, and the remaining images in each type of image data set are used as accessible images and the image database is constructed using the accessible images, wherein the security attribute knowledge base includes an attribute structure diagram that hierarchically displays image content attributes and an attribute knowledge base that records the roles corresponding to each image class and the group information of the image class according to the attribute structure diagram, and the attribute knowledge base includes an image class security attribute table for recording all image roles corresponding to each image class and an image retrieval library for classifying a target image into a corresponding image class to obtain the target image attribute;

[0009] The image data security attributes corresponding to the target access request are queried and obtained from the security attribute knowledge base, and the corresponding access control policy is obtained based on the obtained image data security attributes, so as to perform access control on the target access request using the access control policy.

[0010] As the image big data access control method based on intelligent extraction of security attributes of the present invention, further, the access control subject attributes at least include access user name attributes, access user group attributes and access user role management attributes.

[0011] As an image big data access control method based on intelligent extraction of security attributes of the present invention, further, an attribute structure diagram for hierarchically displaying image content attributes adopts a directed acyclic graph, in which any node represents an attribute, the attribute represented by the leaf node is the image class, and the attributes represented by other nodes are image roles, and the connection between nodes is from the image role to the image class or other image roles.

[0012] As the image big data access control method based on intelligent extraction of security attributes of the present invention, further, the attribute structure diagram also includes: using the attribute list and the adjacency matrix to record the attribute structure, so as to process the addition, deletion or connection relationship adjustment of the corresponding attribute nodes due to the change of the attribute structure under the condition of big data through the attribute list and the adjacency matrix.

[0013] As an image big data access control method based on intelligent extraction of security attributes of the present invention, further, an image database constructed using accessible images includes an image file library and an image attribute library, wherein the image file library records the image file data stored in the library, and the image attribute library includes a vector-ID library composed of image feature vectors and corresponding vector IDs, an ID-path library composed of image IDs and image paths, and a path-attribute library composed of image paths and all image attributes, and both the vector-ID library and the ID-path library use data dictionaries to store relevant data object information.

[0014] As the image big data access control method based on intelligent extraction of security attributes of the present invention, further, an image database is constructed using accessible images, comprising:

[0015] Firstly, the accessible image is taken as the target image, the feature vector of the target image is extracted and an ID is assigned to the feature vector of the target image, and the relevant information of the target image is stored in the vector-ID library and the ID-path library;

[0016] Next, search for several images that are most similar to the target image in the image retrieval library and obtain the image class attributes of the several images, and query the corresponding attribute set in the image class security attribute table according to the obtained image class attributes;

[0017] Then, the content attributes of the target image are obtained by taking the intersection of the attribute sets, the general attributes and the content attributes of the target image are merged, and the relevant information of the target image is added to the path-attribute library.

[0018] As the image big data access control method based on intelligent extraction of security attributes of the present invention, further, querying and obtaining the image data security attributes corresponding to the target access request from the security attribute knowledge base includes:

[0019] First, extract the target feature vector of the image corresponding to the target access request;

[0020] Next, according to the target feature vector, the nearest neighbor vector and the nearest neighbor vector ID are retrieved and obtained in the vector-ID library, and the corresponding target path is retrieved in the ID-path library according to the nearest neighbor vector ID;

[0021] Then, based on the target path, the security attributes of the image corresponding to the target access request are obtained in the path-attribute library.

[0022] Furthermore, the present invention also provides an image big data access control system based on intelligent extraction of security attributes, comprising: a policy execution point, a policy decision point, a policy management point and a policy information point, wherein:

[0023] A policy management point is configured to obtain access control subject attributes and image data sets corresponding to each access control subject according to data access control application scenarios, and to set access control policies for each access user group type and access user role management based on the access control subject attributes and access object attributes; and to select a number of images from each type of image data set based on the image data set corresponding to each access control subject to construct a security attribute knowledge base, and to use the remaining images in each type of image data set as accessible images and to construct an image database using accessible images, wherein the security attribute knowledge base includes an attribute structure diagram that hierarchically displays image content attributes and an attribute knowledge base that records the roles corresponding to each image class and the group information of the image class according to the attribute structure diagram, and the attribute knowledge base includes an image class security attribute table for recording all image roles corresponding to each image class and an image retrieval library for classifying target images into corresponding image classes to obtain target image attributes;

[0024] The policy information point queries and obtains the image data security attributes corresponding to the target access request from the security attribute knowledge base;

[0025] A policy decision point obtains the corresponding access control policy based on the acquired image data security attributes;

[0026] The policy execution point uses the obtained access control policy to perform access control on the target access request.

[0027] Beneficial effects of the present invention:

[0028] The present invention uses the indivisible image class in information system applications as the basic granularity, adds various image roles, and constructs a local tree-shaped image content attribute structure; based on the ABAC access control model framework, the vector search engine and deep neural network model are used to implement image big data access control, which can effectively extract and flexibly manage image attributes. With the support of high-quality attributes, it can guarantee the user's access needs and effectively prevent excessive access, thereby ensuring the security of big data. The rationality and reliability of the scheme in this case are verified by experimental results, and it has a high practical deployment significance. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 This is a schematic diagram of an image big data access control framework based on intelligent extraction of security attributes in an embodiment;

[0030] Figure 2 Schematic diagram of different attribute category structures in the embodiment;

[0031] Figure 3 This is a schematic diagram of a local tree-like attribute structure in the embodiment;

[0032] Figure 4 This is a schematic diagram of the principle of extracting image security attributes in the embodiment;

[0033] Figure 5 This is a schematic diagram of the image security attribute extraction process in the embodiment;

[0034] Figure 6 This is a schematic diagram of the image security attribute query process in the embodiment;

[0035] Figure 7 This is a schematic diagram of the big data access control system framework in the embodiment;

[0036] Figure 8 It is a structural diagram of image class attributes in the embodiment;

[0037] Fig. 9 This is an illustration of the image search result in the embodiment;

[0038] Fig.10 This is a diagram showing the accessible scope of user Bob in the embodiment. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solutions and advantages of the present invention clearer and more understandable, the present invention is further described in detail below in conjunction with the accompanying drawings and technical solutions.

[0040] With the advent of the digital economy, big data resources are fully utilized, which can improve production and operation efficiency and create huge social and economic benefits. However, under the condition of big data, data updates and changes quickly, and transmission and interaction are frequent, which is easy to be excessively collected and abused by malicious visitors. Access control is an important method to ensure information security. Limiting legitimate users to access system resources only within a specified range can greatly reduce data abuse caused by excessive access. Image is a typical unstructured data. The difficulty of extracting and managing image data security attributes limits the application of access control in image big data. The existing image attribute extraction methods have a single attribute structure setting, which is difficult to meet the needs of practical applications. Image retrieval is one of the basic problems of image processing and understanding. Its purpose is to quickly find the image most similar to the image to be tested in the image library of the information system. The existing image retrieval method uses a deep learning model to extract image feature vectors and converts the search for the most similar image into the search for the nearest neighbor vector. This method performs well in a wide range of scenarios and has strong dynamic adjustment and generalization capabilities. Using image retrieval to extract image security attributes will help overcome the defects of existing attribute extraction methods, establish a more flexible attribute structure, and provide security attribute support for image big data access control. To this end, the present invention provides an image big data access control method based on intelligent extraction of security attributes, see Figure 1 As shown, it contains the following contents:

[0041] S101, setting and acquiring access control subject attributes and image data sets corresponding to each access control subject according to data access control application scenarios, and setting access control policies for each access user group type and access user role management based on the access control subject attributes and access object attributes.

[0042] Among them, according to the specific access control application scenario, the access control subject attributes can be set to include access user name attributes, access user group attributes, access user role management attributes, etc.

[0043] It should be noted that those skilled in the art may adjust the access control subject attributes according to the actual application scenario, such as setting information such as account name, account ID, account group and account administrator to achieve access control in the corresponding scenario.

[0044] S102. Based on the image data sets corresponding to each access control subject, a number of images are selected from each type of image data set to construct a security attribute knowledge base, and the remaining images in each type of image data set are used as accessible images and the image database is constructed using the accessible images, wherein the security attribute knowledge base includes an attribute structure diagram that hierarchically displays image content attributes and an attribute knowledge base that records the corresponding roles of each image class and the group information of the image class according to the attribute structure diagram, and the attribute knowledge base includes an image class security attribute table for recording all image roles corresponding to each image class and an image retrieval library for dividing the target image into the corresponding image class to obtain the target image attribute.

[0045] Since images are stored in the form of files, image data has general attributes of files, such as file type, file creator, creation time, etc., which are called common attributes of images. Image content contains visual semantic information, and recording these semantics in the form of words (strings) forms the content attributes of the image. The content attributes of an image correspond to the main information in the image and are the main aspects of security attributes. In order to facilitate analysis and calculation, image processing based on deep learning usually simplifies the attribute structure. For example, the COCO and ImageNet datasets in image classification tasks only use a two-level tree structure, such as Figure 2 As shown, each category (leaf node) is equal. In reality, the image content attributes have complex relationships, presenting a hierarchical and local tree structure, such as "Sichuan subspecies giant panda / Qinling subspecies giant panda-giant panda-Ailuropoda genus-Ursidae-Mammals". In order to adapt to various application scenarios of access control, the attribute structure setting needs to be able to reflect this complexity.

[0046] Specifically, in the embodiment of this case, the attribute structure diagram for hierarchically displaying image content attributes can adopt a directed acyclic graph, in which any node represents an attribute, the attribute represented by the leaf node is the image class, and the attributes represented by other nodes are image roles, and the connection between nodes is from the image role to the image class or other image roles.

[0047] Considering the user access requirements and the capacity and processing power limitations of the information system, it is not necessary to fully present the structural relationship between all attributes. In this embodiment, a local tree-like attribute structure is used, such as Figure 3 As shown in the figure, the structure is a directed acyclic graph. Each node in the graph represents an attribute. The attribute represented by the leaf node is called the image class (pink node in the figure), and the other attributes are called image roles (blue nodes in the figure). The connection between nodes can only be from the image role to the image class or other image roles. The image class represents a certain type of object that is inseparable in reality. When the object of this type needs to be divided into multiple subclasses in the system, the class is converted into an image role, and each subclass becomes a new image class.

[0048] Among them, in the attribute structure diagram, the attribute list and adjacency matrix can be used to record the attribute structure, so as to handle the addition, deletion or connection relationship adjustment of the corresponding attribute nodes due to the change of the attribute structure under the condition of big data through the attribute list and adjacency matrix.

[0049] The attribute structure is recorded by an attribute list and an adjacency matrix. Since the attribute structure of images is constantly changing under big data conditions, this involves the addition, deletion and connection relationship changes of certain attributes in the attribute structure, which can be described as follows:

[0050] (1) Adding attributes: When the attribute to be added is an image class, simply add a new node to the graph. If you want to add an image role, you must specify which image classes and image roles the child nodes of the image role contain, add the new node to the graph, and connect them according to the corresponding relationship. Adding a new attribute means adding a new row and column to the adjacency matrix.

[0051] (2) Deletion of attributes: The administrator can delete the attributes, that is, delete the corresponding rows and columns in the adjacency matrix. After deleting an attribute node, it is also necessary to judge the indirect connections involved and update the adjacency matrix elements according to the newly created connection relationship.

[0052] (3) When the connection relationship of an attribute changes, if the connection relationship needs to be changed, first determine whether a loop will be formed. If the newly added connection will form a loop, the system will issue a warning and prevent the newly added connection from being added.

[0053] Among them, the image database constructed using accessible images includes an image file library and an image attribute library, wherein the image file library records the image file data stored in the library, and the image attribute library includes a vector-ID library composed of image feature vectors and corresponding vector IDs, an ID-path library composed of image IDs and image paths, and a path-attribute library composed of image paths and all image attributes, and both the vector-ID library and the ID-path library use data dictionaries to store relevant data object information.

[0054] In order to solve the problem of difficulty in extracting security attributes of image data, an intelligent extraction method of image data security attributes is proposed based on image retrieval according to the local tree attribute structure. Figure 4 As shown, the purpose of attribute extraction is to label the attributes of image files in the image database, and this process needs to be completed using the image security attribute knowledge base.

[0055] The image class security attribute table in the attribute knowledge base records all image roles corresponding to each image class. The image retrieval library divides all image samples into different groups according to image classes. When the top (3) retrieval results of the image to be tested belong to the same group, it is considered to have all the attributes of the image class. When the attribute structure graph changes, the corresponding information in the attribute knowledge base needs to be modified.

[0056] The image attribute library in the image database is divided into a vector-ID library, an ID-path library, and a path-attribute library. The vector-ID library is a feature vector library. Each feature vector is obtained from the original image through a feature extraction model. A unique ID is assigned to the vector when it is stored. For a given feature vector, the vector-ID library can complete the search for the nearest neighbor vector and return the ID. The ID-path library is a data dictionary with the key name being ID and the key value being the path of the original image; the path-attribute library is also a data dictionary with the key name being path and the key value being all the attributes of the original image. The image attribute library records the attributes of the images in the image file library and can complete the image attribute query function.

[0057] The image attribute library stores all the attributes of all image data in the image file library. The function of the vector-ID library and the ID-path library is to complete the conversion from image to path in the access request mode of image search. The attributes of a single image data can be stored in the path-attribute library with the path as the key name and the attribute field as the key value. The format of the attribute field is shown in Table 1.

[0058] Table 1 Image attribute fields

[0059]

[0060] The attributes Atr(I) of an image I have 14 fields, which are divided into two parts: general attributes and content attributes. General attributes include number, location, file type, creation time, etc.; content attributes include image class and content attribute list. The detailed meaning of each field is as follows:

[0061] General properties:

[0062] ID: The ID is a unified identifier of an image in the system resource library, which is the same as the feature vector ID of the image;

[0063] Position (P): refers to the storage location of the image in the system;

[0064] Size (S): refers to the size of the image file, in KB;

[0065] File name (F): the actual file name of the image;

[0066] File type (E): extension;

[0067] Creation time (T0): the creation time of the original image;

[0068] Modification time (T1): the last modification time of the image file;

[0069] Access time (T2): the last access time of the image file;

[0070] Width (W): The pixel-level width of the image file when it is displayed;

[0071] Height (H): The pixel-level height of the image file when it is displayed;

[0072] Bit depth (D): The length of binary data contained in each pixel of an image file;

[0073] Resolution (dpi): The number of pixels per inch, here the smaller value of horizontal dpi and vertical dpi is taken;

[0074] Content attributes:

[0075] Image class (C): The basic unit of content attributes, representing a class of images with the same abstract content meaning;

[0076] Content attribute list (A): contains all attributes of the image content, stored in the form of a string list. Each item in the list represents a content attribute, regardless of order.

[0077] The storage and retrieval of image attributes are indexed by the image path. When the image file path changes, the relevant records in the three libraries must be changed. When the attribute structure changes, all attribute records need to be traversed for update.

[0078] Specifically, in the embodiment of this case, the image database is constructed using accessible images, which can be designed to include the following contents:

[0079] Firstly, the accessible image is taken as the target image, the feature vector of the target image is extracted and an ID is assigned to the feature vector of the target image, and the relevant information of the target image is stored in the vector-ID library and the ID-path library;

[0080] Next, search for several images that are most similar to the target image in the image retrieval library and obtain the image class attributes of the several images, and query the corresponding attribute set in the image class security attribute table according to the obtained image class attributes;

[0081] Then, the content attributes of the target image are obtained by taking the intersection of the attribute sets, the general attributes and the content attributes of the target image are merged, and the relevant information of the target image is added to the path-attribute library.

[0082] Since image security attributes include general attributes and content attributes, general attributes are directly read from the image file, such as Figure 5 As shown, the extraction of content attributes is divided into four steps:

[0083] Step 1: First, use the feature extraction model to convert the input image I into a feature vector F, assign an unused ID, and store the relevant information in the "vector-ID" library and the "ID-path" library;

[0084] Step 2: Search the image retrieval database for the three images I0, I1, and I2 that are most similar to I. The image class attributes of the three images are C0, C1, and C2 respectively.

[0085] Step 3: In order to obtain the complete content attributes of I0, I1, and I2, three attribute sets A0, A1, and A2 are obtained by querying the image security attribute table according to C0, C1, and C2;

[0086] Step 4: Calculate the content attribute A of image I by taking the intersection of A0, A1, and A2.

[0087] Finally, general attributes and content attributes are merged and added to the "path-attribute" library.

[0088] S103, querying and acquiring the image data security attribute corresponding to the target access request from the security attribute knowledge base, and acquiring the corresponding access control policy based on the acquired image data security attribute, so as to perform access control on the target access request using the access control policy.

[0089] Specifically, the image data security attributes corresponding to the target access request are queried and obtained from the security attribute knowledge base, which can be designed to include the following contents:

[0090] First, extract the target feature vector of the image corresponding to the target access request;

[0091] Next, according to the target feature vector, the nearest neighbor vector and the nearest neighbor vector ID are retrieved and obtained in the vector-ID library, and the corresponding target path is retrieved in the ID-path library according to the nearest neighbor vector ID;

[0092] Then, based on the target path, the security attributes of the image corresponding to the target access request are obtained in the path-attribute library.

[0093] like Figure 6 As shown in the figure, when querying image attributes based on the path, the attributes corresponding to the path are directly searched in the "path-attribute" library and the results are returned. When querying the most similar image attributes based on a given image (image search), image retrieval is first performed, that is, the given image I is converted into a feature vector F through a feature extraction model, and the nearest neighbor vector F' and its ID are retrieved in the "vector-ID" library, and then the "ID-path" library is queried according to the ID to obtain the path, and finally the "path-attribute" library is queried to obtain the attributes.

[0094] Furthermore, based on the above method, an embodiment of the present invention also provides an image big data access control system based on intelligent extraction of security attributes, comprising: a policy execution point, a policy decision point, a policy management point and a policy information point, wherein:

[0095] A policy management point is configured to obtain access control subject attributes and image data sets corresponding to each access control subject according to data access control application scenarios, and to set access control policies for each access user group type and access user role management based on the access control subject attributes and access object attributes; and to select a number of images from each type of image data set based on the image data set corresponding to each access control subject to construct a security attribute knowledge base, and to use the remaining images in each type of image data set as accessible images and to construct an image database using accessible images, wherein the security attribute knowledge base includes an attribute structure diagram that hierarchically displays image content attributes and an attribute knowledge base that records the roles corresponding to each image class and the group information of the image class according to the attribute structure diagram, and the attribute knowledge base includes an image class security attribute table for recording all image roles corresponding to each image class and an image retrieval library for classifying target images into corresponding image classes to obtain target image attributes;

[0096] The policy information point queries and obtains the image data security attributes corresponding to the target access request from the security attribute knowledge base;

[0097] A policy decision point obtains the corresponding access control policy based on the acquired image data security attributes;

[0098] The policy execution point uses the obtained access control policy to perform access control on the target access request.

[0099] like Figure 7 The ABAC access control model shown is used to establish an image big data access control system. The standard ABAC model includes four main parts: the policy enforcement point PEP (Policy Enforcement Point) accepts user requests and returns the requested resources or denies access based on the policy matching results; the policy decision point PDP (Policy Decision Point) makes access or denial decisions based on the attributes and policies of the request; the policy administration point PAP (Policy Administration Point) manages all policies; the policy information point PIP (Policy Information Point) obtains and manages the relevant attributes of the subject, environment and resources. In this embodiment, the image security attribute manager is used to extract the security attributes of the image data and serves as a support for the PIP; in addition, an image attribute library is established in the image database to record the extracted image security attributes and support attribute queries. The system includes attribute extraction and access control implementation of image big data resources.

[0100] In view of the fact that the system can build multiple models and vector databases, the system code can be written based on Python language in the specific design, and learning libraries such as Numpy, OpenCV, Pytorch, Casbin, Milvus and Redis can be introduced to complete the algorithm implementation. Use Casbin to implement the access control model based on ABAC; use Numpy to create an adjacency matrix to implement the attribute structure diagram; use OpenCV and Pytorch deep learning model libraries to extract image feature vectors, and build image retrieval libraries and image attribute libraries based on Milvus and Redis.

[0101] Casbin is a lightweight open source access control framework that supports a variety of classic access control schemes such as RBAC and ABAC, and supports customized access control request formats. The default request format is {subject, object, action}; Casbin supports multi-level role inheritance in RBAC, and resources can also have roles, which is suitable for formulating access control policies based on attribute structure diagrams. In this case, the ABAC access control scheme of Casbin can be used to establish hierarchical roles for image content attributes, and access control of image big data can be achieved by managing and referencing image attributes to formulate policies.

[0102] In the access control framework based on Casbin, the access control request can adopt a four-tuple format: subject (sub), object (obj), environment (envs), operation (act), which is defined as follows:

[0103] r=sub, obj, envs, act (1)

[0104] The format of access control policy can be expressed as: subject rule (sub_rule), object rule (obj_rule), environment rule (envs_rule), operation, which is defined as:

[0105] p=sub rule , obj rule ,envs rule ,act (2)

[0106] The policy matching rule is that the elements of the access request can meet all the conditions in a certain policy:

[0107] m=eval(p.sub_rule)&&eval(p.obj_rule)&&eval(p.envs_rule)&&r.act==p.act (3)

[0108] If the policy matches successfully, it returns "True", otherwise it returns "False".

[0109] NumPy (Numerical Python) is an open source numerical computing extension of Python. Its characteristics are that it can be used to store and process large matrices and support large-dimensional arrays and matrix operations. Since the attribute structure diagram involves a large number of nodes and connections, in this embodiment, a list can be used to store the attribute node information name, and a NumPy matrix can be used to store the attribute structure diagram and perform related calculations.

[0110] Milvus is an open source vector search engine that can use a single node or a distributed structure. Milvus supports indexing of large vector sets, realizes the fusion calculation of CPU and GPU, and greatly improves the retrieval speed. Milvus is installed using a mirror, and then vector insertion and search are performed through the Python SDK. Redis is a remote dictionary database, which is an effective supplement to relational databases. It is stored in a key-value format and supports five types, including strings, lists, hash values, sets, and ordered sets. Redis data is cached in memory to ensure query efficiency. The system in the embodiment of this case includes an image retrieval library and an image attribute library, and the Milvus+Redis structure can be used. The difference is that the original images in the image retrieval library need to be stored in groups according to different image classes, and the image attribute library does not have this requirement; in addition, the image retrieval library can only query image content attributes, while the image attribute library can query all attributes of the image. When performing the most similar image retrieval, it is necessary to first use the OpenCV library function to transform the image to be tested, and then extract the feature vector through the deep learning model in the Pytorch framework.

[0111] In order to verify the effectiveness of this solution, the following is a further explanation based on experimental data:

[0112] The experiment uses 14 categories of images from the Caltech 101 dataset. 20 images from each category are taken as knowledge base images to build an image security attribute knowledge base, and the other images are used as accessible images to build an image database. During the access control test, images in the image database are requested for access, using image paths and image search methods.

[0113] Each image class is labeled with multiple image roles to form an attribute structure diagram such as Figure 8As shown in the figure, the image class attributes can be marked according to actual needs. For example, the attribute of "ant" should be "arthropod"-"insect", but there are no other arthropods in this database and the "insect" attribute can already meet the access control requirements, so the "arthropod" attribute is omitted. When the object in the image is a composite type, its attributes may be more complex, such as "bonsai" contains both "plants" and "natural objects", as well as "home" and "man-made objects".

[0114] After establishing the class attribute structure graph, all predecessor nodes are searched in the graph for each image class, and the security attribute table is constructed as shown in Table 2 below:

[0115] Table 2 Image class security attribute table

[0116]

[0117] A separate folder path is created for each image class, and all knowledge base images are stored according to the corresponding image class. Then, an image retrieval library with a Milvus+Redis structure can be established based on these images to extract the image class attributes of the image to be tested.

[0118] Set the image storage directory name to " / accessible-images" and place all accessible images in this directory. Create a vector-ID library, an ID-path library, and a path-attribute library. Use the VGG model in the Pytorch library to extract the feature vectors of all images, store them in the vector-ID library and obtain the ID, write the path information into the ID-path library, extract the image security attributes, and store the corresponding relationship between the path and the attribute in the path-attribute library.

[0119] Assume that the above image data is the internal data of an online class, and the access control subject sets three attributes, namely name, role, and administrator. The name attribute is a string type, which is filled in by the user when registering in the system; the role attribute is a string list, which is automatically assigned by the system according to the courses registered by the user; the administrator attribute is a logical value, which is set when the system is created, and other users can be assigned by the administrator to become new administrators. There are three users, and their attribute settings are shown in Table 3:

[0120] Table 3 Subject attributes

[0121] Serial number Name Role Admin 1 Alice Home Design Group False 2 Bob Animal and Plant Interest Group False 3 Kate Home Design Group, Animal and Plant Interest Group True

[0122] Three access control policies are formulated according to the subject and object attributes as shown in Table 4:

[0123] Table 4 Access control policy

[0124]

[0125] Access control example 1:

[0126] Access method: Access according to the image resource path

[0127] User: Alice

[0128] Resource path: "Interviewed images / home / chair / 1.jpg"

[0129] Environment: Time = 2023.05.10.16:23

[0130] First, image attribute query is performed, and the results are shown in Table 5 below:

[0131] Table 5 Image attribute query results

[0132]

[0133]

[0134] Construct a Casbin access request:

[0135] r = "Alice", "Interviewed Image / Home / Chair / 1.jpg", "2023.05.10.16:23", Read

[0136] The access control result is True, allowing access.

[0137] Access Control Example 2

[0138] Access method: Image search

[0139] User: Bob

[0140] Original image: crab.jpg (crab)

[0141] The most similar image path obtained through image retrieval is: "Interviewed images / animals / crayfish / crayfish.jpg"

[0142] Image retrieval results are as follows Fig. 9 shown.

[0143] Environment: Time = 2023.05.10.16:24

[0144] The attribute query of the most similar image is as follows: Image Class = "Crayfish", Image Role = "Animal", "Natural Object";

[0145] Construct a Casbin access request:

[0146] r = "Bob", "Interviewed image / animal / crayfish / crayfish.jpg", "2023.05.10.16:24", the Read access control result is True, and access is allowed.

[0147] Access Control Example 3

[0148] Analysis of user Bob's accessible scope:

[0149] According to the second access control policy related to user Bob in Table 4, within the time limit, the object that Bob can access is "natural objects". This image role contains 8 image classes, and the other 6 image classes are prohibited images. The accessible range is as follows: Fig.10 shown.

[0150] The above experimental results show that the image big data access control system based on intelligent extraction of security attributes can effectively extract and flexibly manage image attributes. With the support of high-quality attributes, it can guarantee the access needs of users and effectively prevent excessive access, thus ensuring the security of big data such as images.

[0151] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0152] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0153] The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention.

[0154] Those skilled in the art will appreciate that all or part of the steps in the above method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk or an optical disk. Optionally, all or part of the steps in the above embodiment can also be implemented using one or more integrated circuits, and accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or in the form of software function modules. The present invention is not limited to any specific form of combination of hardware and software.

[0155] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A method for access control of image big data based on intelligent extraction of security attributes, characterized in that: Include: According to the data access control application scenario, the access control subject attributes and the image data sets corresponding to each access control subject are obtained, and the access control policies for each access user group type and access user role management are set based on the access control subject attributes and access object attributes; Based on the image data sets corresponding to each access control subject, a number of images are selected from each type of image data set to construct a security attribute knowledge base, and the remaining images in each type of image data set are used as accessible images and the image database is constructed using the accessible images, wherein the security attribute knowledge base includes an attribute structure diagram that hierarchically displays image content attributes and an attribute knowledge base that records the roles corresponding to each image class and the group information of the image class according to the attribute structure diagram, and the attribute knowledge base includes an image class security attribute table for recording all image roles corresponding to each image class and an image retrieval library for classifying a target image into a corresponding image class to obtain the target image attribute; The image data security attributes corresponding to the target access request are queried and obtained from the security attribute knowledge base, and the corresponding access control policy is obtained based on the obtained image data security attributes, so as to perform access control on the target access request using the access control policy.

2. The image big data access control method based on intelligent extraction of security attributes according to claim 1 is characterized in that: The access control subject attributes at least include an access user name attribute, an access user group attribute, and an access user role management attribute.

3. The image big data access control method based on intelligent extraction of security attributes according to claim 1 is characterized in that: The attribute structure diagram for hierarchical display of image content attributes adopts a directed acyclic graph. Any node in the diagram represents an attribute. The attribute represented by the leaf node is the image class, and the attributes represented by other nodes are image roles. The connection between nodes is from the image role to the image class or other image roles.

4. The image big data access control method based on intelligent extraction of security attributes according to claim 1 or 3 is characterized in that: The attribute structure diagram also includes: using the attribute list and the adjacency matrix to record the attribute structure, so as to process the addition, deletion or connection relationship adjustment of the corresponding attribute nodes due to the change of the attribute structure under the condition of big data through the attribute list and the adjacency matrix.

5. The image big data access control method based on intelligent extraction of security attributes according to claim 1 is characterized in that: The image database constructed using accessible images includes an image file library and an image attribute library, wherein the image file library records the image file data stored in the library, and the image attribute library includes a vector-ID library composed of image feature vectors and corresponding vector IDs, an ID-path library composed of image IDs and image paths, and a path-attribute library composed of image paths and all image attributes, and both the vector-ID library and the ID-path library use data dictionaries to store relevant data object information.

6. The image big data access control method based on intelligent extraction of security attributes according to claim 1 or 5 is characterized in that: Build an image database using accessible images, including: Firstly, the accessible image is taken as the target image, the feature vector of the target image is extracted and an ID is assigned to the feature vector of the target image, and the relevant information of the target image is stored in the vector-ID library and the ID-path library; Next, search for several images that are most similar to the target image in the image retrieval library and obtain the image class attributes of the several images, and query the corresponding attribute set in the image class security attribute table according to the obtained image class attributes; Then, the content attributes of the target image are obtained by taking the intersection of the attribute sets, the general attributes and the content attributes of the target image are merged, and the relevant information of the target image is added to the path-attribute library.

7. The image big data access control method based on intelligent extraction of security attributes according to claim 5 is characterized in that: Query and obtain the image data security attributes corresponding to the target access request from the security attribute knowledge base, including: First, extract the target feature vector of the image corresponding to the target access request; Next, according to the target feature vector, the nearest neighbor vector and the nearest neighbor vector ID are retrieved and obtained in the vector-ID library, and the corresponding target path is retrieved in the ID-path library according to the nearest neighbor vector ID; Then, based on the target path, the security attributes of the image corresponding to the target access request are obtained in the path-attribute library.

8. An image big data access control system based on intelligent extraction of security attributes, characterized in that: Includes: policy execution point, policy decision point, policy management point and policy information point, among which, A policy management point is configured to obtain access control subject attributes and image data sets corresponding to each access control subject according to data access control application scenarios, and to set access control policies for each access user group type and access user role management based on the access control subject attributes and access object attributes; and to select a number of images from each type of image data set based on the image data set corresponding to each access control subject to construct a security attribute knowledge base, and to use the remaining images in each type of image data set as accessible images and to construct an image database using accessible images, wherein the security attribute knowledge base includes an attribute structure diagram that hierarchically displays image content attributes and an attribute knowledge base that records the roles corresponding to each image class and the group information of the image class according to the attribute structure diagram, and the attribute knowledge base includes an image class security attribute table for recording all image roles corresponding to each image class and an image retrieval library for classifying target images into corresponding image classes to obtain target image attributes; The policy information point queries and obtains the image data security attributes corresponding to the target access request from the security attribute knowledge base; A policy decision point obtains the corresponding access control policy based on the acquired image data security attributes; The policy execution point uses the obtained access control policy to perform access control on the target access request.

9. An electronic device, characterized in that: include: at least one processor, and a memory coupled to the at least one processor; The memory stores a computer program, and the computer program can be executed by the at least one processor to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed, the method according to any one of claims 1 to 7 can be implemented.

Images