Electrical equipment supply chain data security access method and system

Abstract

The invention relates to the technical field of data sharing, and particularly discloses an electrical equipment supply chain data security access method and system, and the system can intelligently match table structure information in a power industry database based on natural language input of a user, and generates a corresponding SQL query. By combining a natural language processing technology with a large language model, a user can easily access and query required power industry data under the condition that a complex SQL statement or a database structure does not need to be mastered. According to the method, the efficient query task can be automatically generated, the data access difficulty is greatly reduced, meanwhile, a data field level encryption scheme and a user permission intelligent verification mechanism are designed, and the safety of the data access sharing process is ensured; and the method has good expansibility and can be compatible with power enterprise databases of different scales.

Description

Technical Field

[0001] The present invention relates to the technical field of data sharing, and in particular to a method and system for secure access to data in a supply chain of electrical equipment. Background Art

[0002] Power grid companies have accumulated a large amount of historical data on procurement, logistics, inventory and suppliers in the long-term operation of their electrical equipment supply chain. However, due to the lack of efficient and secure data access and sharing mechanisms, the potential value of these data has not been fully explored. With the rapid development of artificial intelligence and natural language processing technology, some existing tools (such as Chat2DB) can automatically convert natural language questions into SQL query statements to help users extract information from databases. However, when these tools process complex supply chain data in the electrical industry, they still have problems such as low accuracy of natural language matching data tables, low data access efficiency, and lack of security control. In particular, when opening data access to external suppliers, the secure sharing of sensitive data cannot be guaranteed. Therefore, the existing technology urgently needs an efficient, secure and intelligent supply chain data sharing solution to solve the problem that the intelligent agent's intention understanding is not deep enough in the complex business logic and the difficulty in identifying professional terms in specific fields. At the same time, it solves the problems of low matching accuracy, low query efficiency and insufficient security of the generated database table. Summary of the invention

[0003] The purpose of the present invention is to provide a method and system for secure access to data in the electric equipment supply chain, which realizes efficient and secure access to the electric power industry database through natural language processing and metadata indexing technology. To achieve the above-mentioned purpose of the invention, the technical solution used by the present invention is as follows:

[0004] In one aspect, the present invention provides a method for securely accessing data in an electrical equipment supply chain, comprising the following steps:

[0005] S11, receiving a query requirement input by a user in natural language;

[0006] S12, matching the table and field information related to the query requirement input by the user, and extracting the structural information of the related table from the database metadata;

[0007] S13, verifying whether the user has the authority to access the queried data;

[0008] S14. Automatically generate a logical SQL query statement based on the user's query requirements and the matched table structure information;

[0009] S15, execute the generated SQL query statement, access the database and return the query result;

[0010] S16. Desensitize sensitive data in the query results;

[0011] S17: Return the desensitized query results to the user and perform intelligent analysis on the query results.

[0012] Preferably, the structural information of the table includes table name, field name, field type, primary and foreign key relationships, etc.

[0013] Preferably, the step S13 specifically includes the following steps:

[0014] S1301, extracting user identity information and role attributes, parsing query intent and target data table, and obtaining historical access behavior data;

[0015] S1302, analyzing query semantics and extracting core scenario features; evaluating the relevance between the query scenario and the user role; and calculating the field coverage rate;

[0016] S1303. Check RBAC and ABAC rules, calculate scenario risk scores, and integrate multi-dimensional assessment results to obtain the final authority score;

[0017] S1304. Determine the user authority according to the final authority score. If the authority is granted, record the access log and enter the query execution phase. If the authority is denied, generate a friendly prompt and provide alternative suggestions.

[0018] Preferably, the final authority score is calculated by the following formula:

[0019] HAS=RoleAuth·TimeValid·CompScore

[0020] HAS represents the final authority score, RoleAuth represents the role authorization result, TimeValid represents the time validity, and CompScore represents the comprehensive score;

[0021]

[0022] Data timeliness:

[0023]

[0024] Preferably, the comprehensive score is calculated by the following formula:

[0025] CompScore=ω·FieldCoverage+(1-ω)·SceneRisk

[0026] Among them, FieldCoverage represents the field coverage:

[0027]

[0028] Among them, w i Indicates the weight value of the i-th field (range 0 to 1), which is used to reflect the importance and sensitivity of different fields. The larger the weight, the more important the field. i is a permission indicator function, which takes a value of 0 or 1, indicating whether the user has permission to access the i-th field; n represents the total number of fields in the system;

[0029] SceneRisk represents the scene risk score;

[0030]

[0031] Among them, γ is a balancing factor (ranging from 0 to 1), which is used to adjust the weights of the scene score and the risk score; σ is a sigmoid function, which is used to adjust the scene score relative to the threshold θ s The difference is normalized; the tanh function is used to convert the ratio of the risk score (RiskScore) to the standard deviation σ into an inhibition factor between 0 and 1.

[0032] In another aspect, the present invention provides a data security access system for an electrical equipment supply chain, comprising:

[0033] Question and answer guidance module: used to receive user's query requirements input in natural language;

[0034] Database table matching module: used to match the table and field information related to the query requirements input by the user, and extract the structural information of the related table from the database metadata;

[0035] Permission verification module: used to verify whether the user has the permission to access the queried data;

[0036] Large model SQL generation module: used to automatically generate logical SQL query statements based on user query requirements and matched table structure information;

[0037] Data query execution module: used to execute the generated SQL query statements, access the database and return the query results;

[0038] Data security and privacy desensitization module: used to desensitize sensitive data in query results;

[0039] Data analysis and result display module: used to return the desensitized query results to the user and perform intelligent analysis on the query results.

[0040] Preferably, the structural information of the table includes table name, field name, field type, and primary and foreign key relationships.

[0041] Preferably, the authority verification module specifically includes:

[0042] Permission preprocessing module: used to extract user identity information and role attributes, parse query intent and target data tables, and obtain historical access behavior data;

[0043] Scenario intelligent analysis module: used to analyze query semantics and extract core scenario features; evaluate the correlation between query scenarios and user roles; and calculate field coverage rate;

[0044] Dynamic permission assessment module: used to check RBAC and ABAC rules, calculate scenario risk scores, and integrate multi-dimensional assessment results to obtain the final permission score:

[0045] Permission response processing module: used to determine user permissions based on the final permission score. If the permissions are granted, the access log is recorded and the query execution phase is entered; if the permissions are denied, a friendly prompt is generated to provide alternative suggestions.

[0046] Preferably, the final authority score is calculated by the following formula:

[0047] HAS=RoleAuth·TimeValid·CompScore

[0048] HAS represents the final authority score, RoleAuth represents the role authorization result, TimeValid represents the time validity, and CompScore represents the comprehensive score;

[0049]

[0050] Data timeliness:

[0051]

[0052] Preferably, the comprehensive score is calculated by the following formula:

[0053] CompScore=ω·FieldCoverage+(1-ω)·SceneRisk

[0054] Among them, FieldCoverage represents the field coverage:

[0055]

[0056] Among them, w i Indicates the weight value of the i-th field (range 0 to 1), which is used to reflect the importance and sensitivity of different fields. The larger the weight, the more important the field. iis a permission indicator function, which takes a value of 0 or 1, indicating whether the user has permission to access the i-th field; n represents the total number of fields in the system;

[0057] SceneRisk represents the scene risk score;

[0058]

[0059] Among them, γ is a balancing factor (ranging from 0 to 1), which is used to adjust the weights of the scene score and the risk score; σ is a sigmoid function, which is used to adjust the scene score relative to the threshold θ s The difference is normalized; the tanh function is used to convert the ratio of the risk score (RiskScore) to the standard deviation σ into an inhibition factor between 0 and 1.

[0060] Compared with the prior art, the present invention has the following beneficial effects:

[0061] 1. The present invention can intelligently match the table structure information in the power industry database based on the user's natural language input and generate corresponding SQL queries; by combining natural language processing technology with a large language model, users can easily access and query the required power industry data without having to master complex SQL statements or database structures; by constructing metadata indexes and multi-question-answering, the query efficiency and accuracy of this intelligent data access method are guaranteed, especially when processing complex queries, cross-table operations or dynamic data analysis, the system can automatically generate efficient query tasks, greatly reducing the difficulty of data access; at the same time, a data field-level encryption scheme and a user authority intelligent verification mechanism are designed to ensure the security of the data access sharing process.

[0062] 2. The present invention realizes the seamless connection between natural language and structured database access, simplifies the data access threshold, improves access efficiency, and ensures the security of data access; the present invention is widely applicable to equipment management, supply chain optimization, operation analysis, data openness and sharing and other scenarios in the power industry, and has significant application value and prospects; at the same time, it has good scalability and is compatible with power enterprise databases of different sizes. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 It is a flow chart of a method for secure access to data in the supply chain of electrical equipment according to a preferred embodiment of the present invention.

[0064] Figure 2 It is an architecture diagram of a data security access system for an electrical equipment supply chain according to a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0065] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0066] The technical features of the present invention include: multi-round natural language question-answering based on the Langchain framework, combined with metadata indexing, to achieve intelligent matching of database tables; using a large model to generate SQL query statements to improve the efficiency and accuracy of data queries; using a large model for dynamic permission evaluation and access control. The large model dynamically decides access rights by analyzing multi-dimensional information such as query scenarios, user roles, and data sensitivity, breaking through the limitations of traditional static role permission control and realizing intelligent access rights control for external suppliers when querying data; at the same time, traditional data desensitization solutions require manual pre-configuration and maintenance of desensitization rules, which have problems such as complex rule maintenance, delayed updates, and poor scene adaptability when facing massive equipment data. In response to this technical pain point, the present invention designs an intelligent field-level dynamic desensitization mechanism: Intelligent sensitivity identification: The large model performs intelligent analysis on each data field based on field name, data content, and query scenario, and evaluates its sensitivity in real time. For example, for fields such as equipment serial number and technical parameters, the system can automatically identify their sensitive attributes. Scene-aware rule generation: Based on the query scenario and data sensitivity evaluation results, the large model automatically generates adaptive desensitization rules. The system can dynamically adjust the strictness of the desensitization strategy according to the access scenarios of different suppliers, ensuring that data sharing meets both business needs and security. Ensure the security of sensitive data. This invention can significantly improve the efficiency of data access in the electrical supply chain and ensure security during data sharing.

[0067] In the first aspect, the present invention provides a method for secure access to data in the supply chain of electrical equipment based on the Langchain framework. The method first constructs a metadata index system to achieve efficient retrieval of database metadata. On this basis, an intelligent interactive system based on Langchain is designed to accurately understand and confirm the user's query intention and data requirements through carefully designed question-answer prompt templates and multi-round dialogue mechanisms. The system innovatively introduces a large model for dynamic authority evaluation, analyzes the rationality of the query scenario and the user's authority level in real time, and breaks through the limitations of traditional static authority control. For authorized access, the system calls optimized and configured tools such as Chat2DB to accurately convert natural language into executable SQL statements; for unauthorized access, the system directly terminates the operation and gives a reasonable response. In the data return link, the present invention pioneered the design of an intelligent field-level dynamic desensitization mechanism based on a large model, evaluates data sensitivity in real time and automatically generates desensitization rules to ensure that sensitive information is properly protected. At the same time, the system is equipped with an intelligent access behavior analysis module, which monitors and analyzes the supplier's query mode in real time through a large model, and accurately identifies and promptly warns of abnormal behavior. Finally, the system uses large models to intelligently interpret and display query results, providing users with a data access experience that is both secure and intuitive.

[0068] On the other hand, the present invention constructs a complete electrical equipment supply chain data access system architecture based on the Langchain framework, which includes seven core functional modules: (1) User question and answer guidance module: used to receive and parse the natural language query requirements input by the user, based on the optimized prompt engineering design, guide the user to determine the key information of the query data, table structure module, to achieve accurate user intention understanding and query requirement extraction; (2) Table structure matching module: establish an efficient table structure index system, the big model matches the table fields in the database according to the key information that the user needs to query, and realizes the table structure information matching of the professional data of the power industry; (3) Intelligent permission verification module: use the big model to perform dynamic field (4) Big model SQL generation module: using the open source SQL generation tools configured in the langchain framework, such as chat2DB, to automatically generate SQL query statements based on table structure information and user needs, and return query results; (5) Data query execution module: used to execute the generated SQL query and return query results; (6) Intelligent data desensitization and security processing: with the help of the powerful analysis capabilities of the big model, professional interpretation and display of query results, and cooperate with the dynamic desensitization mechanism to ensure data security; (7) Data analysis and result display module: return the desensitized query results to the user and perform intelligent analysis on the query results. These modules work closely together to build a safe, efficient and intelligent data access solution for the power industry.

[0069] Embodiment 1

[0070] like Figure 1 As shown, this embodiment provides a method for secure access to data in the supply chain of electrical equipment. Through natural language interaction and combined with a large model to generate SQL queries, users can obtain accurate database query results through simple natural language input. The core steps of this method include natural language input of user requirements, data table matching based on metadata indexes, permission verification, SQL generation by a large model, data query execution, and sensitive data encryption. The following is a description of the specific steps, and a special explanation of the prompt design is given to guide users to clarify their data requirements.

[0071] User demand input: Users use natural language to input query requirements through the system's question-and-answer guidance module. In order to ensure that users can clearly express their data requirements, the system uses the design of building metadata indexes + prompts to guide users to gradually improve the query content. Metadata construction first collects metadata information, including data table names, column names, data types, data creation and modification times, etc. The metadata is passed to the question-and-answer agent in the langchain framework as a knowledge base file, and the metadata file is vectorized and stored in the vector library. When a user gives a query requirement, the system will first vectorize the user's query requirement, and find the metadata with the highest similarity through vector retrieval. In order to improve the accuracy of data table matching, a process can be added to the promt to ask the user whether he needs to view the list of data tables he can see, which can greatly improve the accuracy of data table matching. Specific instructions for prompt design:

[0072] Design purpose: The main purpose of prompt design is to guide users to clarify their data requirements and avoid users entering vague, incomplete or difficult to understand queries. The system gradually breaks down complex requirements through multiple rounds of interaction to ensure that the query statement generated in the end accurately matches the user's needs.

[0073] Guide users to confirm query content: When users enter initial queries, the system helps users complete information through interactive prompts. For example, when users enter "query transformer purchase data", the system will further guide users to specify specific time ranges and data dimensions (such as purchase amount, purchase quantity, etc.), thereby ensuring that the system can generate accurate SQL queries.

[0074] Sample Prompt:

[0075] Initial prompt: You can enter which data tables I can view? If you need to query other related data, you can tell me which specific indicators you need, such as equipment type, service life, etc. The system will intelligently match the data tables according to your needs and generate the corresponding SQL query statements.

[0076] User input: Query transformer historical repair data

[0077] System prompt: The system asks the user, "Which period of repair data do you want to query? For example, 'the past six months' or '2023 repair data'."

[0078] The user further inputs: "Query the past six months".

[0079] System confirmation: The system further prompts "Do you need to query information such as transformer model, supplier name, etc.? Please specify the specific fields you need."

[0080] The user selects: "Query all information".

[0081] Flexible handling of different user needs: The system supports multiple query modes and different levels of prompts, such as simple data query, complex cross-table query, or trend analysis of historical data. The prompt design can be dynamically adjusted according to the user input to ensure that the user can successfully complete the demand description.

[0082] Clarify the user's query context: Prompt not only guides users to enter key query content, but also maintains contextual consistency. For example, after a user queries the purchase data for a certain period of time, the system can automatically ask the user whether the data needs to be analyzed, such as "Do you need to analyze the purchase trends in the past six months?"

[0083] Keyword matching: The system matches the table and field information related to the keyword entered by the user. Through the metadata index library, the system can vectorize the user request and match it with the table or field name in the database. For example, if the user enters "transformer purchase data", the system can match it to the purchase_orders table in the database and the related fields device_type (equipment type) and purchase_amount (purchase amount).

[0084] Table structure query: The system extracts the structural information of related tables from the database metadata, including table name, field name, field type, primary and foreign key relationships, etc., to ensure that the subsequently generated SQL statements conform to the database structure.

[0085] Smart permission verification: The smart permission verification model consists of the following layers:

[0086] (1) Basic permission layer: Integrate RBAC (Role-Based Access Control) and ABAC (Attribute-Based Access Control).

[0087] ·Role dimension: preset basic roles such as supplier, partner, administrator, etc.

[0088] Attribute dimension: includes access attributes such as time, location, and device characteristics.

[0089] (2) Scenario analysis layer: Based on the designed prompt template, the large model is used to understand and evaluate the scenario.

[0090] Query intent analysis: understand the user’s query purpose and business scenario.

[0091] Sensitivity assessment: Evaluate the sensitivity of the query data.

[0092] Scenario rationality judgment: Analyze the matching degree between the query scenario and the user role.

[0093] (3) Dynamic authority decision-making layer:

[0094] Multi-dimensional permission calculation: Comprehensively evaluate role permissions, attribute conditions, and scenario rationality.

[0095] Permission policy generation: Dynamically generate access policies that adapt to the current scenario.

[0096] Risk level assessment: Conduct real-time risk assessment on query behavior.

[0097] Permission verification process:

[0098] (1) Permission preprocessing: extract user identity information and role attributes, parse query intent and target data tables, and obtain historical access behavior data.

[0099] (2) Scenario intelligent analysis: The big model analyzes query semantics and extracts core scenario features; evaluates the correlation between the query scenario and the user role; and calculates the field coverage rate.

[0100] (3) Dynamic permission evaluation: Basic permission verification: checking RBAC and ABAC rules; scenario permission calculation: evaluating scenario rationality scores; comprehensive permission decision: integrating multi-dimensional evaluation results.

[0101] (4) Permission response processing: If the permission is granted, the access log is recorded and the query execution phase begins; if the permission is denied, a friendly prompt is generated and alternative solutions are suggested.

[0102] The final authority score is given by the following formula

[0103] HAS=RoleAuth·TimeValid·CompScore

[0104] Among them, HAS represents the authority score, RoleAuth represents the role authorization result, TimeValid represents the time validity, CompScore represents the comprehensive score, FieldCoverage represents the field coverage, and SceneRisk represents the scene risk score.

[0105] in,

[0106]

[0107] Data timeliness:

[0108]

[0109] Overall rating:

[0110] CompScore=ω·FieldCoverage+(1-ω)·SceneRisk

[0111] The comprehensive score (CompScore) balances the two dimensions of field coverage (FieldCoverage) and scene risk score (SceneRisk) through the weight factor ω, which is calculated in real time by the big model based on the user's access intention and behavioral characteristics: when the big model recognizes that the user is performing regular data queries, such as daily office, internal portal and other ordinary business systems, the ω value will be increased (such as 0.8) to focus on field permission control; when it is detected that the user query involves important business systems such as human resources and financial management or sensitive operations, the ω value will be reduced (such as 0.4) to strengthen risk control; and for ambiguous scenarios, a medium weight (such as 0.6) is used to balance the two dimensions. This dynamic weight adjustment mechanism based on the big model can more accurately capture user intentions and make corresponding permission adjustments.

[0112] Where FieldCoverage represents the field coverage

[0113]

[0114] Field Coverage calculates the scope of user access rights to data fields by weighted average. i Indicates the weight value of the i-th field (range 0 to 1), which is used to reflect the importance and sensitivity of different fields. The larger the weight, the more important the field. iis a permission indicator function, which takes a value of 0 or 1, indicating whether the user has permission to access the i-th field; n represents the total number of fields in the system. By multiplying the weight of each field by the permission indicator function and summing them, and then dividing by the sum of all weights, a standardized coverage score between 0 and 1 is obtained, which reflects the user's overall access permission level considering the importance of the field.

[0115] SceneRisk represents the scene risk factor

[0116]

[0117] The scenario risk score (SceneRisk) combines two dimensions: where γ is a balancing factor (ranging from 0 to 1) that adjusts the weights of the scenario score and the risk score; σ is a sigmoid function that is used to scale the scenario score (SceneScore) relative to the threshold θ s The difference between the two is normalized; the tanh function is used to convert the ratio of the risk score (RiskScore) to the standard deviation σ into an inhibition factor between 0 and 1. The two parts together constitute the risk assessment of the access behavior. Among them, the scenario score threshold θ s According to the three-level classification: for low-sensitivity systems such as office collaboration and enterprise portals, the initial threshold is set to 0.6; for medium-sensitivity systems such as human resources, customer management, and supply chain, the initial threshold is set to 0.75; and for high-sensitivity core systems such as financial transactions, electronic payments, and certification centers, the initial threshold is set to 0.85. The large model is fine-tuned by floating 0.05 above and below the initial value based on the sensitivity and importance of the business system, security requirements, etc.

[0118] When the final score HAS = 0, it means that there is no access right at all (any factor is 0); when HAS = 1, it means that there is the highest access right (all factors are optimal). In practical applications, the system usually sets an access threshold δ (such as 0.7), and access is allowed only when HAS ≥ δ.

[0119] If the user does not have permission, the system will return to the Q&A module, prompting the user that he or she does not have access rights and providing other query suggestions.

[0120] Passing requirements to the big language model: The system passes the matched table structure information and the user's specific requirements to SQL conversion tools based on the big language model, such as chat2DB. The model generates SQL query statements by understanding the context, ensuring that the statement logic is correct and meets the user's query requirements.

[0121] SQL generation: The large language model dynamically generates SQL queries based on user needs. For example:

[0122] {SELECT device_type,supplier_name,purchase_amountFROM purchase_ordersWHERE device_type='Transformer'AND purchase_date BETWEEN'2023-04-01'AND'2023-10-01'}

[0123] SQL execution: The system executes the generated SQL statements by calling the database query tool. The system optimizes queries for large data sets and can handle complex cross-table queries, aggregate queries, etc.

[0124] Result acquisition: The database returns the query results and the system is ready for further processing.

[0125] Sensitive data processing: The system calls the data security and privacy management module. Based on the data encryption requirements of power grid enterprises, it encrypts some specific fields, such as personal phone information, supplier names, etc., and outputs the encrypted query results.

[0126] Privacy protection methods: Data desensitization uses encryption, obfuscation and other methods to ensure that sensitive information is not leaked during data display. Field-level desensitization encrypts or obfuscates sensitive fields (such as customer name, phone number, address, financial data, etc.). Methods such as hashing and partial hiding (such as only showing the first letter of the name) can be used. This part is achieved through encryption tools to avoid illusions in large models and affect data security.

[0127] Return desensitized data: The system returns the desensitized query results to the user. The user can choose different display methods, such as tables, charts, etc.

[0128] Intelligent analysis tool call: If the user has further needs, the system can call the data analysis tool to perform intelligent analysis on the query results. For example, the system can generate a procurement trend analysis based on procurement data, or evaluate supplier performance.

[0129] Visual display: Intelligent analysis results are displayed to users in the form of visual charts, reports, etc., further improving the efficiency and intuitiveness of data use.

[0130] Embodiment 2

[0131] like Figure 2As shown, this embodiment provides a data security access system for the electrical equipment supply chain, which integrates natural language processing, database query, authority management, privacy protection and intelligent analysis functions, and can dynamically access and analyze data through the user's natural language needs. The core modules of the system include question-answer guidance module, database table structure matching module, intelligent authority verification module, large model SQL generation module, data query execution module, data security and privacy management module, and data analysis and display module. The following is a detailed description of each module of the system:

[0132] 1. Question and answer guidance module

[0133] Functional description: This module is responsible for interacting with users, receiving natural language query input from users, and guiding users to gradually improve their query requirements through the design of prompts. Through this module, users can make specific data access requests, such as "query transformer procurement data for the past six months" or "display equipment failure rates for the past year."

[0134] Prompt design: Based on the user's initial input, the system provides guidance through predefined prompt designs to help users further clarify the key parameters of the query. For example:

[0135] The system prompts: "Please specify the time range for your query, such as the past six months or the whole year of 2023."

[0136] If the user's input is incomplete or ambiguous, the system will conduct multiple rounds of interaction to ensure that the information provided by the user is accurate enough.

[0137] 2. Database table matching module

[0138] Functional description: After receiving user requirements, this module uses keyword matching and database metadata to query the database table structure of the power industry and determine the data tables and fields related to user requirements. This module uses natural language processing technology to identify the device name, data type, etc. in the user input and match it to the correct database table and field.

[0139] Implementation details: This module will identify the table and fields required by the user through mapping with the Chinese name of the table and the field name. For example, if the user enters "transformer purchase data", the system can identify the corresponding table purchase_orders and related fields device_type and purchase_amount.

[0140] 3. Permission verification module

[0141] Functional description: This module is used to verify whether the user has the authority to access the queried data. The system integrates RBAC (role-based access control) and ABAC (attribute-based access control) through a large model to ensure secure access to data.

[0142] Mr. Zhang is a data analyst who needs to access the company's financial data from the previous quarter for analysis. When he initiates an access request, the intelligent permission verification module makes the following determination:

[0143] (1) Role authority determination (RoleAuth): The system checks whether Zhang Gong, the data analyst, has the corresponding authority, RoleAuth = 1

[0144] (2) Time validity determination (TimeValid): Check data time validity: Current date: 2024-10-31, Data date: 2024-06-30, Validity period: 180 days, TimeValid = 1 (within the validity period)

[0145] (3) Calculation of Comprehensive Score (CompScore):

[0146] Field Coverage:

[0147] Financial data field weight settings:

[0148] Total revenue: w1 = 0.8, δ1 = 1

[0149] Cost expenditure: w2 = 0.7, δ2 = 1

[0150] Profit data: w3=0.9,δ3=0

[0151] Cash flow: w4 = 0.6, δ4 = 1

[0152] FieldCoverage = (0.8*1+0.7*1+0.9*0+0.6*1) / (0.8+0.7+0.9+0.6) = 0.7SceneRisk:

[0153] Scene features:

[0154] SceneScore = 0.85 (normal working hours, common IP)

[0155] RiskScore = 0.2 (normal query operation)

[0156] θ s =0.75 (financial data system threshold)

[0157] σ=1.0(standard deviation)

[0158] The large model dynamically generates γ after analyzing the scene features:

[0159] Identified: General data analysis, single query, working hours

[0160] Set γ = 0.7 (focus on scene scoring)

[0161] SceneRisk=0.7*σ(0.85-0.75)+0.3*(1-tanh(0.2 / 1.0))=0.82

[0162] Comprehensive judgment of large model:

[0163] Based on intention understanding:

[0164] -User intent: Data analysis report production

[0165] -Access scope: some financial indicators

[0166] - Operation type: Read-only query

[0167] -Time characteristics: working hours

[0168] The large model sets ω=0.7 (focusing on field permission control)

[0169] CompScore=0.7*0.7+0.3*0.82=0.736

[0170] Final authorization decision:

[0171] HAS=RoleAuth*TimeValid*CompScore

[0172] =1*1*0.736

[0173] =0.736

[0174] System threshold δ=0.7

[0175] Because 0.736>0.7, the authorization is passed.

[0176] Authorization result:

[0177] ·Access allowed: total revenue, cost expenditure, cash flow, profit data In this scenario, the big model dynamically adjusts two key weights by analyzing user intent and scenario characteristics:

[0178] γ value: In the scenario risk score, since it is identified as a routine data analysis scenario, a higher weight (0.7) is set to highlight the impact of the scenario score.

[0179] ω value: In the comprehensive score, considering the standard data analysis requirements, a higher weight (0.7) is set to ensure the necessary data access rights.

[0180] This dynamic weight adjustment mechanism based on a large model makes permission control smarter and more accurate, which can not only ensure data security but also meet normal business needs.

[0181] 4. Large model SQL generation module

[0182] Function description: This module uses the large language model (such as GPT-4) integrated in the Langchain framework to automatically generate logical SQL query statements based on user needs and matched table structure information.

[0183] Implementation details: After the system determines the user's query requirements and table structure, it passes this information to the large language model, which generates SQL query statements.

[0184] 5.Data query execution module

[0185] Functional description: After the SQL is generated, the system executes the generated SQL query through the data query tool, accesses the database of the power industry and returns the query results. This module has the ability to process large data sets to ensure efficient execution of queries.

[0186] 6. Data security and privacy desensitization module

[0187] Functional description: This module ensures that the sensitive data received by users in the query results is desensitized to prevent sensitive information leakage. Before the query results are returned, the system encrypts or obfuscates the sensitive fields in the results through the data security and privacy management module, such as hiding specific amounts, supplier information or personal information.

[0188] Privacy protection strategy: Depending on the user's permissions, the system will perform different levels of desensitization for different levels of users. For example, some users may not have the permission to view the detailed purchase amount, and the system will display the amount field in a fuzzy manner, such as "***" or "range value".

[0189] Data desensitization technology: The system can adopt a variety of data desensitization technologies, such as field encryption, data generalization, data randomization, etc., to ensure the security of data during transmission and display.

[0190] 7. Data analysis and results display module

[0191] Functional description: This module displays the query results to users in various forms such as tables, charts, and reports. At the same time, users can also choose to call data analysis tools to perform intelligent analysis on query results, generate trend forecasts, statistical analysis, etc., to further optimize business decisions.

[0192] Although the present invention is described herein with reference to specific embodiments, it should be understood that these embodiments are merely examples of the principles and applications of the present invention. It should therefore be understood that many modifications may be made to the exemplary embodiments and that other arrangements may be devised without departing from the spirit and scope of the present invention as defined by the appended claims. It should be understood that the various dependent claims and features described herein may be combined in a manner different from that described in the original claims. It should also be understood that features described in conjunction with individual embodiments may be used in other described embodiments.

Claims

1. A method for secure access to data in the supply chain of electrical equipment, characterized in that: The following steps are involved: S11, receiving a query requirement input by a user in natural language; S12, matching the table and field information related to the query requirement input by the user, and extracting the structural information of the related table from the database metadata; S13, verifying whether the user has the authority to access the queried data; S14. Automatically generate a logical SQL query statement based on the user's query requirements and the matched table structure information; S15, execute the generated SQL query statement, access the database and return the query result; S16. Desensitize sensitive data in the query results; S17: Return the desensitized query results to the user and perform intelligent analysis on the query results.

2. A method for secure access to data in the supply chain of electrical equipment according to claim 1, characterized in that: The structural information of the table includes table name, field name, field type, primary and foreign key relationships, etc.

3. The method for secure access to data in the electrical equipment supply chain according to claim 1, characterized in that: The step S13 specifically includes the following steps: S1301, extracting user identity information and role attributes, parsing query intent and target data table, and obtaining historical access behavior data; S1302, analyzing query semantics and extracting core scenario features; evaluating the relevance between the query scenario and the user role; and calculating the field coverage rate; S1303. Check RBAC and ABAC rules, calculate scenario risk scores, and integrate multi-dimensional assessment results to obtain the final authority score; S1304. Determine the user authority according to the final authority score. If the authority is granted, record the access log and enter the query execution phase. If the authority is denied, generate a friendly prompt and provide alternative suggestions.

4. A method for secure access to data in the supply chain of electrical equipment according to claim 3, characterized in that: The final authority score is calculated by the following formula: HAS=RoleAuth·TimeValid·CompScore HAS represents the final authority score, RoleAuth represents the role authorization result, TimeValid represents the time validity, and CompScore represents the comprehensive score; Data timeliness:

5. The method for secure access to data in the electrical equipment supply chain according to claim 4, characterized in that: The comprehensive score is calculated by the following formula: CompScore=ω·FieldCoverage+(1-ω)·SceneRisk Among them, FieldCoverage represents the field coverage: Among them, w i Indicates the weight value of the i-th field (range 0 to 1), which is used to reflect the importance and sensitivity of different fields. The larger the weight, the more important the field. i is a permission indicator function, which takes a value of 0 or 1, indicating whether the user has permission to access the i-th field; n represents the total number of fields in the system; SceneRisk represents the scene risk score; Among them, γ is a balancing factor (ranging from 0 to 1), which is used to adjust the weights of the scene score and the risk score; σ is a sigmoid function, which is used to adjust the scene score relative to the threshold θ s The difference is normalized; the tanh function is used to convert the ratio of the risk score (RiskScore) to the standard deviation σ into an inhibition factor between 0 and 1.

6. A data security access system for the supply chain of electrical equipment, characterized in that: include: Question and answer guidance module: used to receive user's query requirements input in natural language; Database table matching module: used to match the table and field information related to the query requirements input by the user, and extract the structural information of the related table from the database metadata; Permission verification module: used to verify whether the user has the permission to access the queried data; Large model SQL generation module: used to automatically generate logical SQL query statements based on user query requirements and matched table structure information; Data query execution module: used to execute the generated SQL query statements, access the database and return the query results; Data security and privacy desensitization module: used to desensitize sensitive data in query results; Data analysis and result display module: used to return the desensitized query results to the user and perform intelligent analysis on the query results.

7. The electrical equipment supply chain data security access system according to claim 6, characterized in that: The structural information of the table includes table name, field name, field type, and primary and foreign key relationships.

8. The electrical equipment supply chain data security access system according to claim 6, characterized in that: The authority verification module specifically includes: Permission preprocessing module: used to extract user identity information and role attributes, parse query intent and target data tables, and obtain historical access behavior data; Scenario intelligent analysis module: used to analyze query semantics and extract core scenario features; evaluate the correlation between query scenarios and user roles; and calculate field coverage rate; Dynamic permission assessment module: used to check RBAC and ABAC rules, calculate scenario risk scores, and integrate multi-dimensional assessment results to obtain the final permission score: Permission response processing module: used to determine user permissions based on the final permission score. If the permissions are granted, the access log is recorded and the query execution phase is entered; if the permissions are denied, a friendly prompt is generated to provide alternative suggestions.

9. The electrical equipment supply chain data security access system according to claim 8, characterized in that: The final authority score is calculated by the following formula: HAS=RoleAuth·TimeValid·CompScore HAS represents the final authority score, RoleAuth represents the role authorization result, TimeValid represents the time validity, and CompScore represents the comprehensive score; Data timeliness:

10. The electrical equipment supply chain data security access system according to claim 9, characterized in that: The comprehensive score is calculated by the following formula: CompScore=ω·FieldCoverage+(1-ω)·SceneRisk Among them, FieldCoverage represents the field coverage: Among them, w i Indicates the weight value of the i-th field (range 0 to 1), which is used to reflect the importance and sensitivity of different fields. The larger the weight, the more important the field. i is a permission indicator function, which takes a value of 0 or 1, indicating whether the user has permission to access the i-th field; n represents the total number of fields in the system; SceneRisk represents the scene risk score; Among them, γ is a balancing factor (ranging from 0 to 1), which is used to adjust the weights of the scene score and the risk score; σ is a sigmoid function, which is used to adjust the scene score relative to the threshold θ s The difference is normalized; the tanh function is used to convert the ratio of the risk score (RiskScore) to the standard deviation σ into an inhibition factor between 0 and 1.

Images