Document content access authority control method and system

Abstract

The invention is suitable for the technical field of document access, and provides a document content access authority control method and system, and the method comprises the steps: carrying out the semantic learning of a to-be-accessed document when the to-be-accessed document uploaded by a document owner is received, and generating a plurality of document elements; determining a hierarchical relationship and a sequence of a plurality of document elements, and constructing an access control list; when an access instruction of a to-be-accessed document is received, obtaining identification information of an access user; judging whether the identification information of the access user exists in the access control list or not, and if yes, determining a target document element which can be accessed by the access user through the access control list; generating a target access document according to the target document element; and when the access user successfully decrypts the target access document, outputting the target access document, so that the access user can edit the target access document. According to the invention, the access authority is set for the elements of the document, so that the document is finely managed.

Description

Technical Field

[0001] The present invention relates to the technical field of document access, and in particular to a method and system for controlling access rights of document content. Background Art

[0002] At present, electronic document file permission control is widely adopted in various fields. In electronic document management systems, role-based access control and access control list (ACL) technology are commonly used to ensure that users can manage file permissions. Cloud storage services provide a variety of sharing options and encryption technologies to ensure the security of data transmission and storage. At the same time, content management systems and collaboration platforms support workspace permission settings, allowing different teams to assign permissions and manage versions to ensure the effectiveness of collaboration. In email systems, email permissions are set and encryption technology is used to ensure the confidentiality and secure transmission of email content. However, the permission control for current documents is only at the file level, and generally two situations are set: one is that the entire file is allowed to be accessed, and the other is that the entire file is not allowed to be accessed. The level at which the access to part of the file content can be controlled separately is not reached. In this way, under the condition that the sensitive information of the file is protected safely, some content that does not need to be protected cannot be made public and shared, which will result in a lack of refinement in electronic document management. Summary of the invention

[0003] The embodiments of the present application provide a method and system for controlling access rights to document content, which are used to solve the problem of low level of refinement in document management.

[0004] A first aspect of an embodiment of the present application provides a method for controlling access rights to document content, including:

[0005] When receiving a document to be accessed uploaded by a document owner user, semantic learning is performed on the document to be accessed based on natural language processing technology to generate a number of document elements;

[0006] Determining a hierarchical relationship and an order of a plurality of document elements according to the plurality of document elements, and constructing an access control list based on the plurality of document elements and the hierarchical relationship and the order of the plurality of document elements;

[0007] When receiving an access instruction for the document to be accessed, obtaining identification information of the accessing user;

[0008] Determining whether the identification information of the access user exists in the access control list, and if so, determining the target document element that the access user can access through the access control list;

[0009] Generate a target access document according to the target document element;

[0010] When the access user successfully decrypts the target access document, the target access document is output, so that the access user can edit the target access document.

[0011] Furthermore, the semantic learning of the document to be accessed is performed based on natural language processing technology to generate a number of document elements, including:

[0012] Performing data preprocessing on the document to be accessed, and performing word segmentation processing on the preprocessed text;

[0013] Use the deep learning model to perform semantic learning on the text after word segmentation and determine the feature information;

[0014] A plurality of document elements are generated based on the characteristic information.

[0015] Furthermore, the constructing an access control list based on the plurality of document elements and the hierarchical relationship and sequence of the plurality of document elements includes:

[0016] Generate a document element relational database based on the plurality of document elements and the hierarchical relationship and sequence of the plurality of document elements;

[0017] Acquire an access user sequence configured by a document manager, wherein the access user sequence includes an identification type corresponding to identification information of the access user;

[0018] An access control list is constructed according to the document element relational database and the access user sequence.

[0019] Furthermore, the determining whether the identification information of the access user exists in the access control list includes:

[0020] The identification type of the access user is determined according to the identification information of the access user, and it is judged whether the access user sequence in the access control list contains the identification information of the access user.

[0021] Furthermore, the determining, through the access control list, the target document element that the access user can access includes:

[0022] The document element identifiers matched by the accessing user are sequentially screened through the access control list, wherein the document element identifiers are constructed according to document elements, and one document element corresponds to one document element identifier;

[0023] The filtered document element identifiers are marked and stored.

[0024] Furthermore, generating a target access document according to the target document element includes:

[0025] Determine the number of target document elements and the hierarchical relationship and order between the target document elements;

[0026] A target access document is generated according to the hierarchical relationship and sequence between the target document elements.

[0027] Furthermore, when the access user successfully decrypts the target access document, before outputting the target access document so that the access user can edit the target access document, the method further includes:

[0028] A corresponding access type is determined based on the target document element, where the access type includes viewing, modifying, and deleting.

[0029] A second aspect of an embodiment of the present application provides a document content access rights control system, including:

[0030] A document element generating unit, configured to, when receiving a document to be accessed uploaded by a document owner user, perform semantic learning on the document to be accessed based on natural language processing technology to generate a plurality of document elements;

[0031] an access control list construction unit, configured to determine a hierarchical relationship and an order of a plurality of document elements according to the plurality of document elements, and to construct an access control list based on the plurality of document elements and the hierarchical relationship and the order of the plurality of document elements;

[0032] An access user identification information acquisition unit, configured to acquire the access user identification information when receiving an access instruction for the document to be accessed;

[0033] An access user identification information determination unit, used to determine whether the access user identification information exists in the access control list;

[0034] a target document element determining unit, configured to determine the target document element accessible to the access user through the access control list when the access user's identification information exists in the access control list;

[0035] A target access document generating unit, used for generating a target access document according to the target document element;

[0036] The target access document output unit is used to output the target access document when the access user successfully decrypts the target access document, so that the access user can edit the target access document.

[0037] A third aspect of the embodiments of the present application provides a computer device, including:

[0038] memories, transceivers, processors, and bus systems;

[0039] Wherein, the memory is used to store programs;

[0040] The processor is used to execute the program in the memory, including executing the methods of the above aspects;

[0041] The bus system is used to connect the memory and the processor so that the memory and the processor can communicate with each other.

[0042] A fourth aspect of an embodiment of the present application provides a computer-readable storage medium, comprising instructions, which, when executed on a computer, enables the computer to execute the methods provided in the above aspects.

[0043] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages:

[0044] This application first performs semantic learning on the document to obtain multiple document elements after the document owner uploads the document, determines the hierarchical relationship and order of the document elements based on the document elements, and then constructs an access control list based on the document elements and their hierarchical relationship and order; when receiving the access instruction of the document, obtains the identification information of the access user, determines whether the user has the authority to access the document, and further determines which specific document elements in the document the user has the authority to access, and then combines the document elements with access rights to generate the target access document, and finally outputs the target access document to the user for editing. This application splits the document into multiple document elements through natural language processing technology, and then sets access rights for the document elements separately, so that while encrypting the data of the entire document level, it can share or re-encrypt some elements of the document, realizing more sophisticated permission management and data protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 A schematic diagram of an embodiment of a method for controlling access rights to document content in the present invention;

[0046] Figure 2 It is a relational table database diagram in the present invention;

[0047] Figure 3 A matching relationship diagram between access users and document elements in the present invention;

[0048] Figure 4 This is a structural block diagram of an embodiment of a document content access rights control system in the present invention;

[0049] Figure 5 The figure is a structural block diagram of a computer device in the present invention. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0051] The access control method for document content in this embodiment is used to perform more sophisticated management and data protection on the document. The implementation method in this embodiment can be implemented in the system, can be implemented in the server, and can also be implemented in the terminal, and the specific details are not clearly limited.

[0052] Embodiment 1

[0053] See also Figure 1 An embodiment of a method for controlling access rights of document content in the present invention comprises the following steps:

[0054] S11. When receiving a document to be accessed uploaded by a document-owning user, semantic learning of the document to be accessed is performed based on natural language processing technology to generate several document elements; the system connects and manages the document-owning user, document management user and document access user. The document-owning user uploads the document to the system, the document management user can set the people who can edit the document in the system, and the document access user needs to have permission to edit the document.

[0055] In this embodiment, semantic learning is performed on the accessed document based on natural language processing technology to generate a plurality of document elements, and the following steps are also included:

[0056] 1. Perform data preprocessing on the documents to be accessed and perform word segmentation on the preprocessed text;

[0057] Data preprocessing is to clean the original documents to be accessed, including removing irrelevant punctuation marks, special characters, and cleaning up repeated and meaningless texts, etc. Word segmentation is to divide continuous text into independent vocabulary units.

[0058] 2. Use the deep learning model to perform semantic learning on the text after word segmentation and determine the feature information;

[0059] 3. Generate several document elements based on the feature information.

[0060] Here, we use deep learning and other technologies to perform semantic learning on the text that has been segmented. The training model is usually based on a large-scale corpus to learn the lexical, syntactic, semantic and other information in the text. During the training process, the model can learn the contextual relationship between words and their meaning in sentences or paragraphs. Through semantic learning, key information in the document, such as topics, entities, emotions, etc., is extracted. These features will be used for subsequent document element generation. Based on the extracted features, several document elements are generated. These elements can be keywords, topic classifications, entity relationships, etc. For example, for a review document about a product, elements about topics such as product name, function, advantages and disadvantages can be generated.

[0061] In addition, after generating several document elements, the generated document elements are optimized using machine learning algorithms to improve the accuracy and relevance between elements. This process can be achieved by adjusting model parameters, introducing external knowledge, etc. For the optimized results, the document elements are screened and sorted, and the most relevant and representative elements to the document topic are screened and sorted by importance. This sorting serves as the basis for the subsequent construction of the access control list. Subsequent access to the document element also sets the corresponding access rules according to the sorting.

[0062] Several document elements here can be output in appropriate forms, such as text files, databases, etc. These elements can be used for subsequent tasks such as text analysis, information extraction, question-answering systems, etc. Various applications can also be further developed, such as intelligent question-answering systems, text summary generation, sentiment analysis, etc. These applications can enrich people's daily lives and working methods.

[0063] S12. Determine the hierarchical relationship and order of several document elements according to several document elements, and construct an access control list based on the hierarchical relationship and order of several document elements and several document elements;

[0064] In this embodiment, constructing an access control list includes the following steps:

[0065] 1. Generate a document element relational database based on a number of document elements and the hierarchical relationship and order of a number of document elements;

[0066] 2. Obtain the access user sequence configured by the document manager, where the access user sequence includes the identification type corresponding to the identification information of the access user;

[0067] 3. Construct an access control list based on the document element relational database and the access user sequence.

[0068] Specifically, natural language processing technology splits the document content and then screens the hierarchical relationship and order of document elements to generate a relational database. The order here is based on the relevance of the above elements and the order of importance, such as Figure 2 As shown in the table, relational databases are used to store the relationships between elements.

[0069] When configuring the access user sequence, the document manager can group users and set batch authorization. For example, the user can be grouped according to mobile phone number, region, age, etc. After grouping, a user sequence is generated, where mobile phone number, region, age, etc. are identification types. Setting batch authorization of sequences can effectively improve the efficiency of document managers in configuring permissions.

[0070] Finally, an access control list is constructed based on the relational database and the set access user sequence.

[0071] S13. When receiving an access instruction for a document to be accessed, obtaining identification information of the accessing user;

[0072] S14. Determine whether there is identification information of the access user in the access control list,

[0073] S15. When the access control list contains identification information of the access user, the target document element that the access user can access is determined through the access control list;

[0074] When receiving a document access instruction, the system first obtains the identification information of the accessing user, and then determines whether the identification information exists in the access control list, specifically including:

[0075] The identification type of the access user is determined according to the identification information of the access user, and it is determined whether the access user sequence in the access control list contains the identification information of the access user.

[0076] Specifically, first determine the identification type of the accessing user. For example, if it is detected that the user's region is Beijing, then match whether the region sequence contains Beijing. If so, it means that the user can access the document content, and then further determine which elements of the document the user can access.

[0077] The target document elements that can be accessed by the access control list include:

[0078] 1. The document element identifiers matching the accessing user are screened in turn through the access control list. The document element identifiers are constructed based on the document elements. One document element corresponds to one document element identifier.

[0079] 2. Label and store the filtered document element identifiers.

[0080] Specifically, after natural language processing technology splits the document content, it is necessary to assign a unique identifier to each document element fragment, that is, one document element corresponds to one document element identifier, and their relationship is stored in the system. Figure 3The relationship table in the document includes fields such as document element identifier, type, metadata, and data. When determining the access rights of the access user, it is necessary to filter out the element identifiers that match each other in the access control list.

[0081] S16. Generate a target access document based on the target document element;

[0082] In this embodiment, generating a target access document includes:

[0083] 1. Determine the number of target document elements and the hierarchical relationship and order between the target document elements;

[0084] 2. Generate a target access document based on the hierarchical relationship and order between the target document elements.

[0085] After determining the number of document elements with access rights and the hierarchical relationship and order between the elements, the system calls NLP to process the document and the permission control requirements, and reassembles the document content. For example, in "Farewell to Meng Haoran at the Yellow Crane Tower", the old friend bids farewell to the Yellow Crane Tower and goes to Yangzhou in March. The user has access rights to this part of the content. If the document is split into four elements, two of them will be merged to obtain the target access document.

[0086] S17. Determine the corresponding access type based on the target document element, the access type includes viewing, modifying and deleting;

[0087] S18. When the access user successfully decrypts the target access document, the target access document is output, so that the access user can edit the target access document.

[0088] After determining the accessible document content as above, determine the types of access that can be made, including viewing, modification, and deletion. In addition, in order to prevent the accessing user from directly obtaining the document content and leaking it to the outside, a layer of encryption technology is set up for protection. An asymmetric encryption algorithm is used to generate a pair of encryption and decryption keys, namely a public key and a private key, where the private key is used to encrypt data and the public key is used to decrypt data. The system will generate a pair of keys for each accessing user. The private key is saved in the system and the public key is issued to the user. Before a document is opened and displayed to the user, it will be encrypted with the user's private key, and then the user will be prompted to enter the public key for decryption before access. When the decryption is successful, the system automatically pops up the document content, and the accessing user can view, modify or delete the document.

[0089] During the process of accessing users to edit documents, the system also has an audit mechanism to record the user's operation records on sentences or paragraphs, and regularly audit and adjust the permission settings to ensure the security and confidentiality of document information. Configure the audit log recording system to monitor and record the user's operation behavior on sentences or paragraphs. Regularly audit the access permission settings, check and adjust user permissions, and update the access control list to ensure the effectiveness and compliance of permission control.

[0090] Embodiment 2

[0091] See also Figure 4 An embodiment of a document content access rights control system of the present invention includes the following steps:

[0092] The document element generating unit 101 is used to generate a plurality of document elements by performing semantic learning on the document to be accessed based on the natural language processing technology when receiving the document to be accessed uploaded by the document owner user;

[0093] The access control list construction unit 102 is used to determine the hierarchical relationship and order of the plurality of document elements according to the plurality of document elements, and to construct an access control list based on the plurality of document elements and the hierarchical relationship and order of the plurality of document elements;

[0094] The access user identification information acquisition unit 103 is used to acquire the access user identification information when receiving an access instruction for a document to be accessed;

[0095] The access user identification information determination unit 104 is used to determine whether the access user identification information exists in the access control list;

[0096] A target document element determination unit 105, configured to determine the target document element accessible to the access user through the access control list when there is identification information of the access user in the access control list;

[0097] A target access document generating unit 106, configured to generate a target access document according to the target document elements;

[0098] The target access document output unit 107 is used to output the target access document when the access user successfully decrypts the target access document, so that the access user can edit the target access document.

[0099] For the specific definition of the system, please refer to the definition of the method above, which will not be repeated here. Each module in the above system can be implemented in whole or in part by software, hardware and a combination thereof. The above modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0100] Embodiment 3

[0101] See also Figure 5 , the present invention provides a computer device, including a memory, a transceiver, a processor and a bus system;

[0102] Wherein, the memory is used to store programs;

[0103] The processor is used to execute the program in the memory, including executing the above method;

[0104] The bus system is used to connect the memory and the processor so that the memory and the processor can communicate with each other.

[0105] Those of ordinary skill in the art will appreciate that the units of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition of each example has been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0106] In the embodiments provided by the present invention, it should be understood that the division of units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units can be combined into one unit, one unit can be split into multiple units, or some features can be ignored. In addition, each functional unit in each embodiment of the present invention can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units.

[0107] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-0nlyMemory), random access memory (RAM, RandomAccessMemory), mobile hard disk, magnetic disk or optical disk, etc., which can store program code.

[0108] It can be understood that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or replace some or all of the technical features therein by equivalents. These modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be included in the scope of the claims and specification of the present invention.

Claims

1. A method for controlling access rights of document content, characterized in that: include: When receiving a document to be accessed uploaded by a document owner user, semantic learning is performed on the document to be accessed based on natural language processing technology to generate a number of document elements; Determining a hierarchical relationship and an order of a plurality of document elements according to the plurality of document elements, and constructing an access control list based on the plurality of document elements and the hierarchical relationship and the order of the plurality of document elements; When receiving an access instruction for the document to be accessed, obtaining identification information of the accessing user; Determining whether the identification information of the access user exists in the access control list, and if so, determining the target document element that the access user can access through the access control list; Generate a target access document according to the target document element; When the access user successfully decrypts the target access document, the target access document is output, so that the access user can edit the target access document.

2. The method for controlling access rights of document content according to claim 1, characterized in that: The method of performing semantic learning on the document to be accessed based on natural language processing technology to generate a plurality of document elements includes: Performing data preprocessing on the document to be accessed, and performing word segmentation processing on the preprocessed text; Use the deep learning model to perform semantic learning on the text after word segmentation and determine the feature information; A plurality of document elements are generated based on the characteristic information.

3. The method for controlling access rights of document content according to claim 1, characterized in that: The constructing an access control list based on the plurality of document elements and the hierarchical relationship and sequence of the plurality of document elements comprises: Generate a document element relational database based on the plurality of document elements and the hierarchical relationship and sequence of the plurality of document elements; Acquire an access user sequence configured by a document manager, wherein the access user sequence includes an identification type corresponding to identification information of the access user; An access control list is constructed according to the document element relational database and the access user sequence.

4. The method for controlling access rights of document content according to claim 3, characterized in that: The determining whether the identification information of the access user exists in the access control list includes: The identification type of the access user is determined according to the identification information of the access user, and it is judged whether the access user sequence in the access control list contains the identification information of the access user.

5. The method for controlling access rights of document content according to claim 4, characterized in that: Determining the target document element accessible to the access user through the access control list includes: The document element identifiers matched by the accessing user are sequentially screened through the access control list, wherein the document element identifiers are constructed according to document elements, and one document element corresponds to one document element identifier; The filtered document element identifiers are marked and stored.

6. The method for controlling access rights of document content according to claim 5, characterized in that: The step of generating a target access document according to the target document element comprises: Determine the number of target document elements and the hierarchical relationship and order between the target document elements; A target access document is generated according to the hierarchical relationship and sequence between the target document elements.

7. The document content access rights control method according to claim 1, characterized in that: When the access user successfully decrypts the target access document, before outputting the target access document so that the access user can edit the target access document, the method further includes: A corresponding access type is determined based on the target document element, where the access type includes viewing, modifying, and deleting.

8. A document content access rights control system, characterized in that: include: A document element generating unit, configured to, when receiving a document to be accessed uploaded by a document owner user, perform semantic learning on the document to be accessed based on natural language processing technology to generate a plurality of document elements; an access control list construction unit, configured to determine a hierarchical relationship and an order of a plurality of document elements according to the plurality of document elements, and to construct an access control list based on the plurality of document elements and the hierarchical relationship and the order of the plurality of document elements; An access user identification information acquisition unit, configured to acquire the access user identification information when receiving an access instruction for the document to be accessed; An access user identification information determination unit, used to determine whether the access user identification information exists in the access control list; a target document element determining unit, configured to determine the target document element accessible to the access user through the access control list when the access user's identification information exists in the access control list; A target access document generating unit, used for generating a target access document according to the target document element; The target access document output unit is used to output the target access document when the access user successfully decrypts the target access document, so that the access user can edit the target access document.

9. A computer device, characterized in that: include: memories, transceivers, processors, and bus systems; Wherein, the memory is used to store programs; The processor is used to execute the program in the memory, including executing the access permission control method for document content according to any one of claims 1 to 7; The bus system is used to connect the memory and the processor so that the memory and the processor can communicate with each other.

10. A readable storage medium, characterized in that: The method comprises instructions, which, when executed on a computer, enable the computer to execute the method for controlling access rights to document contents as claimed in any one of claims 1 to 7.

Images