Image big data access control method and system based on intelligent extraction of security attributes

Abstract

The present application relates to big data resource access control technical field, especially relate to a kind of image big data access control method and system based on security attribute intelligent extraction, by setting access control subject attribute, each access control subject corresponding image dataset and each access user group type and access user role management access control policy;Select several images from each image dataset to construct security attribute knowledge base, the remaining image in each image dataset is accessed as image and constructs image database;Query and obtain target access request corresponding image data security attribute from security attribute knowledge base, based on the image data security attribute obtained corresponding access control policy, to utilize strategy to carry out access control to target access request.The present application is based on image to formulate hierarchical dynamic attribute management, and realizes image and other big data access control in combination with ABAC access control policy, effectively guarantee the security of image and other big data.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of big data resource access control, and particularly relates to an image big data access control method and system based on intelligent extraction of security attributes. BACKGROUND

[0002] With the advent of the digital economy era, data has become another production factor after land, labor and capital. Making full use of the value contained in big data can improve resource utilization efficiency and bring huge social and economic benefits. However, big data has also brought security risks while creating value and bringing convenience. In recent years, data leakage and misuse incidents have occurred frequently, posing a huge threat to users' privacy and security, business interests of enterprises, and social public services. In order to ensure data security and protect normal production, operation and social order, it is urgent to restrict data access.

[0003] Existing big data resource access control methods mainly include Discretional Access Control (DAC), Mandatory Access Control (MAC), Task-Based Access Control (TBAC), Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC). Among them, Attribute-Based Access Control (ABAC) is more suitable for dynamic access control requirements in the big data environment due to its strong flexibility and simple policy making. High-quality attributes are the key to the effective implementation of ABAC. The attribute extraction and management process of structured data is simple and basically meets the requirements of ABAC. The difficulty of access control implementation under big data conditions lies in the attribute extraction of unstructured data. Image is a typical unstructured data, and the extraction of its security attributes has long relied on manual annotation, which is difficult to meet the requirements in terms of efficiency and accuracy, forming a difficulty in the implementation of image data access control.

[0004] The success of deep learning in image content representation brings hope to the research of automatic extraction of image data security attributes, and using deep learning-based image classification, target detection and title generation methods can automatically obtain image content information as security attributes of image data to support access control; but due to the defects of existing deep learning methods, there are two problems in the extraction of image data security attributes based on deep learning: first, the existing attribute structure is simple, lacks sufficient flexibility and dynamic adjustment ability, and is difficult to match the actual application scene. Taking image classification as an example, the setting of each category is mutually exclusive and equal, while there is a complex hierarchical relationship between object categories in real application scenarios. The existing category setting cannot match most actual needs and is only suitable for a few special scenarios. The lack of dynamicity of the attribute structure is due to the limitation of deep learning theory. The existing deep learning method belongs to supervised learning and does not have effective continuous learning ability. Secondly, the training cost of the deep learning model is high, which limits the use of such methods. Deep learning needs a large amount of labeled data support, and data labeling is done manually, which is costly. Another reason for the high training cost is the vulnerability of deep learning algorithms, which is manifested in the lack of domain adaptation and generalization ability. When the use environment changes slightly, a large amount of repeated training is required. SUMMARY

[0005] Therefore, the present application provides an image big data access control method and system based on intelligent extraction of security attributes, which solves the problem of limited image data security attributes in access control implementation, realizes hierarchical dynamic attribute management of big data access control based on image categories, and effectively guarantees big data security.

[0006] According to the design scheme provided by the present application, on the one hand, an image big data access control method based on intelligent extraction of security attributes is provided, which comprises:

[0007] According to the data access control application scene setting, the access control subject attribute and the image data set corresponding to each access control subject are obtained, and the access control strategy of each access user group type and access user role management is set based on the access control subject attribute and the access object attribute;

[0008] Based on the image data set corresponding to each access control subject, a plurality of images are selected from each type of image data set to construct a security attribute knowledge base, and the remaining images in each type of image data set are used as accessible images and an image database is constructed using the accessible images, wherein the security attribute knowledge base includes an attribute structure diagram showing the hierarchical image content attributes and an attribute knowledge base recording the role corresponding to each image category and the group information of the image category according to the attribute structure diagram. The attribute knowledge base includes an image category security attribute table for recording all image roles corresponding to each image category and an image retrieval library for dividing a target image into a corresponding image category to obtain the target image attribute.

[0009] Query and acquire the image data security attribute corresponding to the target access request from the security attribute knowledge base, and acquire the corresponding access control policy based on the acquired image data security attribute, to utilize the access control policy to perform access control on the target access request.

[0010] As the image big data access control method based on intelligent extraction of security attributes of the application, further, the access control subject attribute at least includes access user name attribute, access user group attribute and access user role management attribute.

[0011] As the image big data access control method based on intelligent extraction of security attributes of the application, further, the attribute structure diagram of hierarchical display image content attribute adopts directed acyclic graph, any node in the diagram represents an attribute, the attribute represented by the leaf node is image class, and the attribute represented by other nodes is image role, and the connection mode between nodes is directed from image role to image class or other image role.

[0012] As the image big data access control method based on intelligent extraction of security attributes of the application, further, the attribute structure diagram further contains: using attribute list and adjacency matrix to record attribute structure, so as to process the addition, deletion or connection relationship adjustment of corresponding attribute nodes due to attribute structure change under the condition of big data through attribute list and adjacency matrix.

[0013] As the image big data access control method based on intelligent extraction of security attributes of the application, further, the image database constructed by the accessible image includes image file library and image attribute library, wherein the image file library records the image file data stored in the library, the image attribute library includes vector-ID library composed of image feature vector and corresponding vector ID, ID-path library composed of image ID and image path, and path-attribute library composed of image path and all image attributes, and the vector-ID library and the ID-path library both use data dictionary to store related data object information.

[0014] As the image big data access control method based on intelligent extraction of security attributes of the application, further, the image database is constructed by the accessible image, containing:

[0015] Firstly, the accessible image is taken as a target image, the target image feature vector is extracted and an ID is assigned to the target image feature vector, and the target image related information is stored in the vector-ID library and the ID-path library;

[0016] Then, a plurality of images most similar to the target image are searched in the image retrieval library and the image class attributes of the plurality of images are acquired, and the corresponding attribute set is queried from the image class security attribute table according to the acquired image class attributes;

[0017] Then, the content attribute of the target image is obtained by taking the intersection of the attribute set, the general attribute and the content attribute of the target image are merged, and the related information of the target image is added to the path-attribute library.

[0018] As the image big data access control method based on intelligent extraction of security attributes, further, the security attributes of the image data corresponding to the target access request are queried and obtained from the security attribute knowledge base, including:

[0019] First, the target feature vector of the image corresponding to the target access request is extracted;

[0020] Next, the nearest neighbor vector and the nearest neighbor vector ID are obtained by searching in the vector-ID library according to the target feature vector, and the corresponding target path is obtained by querying in the ID-path library according to the nearest neighbor vector ID.

[0021] Then, the security attributes of the image corresponding to the target access request are obtained in the path-attribute library based on the target path.

[0022] Further, the application also provides an image big data access control system based on intelligent extraction of security attributes, including a policy execution point, a policy decision point, a policy management point and a policy information point, wherein,

[0023] The policy management point obtains the access control subject attributes and the image data sets corresponding to each access control subject according to the data access control application scene setting, sets the access control policy of each access user group type and access user role management based on the access control subject attributes and the access object attributes, and selects a plurality of images from each type of image data set to construct a security attribute knowledge base based on the image data sets corresponding to each access control subject, and uses the remaining images in each type of image data set as accessible images and constructs an image database using the accessible images, wherein the security attribute knowledge base includes an attribute structure diagram showing the hierarchical display of image content attributes and an attribute knowledge base recording the role corresponding to each image class and the group information of the image class according to the attribute structure diagram, and the attribute knowledge base includes an image class security attribute table for recording all image roles corresponding to each image class and an image retrieval library for dividing the target image into the corresponding image class to obtain the attribute of the target image.

[0024] The policy information point queries and obtains the security attributes of the image data corresponding to the target access request from the security attribute knowledge base;

[0025] The policy decision point obtains the corresponding access control policy based on the obtained image data security attributes;

[0026] The policy execution point uses the obtained access control policy to perform access control on the target access request.

[0027] The application has the following advantages:

[0028] The application takes the non-divisible image class in the information system application as the basic granularity, adds various image roles, and constructs a local tree-shaped image content attribute structure; on the basis of the ABAC access control model framework, the vector search engine and the deep neural network model are applied to realize the image big data access control, which can effectively extract and flexibly manage the image attributes, and under the support of high-quality attributes, the access demand of users can be guaranteed and excessive access can be effectively prevented, and the safety of big data is guaranteed. The rationality and reliability of the scheme are verified by the experimental results, and it has high practical deployment significance. BRIEF DESCRIPTION OF DRAWINGS

[0029] Figure 1 An image big data access control framework based on intelligent extraction of security attributes in the embodiment is shown;

[0030] Figure 2 An illustration of different attribute categories in the embodiment is shown;

[0031] Figure 3 An illustration of a local tree-shaped attribute structure in the embodiment is shown;

[0032] Figure 4 An illustration of the principle of image security attribute extraction in the embodiment is shown;

[0033] Figure 5 An illustration of the image security attribute extraction process in the embodiment is shown;

[0034] Figure 6 An illustration of the image security attribute query process in the embodiment is shown;

[0035] Figure 7 An illustration of the big data access control system framework in the embodiment is shown;

[0036] Figure 8 An image class attribute structure in the embodiment is shown;

[0037] Figure 9 An illustration of the image search result in the embodiment is shown;

[0038] Figure 10 An illustration of the accessible range of user Bob in the embodiment is shown. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical scheme and advantages of the application more clear, specific and understandable, the application will be further described in detail below with reference to the drawings and technical scheme.

[0040] With the advent of the digital economy era, big data resources are fully utilized, which can improve production and operation efficiency and create huge social and economic benefits. However, under the condition of big data, data updates and changes are fast, transmission and interaction are frequent, and it is easy to be excessively collected and abused by malicious visitors. Access control is an important method to protect information security, which limits legal users to access system resources within a specified range, and can greatly reduce data abuse caused by excessive access. Image is a typical unstructured data, and the difficulty of image data security attribute extraction and management limits the application of access control in image big data. The existing image attribute extraction method has a single attribute structure setting, which is difficult to meet the needs of practical application. Image retrieval is one of the basic problems of image processing and understanding, and its purpose is to quickly find the most similar image to the test image in the image library of the information system. The existing image retrieval method uses a deep learning model to extract an image feature vector, and converts the search for the most similar image into the search for the nearest neighbor vector. This method performs well in a wide range of scenarios and has strong dynamic adjustment and generalization ability. Using image retrieval to extract image security attributes will help overcome the shortcomings of existing attribute extraction methods and establish a more flexible attribute structure to support security attributes for image big data access control. Therefore, the embodiment of the present application provides an image big data access control method based on intelligent extraction of security attributes, as shown in Figure 1 , which includes the following contents:

[0041] S101, according to the data access control application scenario, the access control subject attribute and the corresponding image data set of each access control subject are obtained, and the access control strategy of each access user group type and access user role management is set based on the access control subject attribute and the access object attribute.

[0042] Among them, according to the specific access control application scenario, the access control subject attribute can be set to include access user name attribute, access user group attribute and access user role management attribute, etc.

[0043] It should be noted that the access control subject attribute can be adjusted by the person skilled in the art according to the actual application scenario, such as setting account name, account ID, account group and account administrator, etc. Information to realize access control in the corresponding scene.

[0044] S102, select a plurality of images from each type of image dataset based on the image dataset corresponding to each access control subject to construct a security attribute knowledge base, and use the remaining images in each type of image dataset as accessible images to construct an image database, wherein the security attribute knowledge base includes an attribute structure diagram showing the hierarchical image content attributes and an attribute knowledge base recording the role corresponding to each image class and the group information of the image class according to the attribute structure diagram, and the attribute knowledge base includes an image class security attribute table for recording all image roles corresponding to each image class and an image retrieval library for dividing target images into corresponding image classes to obtain target image attributes.

[0045] Since the image is stored in the form of a file, the image data has the general properties of a file, such as file type, file creator, creation time, etc., which are referred to as general properties of the image. The image content contains visual semantic information, and recording these semantics in the form of words (strings) forms the content attributes of the image. The content attributes of the image correspond to the subject information in the image and are the main aspect of the security attributes. In order to facilitate analysis and calculation, image processing based on deep learning usually simplifies the attribute structure, such as the COCO and ImageNet datasets in image classification tasks, which only use a two-level tree structure, as shown in Figure 2 , where each category (leaf node) is equal. However, the content attributes of images in reality have complex relationships and exhibit a hierarchical and local tree structure, such as "Sichuan subspecies of giant panda / Qinling subspecies of giant panda - giant panda - Ailuropoda - Ursidae - Mammalia". In order to adapt to various application scenarios of access control, the attribute structure needs to be able to reflect this complexity.

[0046] Specifically, in the embodiments of the present case, the attribute structure diagram showing the hierarchical image content attributes can use a directed acyclic graph, where any node in the graph represents an attribute, the leaf node represents an image class, and the other nodes represent image roles. The connection between nodes is directed from image roles to image classes or other image roles.

[0047] Considering the user access requirements and the capacity and processing power limitations of information systems, it is unnecessary to fully present the structural relationships between all attributes. In the embodiments of the present case, a local tree attribute structure is used, as shown in Figure 3 , which is a directed acyclic graph, where any node in the graph represents an attribute, the leaf node represents an image class (pink node in the graph), and the other attributes are referred to as image roles (blue nodes in the graph). The connection between nodes can only be directed from image roles to image classes or other image roles. An image class represents a certain type of object that cannot be divided in reality. When this type of object needs to be divided into multiple sub-classes in the system, the class is converted into an image role, and each sub-class becomes a new image class.

[0048] In the attribute structure diagram, the attribute structure can be recorded by using the attribute list and the adjacency matrix, so that the addition, deletion or connection relationship adjustment of the corresponding attribute node due to the attribute structure change under the big data condition can be processed through the attribute list and the adjacency matrix.

[0049] The attribute structure is recorded by an attribute list and an adjacency matrix. Since the attribute structure of the image is constantly changing under the big data condition, it involves the addition, deletion and connection relationship change of some attributes in the attribute structure, which can be specifically described as:

[0050] (1) Attribute addition. When the attribute to be added is an image class, a new node can be directly added to the graph. For example, when an image role is added, the sub-nodes of the image role are specified to include which image classes and image roles, the new node is added to the graph and connected according to the corresponding relationship. Adding a new attribute adds a new row and a new column to the adjacency matrix.

[0051] (2) Attribute deletion. The administrator can delete the attribute, that is, delete the corresponding row and column in the adjacency matrix. After deleting a certain attribute node, the indirect connection involved needs to be judged, and the adjacency matrix elements are updated according to the new connection relationship.

[0052] (3) Attribute connection relationship change. When the connection relationship needs to be changed, it is first judged whether a loop will be formed. When the newly added connection will form a loop, the system gives a warning and prevents the connection from being added.

[0053] The image database constructed by using the accessible images includes an image file library and an image attribute library. The image file library records the image file data in the library, the image attribute library includes a vector-ID library composed of image feature vectors and corresponding vector IDs, an ID-path library composed of image IDs and image paths, and a path-attribute library composed of image paths and all attributes of the images, and the vector-ID library and the ID-path library both use data dictionaries to store relevant data object information.

[0054] In order to solve the problem of difficult extraction of image data security attributes, an intelligent extraction method of image data security attributes is proposed based on image retrieval according to the local tree-shaped attribute structure. As shown in Figure 4 The purpose of attribute extraction is to mark the attributes of the image files in the image database, and this process needs to use the image security attribute knowledge base to complete.

[0055] The image class security attribute table in the attribute knowledge base records all image roles corresponding to each image class. The image retrieval library divides all image samples into different groups according to image classes, and when the top(3) retrieval result of the image to be tested belongs to the same group, it is considered that the image to be tested has all the attributes of the image class. When the attribute structure diagram changes, the corresponding information in the attribute knowledge base needs to be modified.

[0056] The image attribute library in the image database is divided into a vector-ID library, an ID-path library and a path-attribute library. The vector-ID library is a feature vector library, each feature vector being obtained from an original image through a feature extraction model. When a vector is stored, a unique ID is assigned. For a given feature vector, the vector-ID library can complete the search of the nearest neighbor vector and return the ID. The ID-path library is a data dictionary, the key name being ID and the key value being the path of the original image. The path-attribute library is also a data dictionary, the key name being the path and the key value being all the attributes of the original image. The image attribute library records the attributes of the images in the image file library and can complete the image attribute query function.

[0057] The image attribute library stores all the attributes of all image data in the image file library. The vector-ID library and the ID-path library are used to complete the conversion from an image to a path in the access request mode of image search. The attributes of a single image data can be stored in the path-attribute library with the path as the key name and the attribute field as the key value. The format of the attribute field is shown in Table 1.

[0058] Table 1 Image attribute field

[0059]

[0060] The attributes Atr(I) of an image I have 14 fields, which are divided into general attributes and content attributes. The general attributes include number, position, file type, creation time, etc. The content attributes include image class and content attribute list. The detailed meanings of the fields are as follows:

[0061] General attributes:

[0062] Number (ID): The number is the uniform identification of an image in the system resource library, which is the same as the number of the feature vector of the image;

[0063] Position (P): The position refers to the storage position of the image in the system;

[0064] Size (S): The size refers to the size of the image file, which is in KB;

[0065] File name (F): The actual file name of the image;

[0066] File type (E): The file type is the extension;

[0067] Creation time (T0): the creation time of the original image;

[0068] Modification time (T1): the last modification time of the image file;

[0069] Access time (T2): the last access time of the image file;

[0070] Width (W): the width of the image file in pixels when displayed;

[0071] Height (H): the height of the image file in pixels when displayed;

[0072] Bit depth (D): the length of binary data contained in each pixel of the image file;

[0073] Resolution (dpi): the number of pixels per inch, here the smaller value of horizontal dpi and vertical dpi is taken;

[0074] Content attribute:

[0075] Image class (C): the basic unit of content attribute, representing images with the same abstract content meaning;

[0076] Content attribute list (A): containing all attributes of the image content, stored in the form of a string list, each item in the list represents an attribute of the content, and the order is not distinguished;

[0077] The storage and retrieval of image attributes are indexed by image paths, and when the image file path changes, the relevant records in the three libraries must be changed. When the attribute structure changes, all attribute records need to be updated.

[0078] In the embodiment, the accessible images are used to construct the image database, which can be designed to contain the following contents:

[0079] First, the accessible image is taken as the target image, the target image feature vector is extracted and assigned an ID, and the target image related information is stored in the vector-ID library and the ID-path library;

[0080] Then, search for several images most similar to the target image in the image retrieval library and obtain the image class attributes of the several images, and query the corresponding attribute set according to the obtained image class attributes in the image class security attribute table;

[0081] Then, the content attributes of the target image are obtained by taking the intersection of the attribute set, the general attributes and content attributes of the target image are merged, and the related information of the target image is added to the path-attribute library.

[0082] Since the image security attributes include general attributes and content attributes, the general attributes are directly read from the image file, such asFigure 5 As shown, the extraction of content attributes involves four steps:

[0083] Step 1: First, use the feature extraction model to convert the input image I into a feature vector F, assign an unused ID, and store the relevant information in the "vector-ID" library and the "ID-path" library;

[0084] Step 2: Search the image retrieval library for the three images I0, I1, and I2 that are most similar to I. The image class attributes of the three images are C0, C1, and C2, respectively.

[0085] Step 3: In order to obtain the complete content attributes of I0, I1, and I2, query the image class security attribute table based on C0, C1, and C2 to obtain three attribute sets A0, A1, and A2;

[0086] Step 4: Calculate the content attribute A of image I by taking the intersection of A0, A1, and A2.

[0087] Finally, general attributes and content attributes were merged and added to the "Path-Attributes" library.

[0088] S103. Query and obtain the security attributes of the image data corresponding to the target access request from the security attribute knowledge base, and obtain the corresponding access control policy based on the obtained image data security attributes, so as to use the access control policy to control the target access request.

[0089] Specifically, querying and retrieving the security attributes of the image data corresponding to the target access request from the security attribute knowledge base can be designed to include the following:

[0090] First, extract the target feature vector of the image corresponding to the target access request;

[0091] Next, based on the target feature vector, the nearest neighbor vector and its ID are retrieved from the vector-ID database, and the corresponding target path is obtained by querying the ID-path database based on the nearest neighbor vector ID.

[0092] Then, based on the target path, the security attributes of the image corresponding to the target access request are obtained from the path-attribute library.

[0093] like Figure 6 As shown, when querying image attributes based on a path, the system directly searches for the attribute corresponding to that path in the "Path-Attribute" library and returns the result. When querying the attribute of the most similar image based on a given image (image search), image retrieval is first performed. That is, the given image I is converted into a feature vector F through a feature extraction model. The nearest neighbor vector F' and its ID are retrieved in the "Vector-ID" library. Then, the path is obtained by querying the "ID-Path" library based on the ID. Finally, the attribute is obtained by querying the "Path-Attribute" library.

[0094] Furthermore, based on the above method, this embodiment of the invention also provides an image big data access control system based on intelligent extraction of security attributes, comprising: policy execution points, policy decision points, policy management points, and policy information points, wherein,

[0095] The policy management point obtains the access control subject attributes and the image datasets corresponding to each access control subject based on the data access control application scenario. Based on the access control subject attributes and access object attributes, it sets access control policies for each access user group type and access user role management. Based on the image datasets corresponding to each access control subject, it selects several images from each type of image dataset to construct a security attribute knowledge base. The remaining images in each type of image dataset are used as accessible images, and an image database is constructed using the accessible images. The security attribute knowledge base includes an attribute structure diagram that displays the image content attributes hierarchically and an attribute knowledge base that records the corresponding roles and group information of each image class according to the attribute structure diagram. The attribute knowledge base includes an image class security attribute table for recording all image roles corresponding to each image class and an image retrieval library for classifying target images into corresponding image classes to obtain target image attributes.

[0096] The strategy information point is to query and obtain the security attributes of the image data corresponding to the target access request from the security attribute knowledge base;

[0097] The policy decision point is to obtain the corresponding access control policy based on the security attributes of the acquired image data.

[0098] The policy enforcement point uses the acquired access control policy to control access to the target access request.

[0099] like Figure 7 The illustrated image big data access control system utilizes the ABAC access control model. The standard ABAC model comprises four main parts: a Policy Enforcement Point (PEP) that accepts user requests and, based on policy matching results, returns the requested resource or denies access; a Policy Decision Point (PDP) that makes an access or denial decision based on the request's attributes and policies; a Policy Administration Point (PAP) that manages all policies; and a Policy Information Point (PIP) that acquires and manages relevant attributes of the subject, environment, and resources. In this embodiment, a security attribute manager is used for image data security attribute extraction, serving as a support for the PIP. Additionally, an image attribute library is established in the image database to record extracted image security attributes and support attribute queries. This system includes attribute extraction and access control implementation for image big data resources.

[0100] For the case that the system can build various models and vector databases, the system code can be written based on Python language during specific design, and learning libraries such as Numpy, OpenCV, Pytorch, Casbin, Milvus and Redis are introduced to complete algorithm implementation. Casbin is used to implement the access control model based on ABAC; Numpy is used to create an adjacency matrix to implement the attribute structure diagram; OpenCV and Pytorch deep learning model library are used to extract image feature vectors, and Milvus and Redis are used to establish an image retrieval library and an image attribute library.

[0101] Casbin is a lightweight open source access control framework that supports RBAC, ABAC and other classic access control schemes, and supports custom access control request formats. The default request format is {subject, object, action}. Casbin supports multi-level role inheritance in RBAC, and resources can also have roles, which is suitable for formulating access control policies based on attribute structure diagrams. In the embodiment, the ABAC access control scheme of Casbin can be used to establish hierarchical roles for image content attributes, and policies can be formulated by managing and referencing image attributes to achieve access control of image big data.

[0102] In the access control framework based on Casbin, the access control request can adopt a four-tuple format: subject (sub), object (obj), environment (envs), and operation (act), which is defined as follows:

[0103] r=sub,obj,envs,act (1)

[0104] The format of the access control policy can be represented as: subject rule (sub_rule), object rule (obj_rule), environment rule (envs_rule), and operation, which is defined as:

[0105] p=sub rule ,obj rule ,envs rule ,act (2)

[0106] The policy matching rule is that the elements of the access request can satisfy all the conditions in a certain policy:

[0107] m=eval(p.sub_rule)&&eval(p.obj_rule)&&eval(p.envs_rule)&&r.act==p.act (3)

[0108] The policy matching success returns "True", otherwise returns "False".

[0109] NumPy (Numerical Python) is an open source numerical computing extension of Python. Its characteristics can be used to store and process large matrices, support large dimension array and matrix operation. Since the attribute structure diagram involves a large number of nodes and connections, in the embodiment of the case, the attribute node information name can be stored by using the list, and the attribute structure diagram can be stored by using the NumPy matrix and related calculation.

[0110] Milvus is an open source vector search engine, which can adopt single node or distributed structure. Milvus supports indexing for large vector sets, realizes the fusion computing of CPU and GPU, and greatly improves the retrieval speed. Milvus uses image installation, and then inserts and searches vectors through Python SDK. Redis is a remote dictionary database, which is an effective supplement to relational databases, stores in the form of key name-key value, supports five types including string, list, hash value, set and ordered set. The data cache of Redis is in the memory, which guarantees the efficiency of query. The system in the embodiment of the case contains image retrieval library and image attribute library, which can adopt the structure of Milvus+Redis, the difference lies in that the original images in the image retrieval library need to be stored according to different image classes, and the image attribute library does not have this requirement; in addition, the image retrieval library can only query the image content attribute, and the image attribute library can query all attributes of the image. When the most similar image retrieval is carried out, the image transformation is first carried out on the image to be tested by using the OpenCV library function, and then the feature vector is extracted through the deep learning model in the Pytorch framework.

[0111] In order to verify the effectiveness of the scheme, the following experimental data are combined to further explain and describe:

[0112] In the experiment, 14 classes of images in Caltech 101 data set are selected. 20 images are taken out from each class of images to build the image security attribute knowledge base, and other images are taken out to build the image database. When the access control test is carried out, the images in the image database are requested to access, and the image path and image search are used to access.

[0113] The image classes are marked with multiple image roles to form an attribute structure diagram as shown in Figure 8As shown, when labeling the attributes of the image class, it can be based on actual needs, such as the attribute of "ant" should be "arthropod"-"insect", but there is no other arthropod in this library and using the "insect" attribute can already meet the access control requirements, so the "arthropod" attribute is omitted. When the object in the image is a composite type, its attribute can be more complex, such as "potted landscape" contains both "plant", "natural object", and "home", "man-made object".

[0114] After establishing the class attribute structure diagram, find all predecessor nodes in the diagram for each image class, and construct a security attribute table as shown in Table 2:

[0115] Table 2 Image class security attribute table

[0116]

[0117] For each image class, a separate folder path is established, and all knowledge base images are stored according to the corresponding image class, and then an image retrieval library with Milvus+Redis structure can be established based on these images to extract the image class attributes of the test image.

[0118] Set the image storage directory name as " / accessed images", and place all accessible images under this directory, establish the vector-ID library, ID-path library and path-attribute library. Use the VGG model in the Pytorch library to extract the feature vectors of all images, store them in the vector-ID library and obtain the ID, write the path information into the ID-path library, extract the image security attributes, and store the corresponding relationship between the path and the attribute in the path-attribute library.

[0119] Suppose the above image data is some online classroom internal data, and the access control subject is set with three attributes, namely name (Name), role (Role), and administrator (Admin). The name attribute is a string type, which is filled in by the user during system registration; the role attribute is a string list, which is automatically assigned by the system according to the courses the user has signed up for; the administrator attribute is a logical value, which is set when the system is created, and other users can be assigned by the administrator to become new administrators. There are three existing users, and their attribute settings are shown in Table 3:

[0120] Table 3 Subject attribute

[0121] Serial Number Name Role Admin 1 Alice Home Design Group False 2 Bob Animals and Plants Interest Group False 3 Kate Home Design Group, Animals and Plants Interest Group True

[0122] According to the subject and object attributes, three access control policies are formulated as shown in Table 4:

[0123] Table 4 Access control policy

[0124]

[0125] Access Control Instance 1:

[0126] Access Method: Access according to image resource path

[0127] User: Alice

[0128] Resource Path: "Visited Image / Home / Furniture / Chair / 1.jpg"

[0129] Environment: Time = 2023.05.10.16:23

[0130] First, query the image attributes, the results are shown in Table 5:

[0131] Table 5 Image Attribute Query Results

[0132]

[0133]

[0134] Build Casbin access request:

[0135] r = "Alice", "Visited Image / Home / Furniture / Chair / 1.jpg", "2023.05.10.16:23", Read

[0136] The access control result is True, allowing access.

[0137] Access Control Instance 2

[0138] Access Method: Image search by image

[0139] User: Bob

[0140] Original image: crab.jpg (crab)

[0141] The most similar image path obtained by image retrieval is: "Visited Image / Animal / Crayfish / crayfish.jpg"

[0142] The image retrieval results are as Figure 9 shown.

[0143] Environment: Time = 2023.05.10.16:24

[0144] Attribute query on the most similar image, the result is: image class = "crayfish", image role = "animal", "natural object";

[0145] Build Casbin access request:

[0146] r = "Bob", "visited image / animal / crayfish / crayfish.jpg", "2023.05.10.16:24", the read access control result is True, and access is allowed.

[0147] Access control instance 3

[0148] User Bob's accessible range analysis:

[0149] According to the second access control policy related to user Bob in Table 4, within the scope of time permission, the object that Bob can access is "natural object", and the image role contains 8 image classes. The other 6 image classes are prohibited access images, and the accessible range is as shown in Figure 10 .

[0150] The above experimental results show that the image big data access control system based on intelligent extraction of security attributes can effectively extract and flexibly manage image attributes. Under the support of high-quality attributes, the access needs of users can be guaranteed and excessive access can be effectively prevented, and the security of big data such as images can be ensured.

[0151] Unless specifically stated otherwise, the relative steps, numerical expressions, and numerical values of the components and steps set forth in these embodiments do not limit the scope of the present application.

[0152] Each embodiment in the specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between each embodiment can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0153] The units and method steps of each example described in combination with the embodiments disclosed herein can be realized in electronic hardware, computer software or a combination of both. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been described in the above description. These functions are executed in hardware or software, depending on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation is not considered beyond the scope of the present application.

[0154] Those skilled in the art can understand that all or part of the steps in the foregoing method can be instructed by programs to the relevant hardware to complete, and the programs can be stored in a computer readable storage medium, such as a read-only memory, a magnetic disk or an optical disk. Alternatively, all or part of the steps of the foregoing embodiments can also be implemented using one or more integrated circuits, and accordingly, each module / unit in the foregoing embodiments can be implemented in the form of hardware or in the form of a software functional module. The present application is not limited to any specific form of combination of hardware and software.

[0155] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present application, which are used to illustrate the technical solutions of the present application, rather than limit the same. The protection scope of the present application is not limited thereto. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can make modifications or easily think of changes to the technical solutions recorded in the foregoing embodiments, or make equivalent replacements to some of the technical features, within the technical scope disclosed by the present application. Such modifications, changes or replacements do not cause the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. An image big data access control method based on intelligent extraction of security attributes, characterized in that, Comprise: According to the data access control application scenario setting, the access control subject attribute and the image data set corresponding to each access control subject are obtained, and the access control policy of each access user group type and access user role management is set based on the access control subject attribute and the access object attribute; Based on the image data set corresponding to each access control subject, a number of images are selected from each type of image data set to construct a security attribute knowledge base, and the remaining images in each type of image data set are used as accessible images to construct an image database, wherein the security attribute knowledge base includes an attribute structure diagram showing the hierarchical image content attributes and an attribute knowledge base recording the role corresponding to each image class and the group information to which the image class belongs according to the attribute structure diagram, the attribute knowledge base includes an image class security attribute table for recording all image roles corresponding to each image class and an image retrieval library for dividing target images into corresponding image classes to obtain target image class attributes, the image database stores accessible original images, and the image retrieval library uses Milvus+Redis structure to store original images in different image classes; The image data security attribute corresponding to the target access request is queried and obtained from the security attribute knowledge base, and the corresponding access control policy is obtained based on the obtained image data security attribute, so as to use the access control policy to control the target access request. 2.The image big data access control method based on intelligent extraction of security attributes according to claim 1, characterized in that, The access control subject attribute at least includes access user name attribute, access user group attribute and access user role management attribute. 3.The image big data access control method based on intelligent extraction of security attributes according to claim 1, characterized in that, The attribute structure diagram showing the hierarchical image content attributes adopts a directed acyclic graph, any node in the graph represents an attribute, the leaf node represents an image class, and the other nodes represent image roles. The connection mode between nodes is directed from image role to image class or other image role. 4.The image big data access control method based on intelligent extraction of security attributes according to claim 1 or 3, characterized in that, The attribute structure diagram also includes: using attribute list and adjacency matrix to record attribute structure, so as to process the addition, deletion or connection relationship adjustment of corresponding attribute nodes due to attribute structure changes under big data conditions through attribute list and adjacency matrix. 5.The image big data access control method based on intelligent extraction of security attributes according to claim 1, characterized in that, The image database constructed by using accessible images includes an image file library and an image attribute library, wherein the image file library records the image file data in the library, the image attribute library includes a vector-ID library composed of image feature vectors and corresponding vector IDs, an ID-path library composed of image IDs and image paths, and a path-attribute library composed of image paths and image all attributes, and the vector-ID library and the ID-path library both use data dictionary to store related data object information. 6.The image big data access control method based on intelligent extraction of security attributes according to claim 1 or 5, characterized in that, Using accessible images to construct an image database includes: First, use the accessible image as a target image, extract the target image feature vector and assign an ID to the target image feature vector, and store the target image related information in the vector-ID library and the ID-path library; Next, search for a number of images similar to the target image in the image retrieval library and obtain the image class attributes of the images, and query the corresponding attribute set in the image class security attribute table according to the obtained image class attributes; Then, the content attribute of the target image is obtained by taking the intersection of the attribute set, the general attribute and the content attribute of the target image are merged, and the related information of the target image is added to the path-attribute library. 7.The image big data access control method based on intelligent extraction of security attributes according to claim 5, characterized in that, The image data security attribute corresponding to the target access request is queried and obtained from the security attribute knowledge base, including: First, the target feature vector of the image corresponding to the target access request is extracted; Next, the nearest neighbor vector and the nearest neighbor vector ID are obtained by searching in the vector-ID library according to the target feature vector, and the corresponding target path is obtained by querying in the ID-path library according to the nearest neighbor vector ID. Then, the security attribute of the image corresponding to the target access request is obtained based on the target path in the path-attribute library.

8. An image big data access control system based on intelligent extraction of security attributes, characterized in that, Including: policy execution point, policy decision point, policy management point and policy information point, wherein, The policy management point obtains the access control subject attribute and the image data set corresponding to each access control subject according to the data access control application scene setting, sets the access control policy of each access user group type and access user role management based on the access control subject attribute and the access object attribute, and selects a number of images from each type of image data set to construct a security attribute knowledge base based on the image data set corresponding to each access control subject, and uses the remaining images in each type of image data set as accessible images and constructs an image database using the accessible images, wherein the security attribute knowledge base includes an attribute structure diagram that hierarchically displays image content attributes and an attribute knowledge base that records the role corresponding to each image class and the group information to which the image class belongs according to the attribute structure diagram, the attribute knowledge base includes an image class security attribute table for recording all image roles corresponding to each image class and an image retrieval library for dividing the target image into the corresponding image class to obtain the target image class attribute, the image database stores accessible original images, and the image retrieval library uses a Milvus+Redis structure to store original images in different image classes; The policy information point queries and obtains the image data security attribute corresponding to the target access request from the security attribute knowledge base; The policy decision point obtains the corresponding access control policy based on the obtained image data security attribute; The policy execution point uses the obtained access control policy to perform access control on the target access request.

9. An electronic device, comprising: It includes: At least one processor, and a memory coupled to the at least one processor; Wherein, the memory stores a computer program, the computer program can be executed by the at least one processor to realize the method of any one of claims 1~7.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, when the computer program is executed, the method of any one of claims 1~7 can be realized.

Images