A natural language access control policy generation method based on large language model

Abstract

The present invention discloses a natural language access control policy generation method based on a large language model, which belongs to the field of access control, including: constructing a knowledge graph for a CSV file uploaded by a user, storing it in a graph database, and allowing the user to select a target service and specify a target access control type; generating an initial natural language access control policy document using a first large language model based on a preset prompt engineering template combination and a LangChain framework; sequentially using a second large language model to eliminate non-natural language access control policy statements, using a third large language model to remove existing duplicate policies, and using a fourth large language model to modify existing conflicting policies to obtain a final natural language access control policy document. The present invention can automatically generate a natural language access control policy that meets the requirements according to the user's security needs and business content, supports rapid changes, and is applicable to different forms of access control policies.

Description

Technical Field

[0001] The invention belongs to the field of access control, and in particular relates to a natural language access control strategy generation method based on a large language model. Background Art

[0002] Access control is an important cornerstone of information security. Its main goal is to ensure that only authorized users can access specific resources to protect sensitive data from leakage or tampering, while effectively preventing internal and external threats. By effectively designing access control policies, not only can regulatory compliance requirements be met, but potential security risks can also be significantly reduced to ensure stable system operation. The core of access control policies is to formulate clear rules and methods to regulate the allocation and management of resource access rights. Common policy types include role-based access control (RBAC), attribute-based access control (ABAC), mandatory access control (MAC), discretionary access control (DAC) and the principle of least privilege. These policies provide effective support for protecting systems and resources in different scenarios.

[0003] The main research of the prior art focuses on how to convert natural language access control policies (NLACPs) into machine-readable access control rules. For example, patent documents with publication numbers CN108701339A and CN117688608A both focus on extracting machine-readable access control policies from natural language policy documents. However, the writing of NLACPs currently mostly relies on manual work. This approach may still meet the needs in the traditional development model, but with the popularization of agile development models and the rapid changes in network services and business requirements, manually writing natural language access control policies has faced many challenges.

[0004] Specifically, business personnel need to quickly write and adjust NLACPs based on dynamically changing security requirements and business scenarios, so that they can be delivered to security engineers in a timely manner to implement updated access control rules. However, the existing process requires managers and related personnel to receive professional training to ensure that they can accurately understand the requirements and write natural language access control policies that meet the specifications. This not only prolongs the time for policy formulation, but also consumes a lot of manpower and resources.

[0005] In addition, in the Internet of Things and large-scale dynamic systems, such as the Internet of Vehicles, access control policies need to frequently adapt to changes in the environment and business needs. The high-frequency adjustment of NLACPs in these environments further increases the difficulty of management and significantly increases the complexity of system maintenance. Therefore, how to efficiently generate natural language access control policies has become an important issue that needs to be solved in the current access control field. Summary of the invention

[0006] In order to solve the above problems existing in the prior art, the present invention provides a method for generating a natural language access control policy based on a large language model. The technical problem to be solved by the present invention is achieved through the following technical solutions:

[0007] A natural language access control policy generation method based on a large language model is applied in the field of Internet of Vehicles. The method includes:

[0008] Receive a CSV file with a preset data structure uploaded by a user, store the CSV file in a graph database by constructing a knowledge graph, and obtain a target service selected by the user from all services in the graph database and a target access control type specified by the user; wherein the CSV file includes company information, department information, employee information, service information, collaboration relationship information, and security requirement information;

[0009] Based on the target service, the target access control type, a preset prompt engineering template combination and a LangChain framework, using a first large language model to generate an initial natural language access control policy document;

[0010] Eliminate non-natural language access control policy statements in the initial natural language access control policy document based on the second large language model to obtain a natural language access control policy document after elimination;

[0011] Using a third large language model to remove duplicate policies in the natural language access control policy document after the elimination process, to obtain a natural language access control policy document after the elimination process;

[0012] The fourth large language model is used to modify the conflicting policies in the natural language access control policy document after the deduplication process to obtain a final natural language access control policy document.

[0013] Beneficial effects of the present invention:

[0014] The natural language access control policy generation method based on a large language model provided in an embodiment of the present invention first constructs a knowledge graph for the CSV file uploaded by the user, stores it in a graph database, and the user selects the target service and specifies the target access control type from it; next, based on the preset prompt engineering template combination and the LangChain framework, the first large language model is used to generate an initial natural language access control policy document; then the second large language model is used in turn to eliminate non-natural language access control policy statements, the third large language model is used to remove existing duplicate policies, and the fourth large language model is used to modify existing conflicting policies to obtain the final natural language access control policy document.

[0015] This method can automatically generate natural language access control policies that meet the requirements according to the user's security needs and business content, support rapid changes, and is applicable to different forms of access control policies, such as role-based access control (RBAC) and attribute-based access control (ABAC). This method can generate natural language access control policies with different control granularities according to different access control types for the field of Internet of Vehicles. It has the advantages of strong adaptability, high efficiency, and high accuracy, making the formulation of access control policies more convenient and effective. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A flowchart of a method for generating a natural language access control policy based on a large language model is provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0017] The present invention is further described in detail below with reference to specific embodiments, but the embodiments of the present invention are not limited thereto.

[0018] In order to effectively solve the problem that it is time-consuming and laborious to manually formulate natural language access control policies in the traditional way, an embodiment of the present invention provides a natural language access control policy generation method based on a large language model, which is applied to the field of Internet of Vehicles, such as Figure 1 As shown, the method may include the following steps:

[0019] S1, receiving a CSV file with a preset data structure uploaded by a user, storing the CSV file in a graph database by constructing a knowledge graph, and obtaining a target service selected by the user from all services in the graph database and a target access control type specified by the user;

[0020] Step S1 can be regarded as the initialization stage, which can be specifically divided into three stages: data uploading, data processing and task selection.

[0021] Data upload refers to receiving a CSV file with a preset data structure uploaded by the user to the background program. In the field of Internet of Vehicles, users can set up personnel for access control in related companies. The CSV file includes company information, department information, employee information, service information, collaborative relationship information, and security requirement information;

[0022] In the embodiment of the present invention, different users can upload CSV files respectively. For each CSV file, the processes S1 to S5 are executed accordingly. The following is an example description using any received CSV file.

[0023] The specific descriptions of each item in the CSV file are as follows:

[0024] 1) The company information includes the company name and company description, and the company description includes the company introduction;

[0025] The data representation form of the company information may be Company {name, description}, wherein Company represents company information, name represents the company name, and description represents the company introduction content.

[0026] 2) The department information includes the department number, department name and department description, and the department description includes the company to which the department belongs, the department's position information and authority description;

[0027] The data representation form of the department information may be Department {id, name, description}, wherein Department represents department information, id represents department number, name represents department name, and description represents department description.

[0028] The department information and the company information are represented by the following relationship:

[0029] Department-[:BELONGS_TO]->Company.

[0030] 3) The employee information includes employee number, employee type and employee description, and the employee description includes the employee's job content and department to which he belongs;

[0031] The data representation form of the employee information may be Member {id, name, description}, wherein Member represents employee information, id represents employee number, name represents employee type, and description represents employee description.

[0032] The employee information and the department to which the employee belongs are represented by the following relationship:

[0033] Member-[:BELONGS_TO]->Department.

[0034] 4) The service information includes the service number, service name and service description. The service description includes the service content, the affiliated company and the partner company;

[0035] The data representation form of the service information may be Service{id, name, description}, wherein Service represents service information, id represents a service number, name represents a service name, and description represents a service description.

[0036] The service association between companies is represented by the following relationship:

[0037] Company-[:Relate_Service]->Service;

[0038] Service-[:Relate_Service]->Company.

[0039] 5) The collaboration relationship information is used to describe the collaboration relationship between departments required for the service;

[0040] The collaboration relationship information is represented by ASSOCIATED_WITH, which is used to describe which departments need to collaborate in the service. Specifically, the collaboration relationship between the service Service and the specified Department is described through the relationship Service-[:ASSOCIATED_WITH]->Department.

[0041] 6) The security requirement information includes the requirement number, requirement name and requirement description. The requirement description includes personal information collection and user authorization, core business data collection rules, data collection security control measures, data sensitivity classification and security measures, and data sharing approval process.

[0042] The data representation of the security requirement information can be Requirement{id, name, description}, where Requirement represents the security requirement information, id represents the requirement number, name represents the requirement name, and description represents the requirement description. Description includes specific requirements such as personal information collection and user authorization, core business data collection rules, data collection security control measures, data sensitivity classification and security measures, and data sharing approval process.

[0043] The relationship between services and security requirement information is expressed by the following relationship:

[0044] Requirement-[:BELONGS_TO]->Service;

[0045] Data processing refers to storing the uploaded CSV files in the data processing task queue. The task queue will process each CSV file in turn. For each CSV file, when processing, the CSV file is constructed into a knowledge graph through the graph database and stored in the graph database.

[0046] A graph database is a database system designed for processing graph-structured data. It can store and manage nodes, edges, and their attributes in a graph. A knowledge graph is a structured data representation that uses nodes (entities) and edges (relationships) to describe and represent various relationships between entities in a specific field. It is constructed from information such as key entities and relationship data in the corresponding field.

[0047] Among them, the neo4j graph database can be used, but is not limited to this.

[0048] In addition, a UUID (Universally Unique Identifier) ​​can be used to generate a unique identifier for the graph database to ensure that the graph database is named uniquely. Among them, UUID is a standardized method for identifying information, which ensures that each generated identifier is unique.

[0049] For task selection, all service names are queried in the newly created graph database for user selection, and the target service selected by the user is received. The target service can be named<Target Service> , which is used to generate the corresponding natural language access control policy. At the same time, the user needs to specify the access control type, such as ABAC (Attribute-Based Access Control), RBAC (Role-Based Access Control), and PBAC (Policy-Based Access Control), and define the corresponding target access control type as <model>.

[0050] S2, based on the target service, the target access control type, the preset prompt engineering template combination and the LangChain framework, using the first large language model to generate an initial natural language access control policy document;

[0051] LangChain is a framework for developing applications driven by large language models (LLMs). Prompt Engineering, also known as contextual prompts, is a method to guide LLM behavior towards a specific result without updating the weights / parameters of the model. Specifically, the prompt engineering is used to design and construct a suitable piece of content as the input of a large language model to guide the large language model to generate output that is more in line with expectations.

[0052] The embodiment of the present invention designs a plurality of prompt engineering templates in advance in combination with appropriate skills selected by professionals, and uses them in combination.

[0053] Step S2 is the generation stage of the initial natural language access control policy, which specifically includes:

[0054] Use the LangChain framework to execute the preset prompt engineering template combination , guiding the first large language model to use the relevant data of the graph database to gradually generate an initial natural language access control policy document that matches the target service and the target access control type, wherein, All are prompt project templates.

[0055] The first large language model refers to a large model that can meet the corresponding input and output.

[0056] In an optional implementation, the preset prompt engineering template combination include That is, the embodiment of the present invention designs 9 prompt engineering templates to form a prompt engineering template combination, and these 9 prompt engineering templates are used for task confirmation, data query, task splitting, task execution generation, statement merging, etc. Through the processing flow of the 9 prompt engineering templates, a natural language access control policy that meets the requirements is gradually generated.

[0057] The following describes the process of using the prompt project template combination.

[0058] ① is a first cognitive confirmation project template, used to confirm whether the first large language model can be used for generating natural language access control policies, and return True or False as a result;

[0059] Cognitive validation at this step is crucial and involves asking the large language model system about its knowledge of a particular concept or term, in order to test whether the system has the basic knowledge to handle the topic in question.

[0060] Example: Hello, do you know what Natural Language Access Control Policies (NLACPs) are? Just answer True or False.

[0061] If it is confirmed that the first large language model can be used for generating natural language access control policies, True is returned; otherwise, False is returned.

[0062] ② Confirm the engineering template for the second cognition, used in Based on the output return result True, confirm whether the first large language model can generate a natural language access control policy for the current company, and return True or False as the result;

[0063] Example: Can you customize NLACPs for customer services in the field of Internet of Vehicles (IoV)? The company will provide you with the corresponding company information, department information, employee information, service information, collaborative relationship information, and security requirement information. Just answer True or False.

[0064] If it is confirmed that the first large language model can generate a natural language access control policy for the current company, True is returned; otherwise, False is returned.

[0065] ③ A role-playing project template for On the basis of outputting the return result True, the first large language model is required to play the role of an experienced natural language access control policy formulation expert, and confirm whether the first large language model can generate a natural language access control policy for the target service specified by the current company, and return True or False as the result;

[0066] Example: OK, let's assume that you are an experienced natural language access control policy formulation expert who has formulated NLACPs for many companies and institutions in the field of Internet of Vehicles.<Company, description> Could you please help this company?<Service{id, name, description}> Do you want to formulate a corresponding natural language access control policy? Just answer True or False.

[0067] in, <company>and<Service{id, name, description}> The CSV file uploaded by the user in S1.

[0068] If it is confirmed that the first large language model can generate a natural language access control policy for the target service specified by the current company, True is returned; otherwise, False is returned.

[0069] Through this role-playing method, the first large language model was guided into a preset professional role, namely an experienced strategy-making expert, which not only improved the professionalism of the conversation, but also tested its ability to provide solutions in specific fields.

[0070] ④ It is a fact-dependent engineering template used in On the basis of outputting the returned result True, clarifying the specific principles and standards that the first large language model follows when generating the natural language access control policy document;

[0071] Example: What was the basis for you to develop the NLACPs document for the company?

[0072] The first large language model will output the basis for formulating the NLACPs document, including consideration of relevant laws and regulations, data protection laws, the company's organizational structure, business needs and goals, etc.

[0073] This step aims to ensure that the first large language model follows established specifications during the formulation of natural language access control policies and avoids deviations from actual needs, thereby reducing the possibility of the model "hallucinations" (i.e., generating untrue or unreasonable content) and improving the credibility and consistency of the policy.

[0074] ⑤ Selecting an engineering template for the model, for selecting a target access control type specified by a user, to ensure that the first large language model strictly follows the target access control type when formulating a natural language access control policy document;

[0075] Example: OK, the company's requirement for the access control model is ABAC (attribute-based access control). When you formulate it, please follow the ABAC model.

[0076] The ABAC here is the user-specified <model>.

[0077] ⑥ is a data query engineering template, which is used to obtain the query information of the target service, including the service information, collaboration relationship information, department information, employee information and security requirement information involved in the target service, and merge the obtained query information into middle;

[0078] Example: Use MATCH (targetService:Service {name: '<Target Service> '}) to obtain the entity information of the service in the current graph data and mark it as targetService. Then, query MATCH(targetService)-[:Relate_Service]->(company:Company), MATCH (targetService)-[:ASSOCIATED_WITH]->(department:Department), MATCH (department)<-[:BELONGS_TO]-(member:Member), and MATCH (targetService)-[:BELONGS_TO]->(requirement:Requirement) to obtain the company information, department information, employee information, security requirements and other data related to targetService.

[0079] This step is to use the first large language model to retrieve relevant data from the graph database.<Target Service> Replace it with the default query statement of the department and personnel corresponding to the data query to obtain <targetservice>Data such as service information, collaboration relationship information, department information, employee information, and security requirement information involved, and merge the obtained results into it.

[0080] ⑦ It is a task decomposition engineering template used to require the first large language model to split the overall generation task according to two task types: process and department, and specify the output format; its purpose is to facilitate LangChain to automatically execute subsequent subtasks;

[0081] Example 1: OK, the current service is <Target Service>. Currently, you are required to decompose this service, and the decomposition types include process task types and department task types. Please select the appropriate decomposition type based on the service information, and the decomposed results need to be output in the form of "Step N: Specific task".

[0082] The specified output format can be expressed as (Step1, Step2, Step3.....) to facilitate LangChain to automatically execute subsequent subtasks; in the process task type, the structure of each line in the output result is <Step N: Specific task>, where the specific tasks are split according to the sequence of task execution; in the department task type, the structure of each line in the output result is <StepN: Specific task>, where the specific tasks are split according to the category relationship of departments;

[0083] Example 2:

[0084] Process type split result: After-sales service task, Step 1, Customer feedback; Step 2, Customer feedback;

[0085] Problem reception; Step 3, Customer confirmation; Step 4, Preliminary diagnosis; Step 5, Problem handling; Step 6, Customer satisfaction evaluation; Step 7, Service summary and archiving.

[0086] Department type split result: Vehicle service task, Step 1, Sales and Marketing Department; Step 2, Research and Development Department; Step 3, Manufacturing and Production Department; Step 4, Administrative Management Department; Step 5, Information Technology Department; Step 6, Finance Department; Step 7, Human Resources Department; Step 8, Legal and Compliance Department.

[0087] This step aims to improve the efficiency of large language models in processing tasks and the quality of generating strategies by systematically decomposing tasks; the first large language model, such as ChatGPT, performs poorly when faced with large and complex tasks; refining tasks can enable the first large language model to focus more on specific details, thereby generating more comprehensive and precise strategies.

[0088] ⑧ A subtask engineering template is provided for executing the subtask asynchronously, and a few-sample prompting technique is used in the subtask strategy generation process to guide the subtask strategy generation process by presenting the selected policy statements related to the target service to the first large language model, and it is noted that the selection of examples depends on the type of the selected model and the granularity of the selected task;

[0089] Example: "Access to sensitive financial reports in the system is allowed only if the user's role is administrator, their work location is headquarters, the current time is within working hours (09:00 to 18:00), and the user's security level is high." This sentence is an attribute-based fine-grained access control (ABAC) natural language access control policy.

[0090] Few-shot technology is also known as Few-shot technology. For details, please refer to the relevant technical understanding.

[0091] ⑨ Merge project template for strategies The decomposed strategies of each small task are integrated into a complete access control policy document as an initial natural language access control policy document; the initial natural language access control policy document contains the initially generated natural language access control policy.

[0092] Example: 1. For process type merging, sort the generated results of the subtasks in descending order according to the Step N number in the subtasks, and merge them; 2. For department type merging, there is no need to sort the subtasks, and the generated results of the subtasks are directly merged.

[0093] The purpose of policy merging in this step is to ensure the consistency and integrity of the entire access control policy document.

[0094] Prompt engineering template combination designed by the embodiment of the present invention It is the only design that uses LLM and effectively generates natural language access control policies. This combination of prompt engineering templates can automatically generate customized natural language access control policies based on user security requirements and business content. In addition, the generation process supports the generation of policies of different granularities, including coarse-grained and fine-grained, to meet different management needs.

[0095] The granularity of a policy refers to the description of the accuracy and control granularity of access rights in the policy.

[0096] Coarse-grained access control policies usually use larger permission units to define access control. It allows fewer conditions and broader access rules, and is suitable for scenarios that require less detail. This type of policy is usually simpler and easier to manage, but less flexible.

[0097] Fine-grained access control policies define the access rights of users, resources, and environments in great detail, covering more control conditions, and usually authorize based on multiple attributes (for example, user's role, location, time, device, operation, etc.). Fine-grained policies provide greater flexibility and higher security, but also increase management complexity.

[0098] An example is as follows:

[0099] Coarse-grained: All administrators have access to all data in the system.

[0100] Fine-grained: Access to sensitive financial reports in the system is allowed only if the user's role is administrator, their work location belongs to the headquarters, the current time is within working hours (09:00 to 18:00), and the user's security level is high.

[0101] At the same time, the prompt engineering template combination is applicable to various forms of access control policies, such as role-based access control (RBAC) and attribute-based access control (ABAC), thus providing comprehensive support in flexibility and practicality.

[0102] S3, based on the second large language model, eliminating non-natural language access control policy statements in the initial natural language access control policy document to obtain a natural language access control policy document after elimination;

[0103] Step S3 can be regarded as a process of generating data set performance detection and processing.

[0104] Since the initial natural language access control policy document generated by S4 may contain natural language access control policies and non-natural language access control policies, in order to extract effective natural language access control policies, it is necessary to first judge the statements of natural language access control policies and non-natural language access control policies.

[0105] As an example, a natural language access control policy is: laboratory technicians can view their own laboratory process priority queue. A non-natural language access control policy is: the user interface should first fill in the filter criteria value from the previously saved filter.

[0106] Specifically, the process of determining the non-natural language access control policy statement in the initial natural language access control policy document includes:

[0107] (1) for each sentence in the initial natural language access control policy document, use the second large language model and the text binary classifier to perform ACP discrimination, and obtain corresponding discrimination results;

[0108] Among them, the second large language model refers to a large model that can distinguish ACP; it adopts adaptive professional prompting techniques and can be pre-selected by professionals.

[0109] ACP discrimination is a technology used to identify whether a sentence is a policy. ACP refers to natural language access control policy. For details, please refer to the relevant technical understanding.

[0110] A text binary classifier refers to a tool based on machine learning or deep learning technology, which is used to classify input text into two categories. The embodiment of the present invention can use any existing text binary classifier. For example, in an optional implementation, the text binary classifier is a text binary classifier based on TextCNN, which is used to judge the effectiveness of natural language access control policies, including convolution layers with three sizes of convolution kernels, the three sizes are 2, 3, and 4 respectively; each convolution kernel is equipped with 100 filters. And top_k_max_pooling (k=1) is used.

[0111] It should be noted that, before using the second large language model for formal identification, the embodiment of the present invention uses the collected natural language access control policy data set as the experimental object to verify the feasibility of the second large language model as an ACP identification tool. And according to the experimental results, the experimental indicators such as Precision, Recall and F1-score are calculated respectively, and compared with the existing ACP identification technology. The results show that the second large language model is capable of ACP identification tasks.

[0112] Moreover, in the experiment of the embodiment of the present invention, the collected natural language access control policy data set is divided into a 70% training set and a 30% test set. The text binary classifier is trained by the training set and tested by the test set. The results show that the text binary classifier can also effectively complete the ACP discrimination task.

[0113] The process of using a large language model and a text binary classifier to perform ACP discrimination on sentences can be understood in conjunction with related technologies and will not be described in detail here.

[0114] (2) The two judgment results are combined through a weighted voting mechanism to obtain the final judgment result of the sentence.

[0115] The present invention evaluates the effectiveness of the generation strategy through the voting mechanism of the text binary classifier and the large language model to ensure the fairness and accuracy of the judgment, thereby screening out the strategy that meets the needs.

[0116] Specifically, the two discrimination results are combined through a weighted voting mechanism to obtain the final discrimination result of the sentence, and the formula used is:

[0117] ;

[0118] Among them, if the final judgment result is yes, it means that the statement is a natural language access control policy statement; if the final judgment result is no, it means that the statement is a non-natural language access control policy statement; and are respectively the discrimination results obtained by performing ACP discrimination on the sentence using the second large language model and the text binary classifier; for The corresponding weights; for The corresponding weights; is a preset threshold; weight and preset threshold can be set as needed.

[0119] From the above formula, it can be seen that if and only if the weighted discrimination result is greater than or equal to the preset threshold When , the algorithm considers the current statement to be a valid natural language access control policy, otherwise it is invalid. Through the above process, valid natural language access control policy statements can be screened out, non-natural language access control policy statements can be deleted, and the natural language access control policy document after elimination processing can be obtained.

[0120] It should be noted that if after judging the statements of the initial natural language access control policy document, it is found that there are no natural language access control policy statements, that is, the document does not contain any access control policies that meet the requirements, then return to step S2 and manually adjust the prompt tips in step S2 for processing again.

[0121] S4, using a third large language model to remove duplicate policies in the natural language access control policy document after the elimination process, to obtain a natural language access control policy document after the elimination process;

[0122] Step S4 can be regarded as a duplicate strategy detection and processing process, the purpose of which is to check whether there are redundant or duplicate strategies to ensure the uniqueness and simplicity of the output.

[0123] The process of determining the duplicate policies in the natural language access control policy document after elimination includes:

[0124] Under the guidance of the prompting technique, the third large language model is used to detect duplicate policies in the natural language access control policy document after the elimination process.

[0125] Specifically, in the process of strategy generation, a complex large task is decomposed into multiple small tasks through task decomposition, and corresponding strategies are generated for each task. However, since each small task may involve similar or overlapping rules in different contexts, it is easy to introduce duplication when merging these small task strategies.

[0126] As an example:

[0127] Statement 1:

[0128] Project managers have access to all market research data and promotional copy related to new model launches to ensure consistent messaging and support launch planning.

[0129] Statement 2:

[0130] Project managers can access all data and promotional materials related to market research for new models during the project launch phase to optimize launch strategies and ensure the effectiveness of marketing.

[0131] Both statements give the project manager the same permissions: access to market research data and promotional materials related to the launch of new models. Statement 1 mentions "information consistency" and "launch plan" in its description, while statement 2 mentions "launch strategy" and "marketing effectiveness", but in essence they both express the same access rights. This duplication of definitions increases the complexity of strategy management and can easily lead to confusion, especially when it may not be clear which strategy is better or more appropriate during actual implementation.

[0132] To solve this problem, an embodiment of the present invention inputs the natural language access control policy document after the elimination process into a third large language model, and under the guidance of prompting skills, the third large language model performs duplicate detection on the input document.

[0133] If there is no duplication, the input document is output as a natural language access control policy document after deduplication processing. Otherwise, under the guidance of prompting skills, the third large language model modifies the policy with duplication and re-executes step S4 to ensure that the modified document does not contain duplicate content; the third large language model refers to a large model that can meet the corresponding input and output and can detect duplication; it uses adaptive professional prompting skills and can be pre-selected by professionals.

[0134] S5, using a fourth large language model to modify the conflicting policies in the natural language access control policy document after the deduplication process, to obtain a final natural language access control policy document.

[0135] Step S5 can be regarded as a policy conflict detection and processing process, which is to perform conflict analysis on the generated policies to discover and resolve possible conflicts between policies.

[0136] The process of determining conflicting policies in the natural language access control policy document after deduplication processing includes:

[0137] Under the guidance of the prompting skills, the fourth large language model is used to detect conflicting policies in the natural language access control policy document after the deduplication process.

[0138] Specifically, in the process of task decomposition and strategy merging, since each small task may propose conflicting strategies for the same topic in different contexts, contradictory content may appear in the final merged strategy document.

[0139] As an example:

[0140] Statement 1: Engineers can access all design documents and market analysis reports related to new models after authorization to support research and development.

[0141] Statement 2: Only project managers can access design documents and market analysis reports related to new models through secure terminals in designated meeting rooms.

[0142] Statement 1 allows authorized engineers to access new vehicle design documents, while statement 2 restricts access to this information to project managers only. This conflict could result in unauthorized engineers accessing sensitive data, thus violating access control rules.

[0143] To solve this problem, an embodiment of the present invention inputs the natural language access control policy document after deduplication processing into a fourth large language model, and under the guidance of prompting skills, the fourth large language model performs contradiction detection on the input document.

[0144] If there is no contradiction, the natural language access control policy document after deduplication processing is output as the final natural language access control policy document; otherwise, under the guidance of the prompting technique, the fourth large language model modifies the conflicting policies; and re-executes step S5 to ensure that there is no conflict in the modified document;

[0145] The fourth large language model refers to a large model that can meet the specific input and output of this step of the embodiment of the present invention; it uses adaptive professional prompting techniques and can be pre-selected by professionals.

[0146] In the embodiment of the present invention, the various large-scale language models used can be selected as needed. For example, the first large-scale language model, the second large-scale language model, the third large-scale language model, and the fourth large-scale language model include the large-scale language model ChatGPT.

[0147] The natural language access control policy generation method based on a large language model provided in an embodiment of the present invention first constructs a knowledge graph for the CSV file uploaded by the user, stores it in a graph database, and the user selects the target service and specifies the target access control type from it; next, based on the preset prompt engineering template combination and the LangChain framework, the first large language model is used to generate an initial natural language access control policy document; then the second large language model is used in turn to eliminate non-natural language access control policy statements, the third large language model is used to remove existing duplicate policies, and the fourth large language model is used to modify existing conflicting policies to obtain the final natural language access control policy document.

[0148] This method can automatically generate natural language access control policies that meet the requirements according to the user's security needs and business content, support rapid changes, and is applicable to different forms of access control policies, such as role-based access control (RBAC) and attribute-based access control (ABAC). This method can generate natural language access control policies with different control granularities according to different access control types for the field of Internet of Vehicles. It has the advantages of strong adaptability, high efficiency, and high accuracy, making the formulation of access control policies more convenient and effective.

[0149] It should be noted that, in the description of the present invention, the terms "first" and "second" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, "plurality" means two or more, unless otherwise clearly and specifically defined.

[0150] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification.

[0151] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.< / targetservice> < / model> < / company> < / model>

Claims

1. A natural language access control policy generation method based on a large language model, characterized in that: Applied in the field of Internet of Vehicles, the method includes: Receive a CSV file with a preset data structure uploaded by a user, store the CSV file in a graph database by constructing a knowledge graph, and obtain a target service selected by the user from all services in the graph database and a target access control type specified by the user; wherein the CSV file includes company information, department information, employee information, service information, collaboration relationship information, and security requirement information; Based on the target service, the target access control type, the preset prompt engineering template combination and the LangChain framework, using the first large language model to generate an initial natural language access control policy document; Based on the second large language model, non-natural language access control policy statements in the initial natural language access control policy document are eliminated to obtain a natural language access control policy document after the elimination process; wherein, the judgment process of the non-natural language access control policy statements in the initial natural language access control policy document includes: for each statement in the initial natural language access control policy document, using the second large language model and the text binary classifier to perform ACP judgment respectively to obtain the corresponding judgment result; and combining the two judgment results through a weighted voting mechanism to obtain the final judgment result of the statement; Using a third large language model to remove duplicate policies in the natural language access control policy document after the elimination process, to obtain a natural language access control policy document after the elimination process; The fourth large language model is used to modify the conflicting policies in the natural language access control policy document after the deduplication process to obtain a final natural language access control policy document.

2. The method for generating a natural language access control policy based on a large language model according to claim 1, characterized in that: In the CSV file, The company information includes the company name and company description, and the company description includes the company introduction content; The department information includes department number, department name and department description, and the department description includes the company to which the department belongs, the department's position information and authority description; The employee information includes employee number, employee type and employee description, and the employee description includes the employee's job content and department to which he belongs; The service information includes the service number, service name and service description, and the service description includes the service content, the affiliated company and the partner company; The collaboration relationship information is used to describe the collaboration relationship between departments required for the service; The security requirement information includes the requirement number, requirement name and requirement description. The requirement description includes personal information collection and user authorization, core business data collection rules, data collection security control measures, data sensitivity classification and security measures, and data sharing approval process.

3. The method for generating a natural language access control policy based on a large language model according to claim 2, characterized in that: Based on the target service, the target access control type, the preset prompt engineering template combination and the LangChain framework, an initial natural language access control policy document is generated using a first large language model, including: Use the LangChain framework to execute the preset prompt engineering template combination , guiding the first large language model to use the relevant data of the graph database to gradually generate an initial natural language access control policy document that matches the target service and the target access control type; wherein, All are prompt project templates.

4. The method for generating a natural language access control policy based on a large language model according to claim 3 is characterized in that: The preset prompt project template combination include ;in, is a first cognitive confirmation project template, used to confirm whether the first large language model can be used for generating natural language access control policies, and return True or False as a result; Confirm the engineering template for the second cognition, used in Based on the output return result True, confirm whether the first large language model can generate a natural language access control policy for the current company, and return True or False as the result; A role-playing project template for On the basis of outputting the return result True, the first large language model is required to play the role of an experienced natural language access control policy formulation expert, and confirm whether the first large language model can generate a natural language access control policy for the target service specified by the current company, and return True or False as the result; It is a fact-dependent engineering template used in On the basis of outputting the returned result True, clarifying the specific principles and standards that the first large language model follows when generating the natural language access control policy document; Selecting an engineering template for the model, for selecting a target access control type specified by a user, to ensure that the first large language model strictly follows the target access control type when formulating a natural language access control policy document; is a data query engineering template, which is used to obtain the query information of the target service, including the service information, collaboration relationship information, department information, employee information and security requirement information involved in the target service, and merge the obtained query information into middle; It is a task decomposition project template, which is used to require the first large language model to split the overall generation task into two task types: process and department, and specify the output format so that LangChain can automatically execute subsequent subtasks; An execution subtask engineering template is used to asynchronously execute subtasks, and a few-sample prompting technique is used in the subtask strategy generation process to guide the subtask strategy generation process by presenting the selected policy statements related to the target service to the first large language model; Merge project template for strategies The decomposed strategies of each small task are integrated into a complete access control policy document as an initial natural language access control policy document; the initial natural language access control policy document contains the initially generated natural language access control policy.

5. The method for generating a natural language access control policy based on a large language model according to claim 1, characterized in that: The two discrimination results are combined through the weighted voting mechanism to obtain the final discrimination result of the sentence. The formula used is: ； Among them, if the final judgment result is yes, it means that the statement is a natural language access control policy statement; if the final judgment result is no, it means that the statement is a non-natural language access control policy statement; and are respectively the discrimination results obtained by performing ACP discrimination on the sentence using the second large language model and the text binary classifier; for The corresponding weights; for The corresponding weights; is the preset threshold.

6. The method for generating a natural language access control policy based on a large language model according to claim 1, characterized in that: The text binary classifier is a text binary classifier based on TextCNN, including convolution layers with convolution kernels of three sizes, which are 2, 3, and 4 respectively; each convolution kernel is equipped with 100 filters.

7. The method for generating a natural language access control policy based on a large language model according to claim 1, characterized in that: The process of determining duplicate policies in the natural language access control policy document after elimination processing includes: Under the guidance of the prompting technique, the third large language model is used to detect duplicate policies in the natural language access control policy document after the elimination process.

8. The method for generating a natural language access control policy based on a large language model according to claim 1, characterized in that: The process of determining conflicting policies in the natural language access control policy document after deduplication processing includes: Under the guidance of the prompting skills, the fourth large language model is used to detect conflicting policies in the natural language access control policy document after the deduplication process.

9. The method for generating a natural language access control policy based on a large language model according to claim 1, characterized in that: The first large-scale language model, the second large-scale language model, the third large-scale language model, and the fourth large-scale language model include a large-scale language model ChatGPT.

Images