Database access control method and system based on information verification

Abstract

The invention discloses a database access control method and system based on information verification, and belongs to the technical field of data analysis. According to the method, the to-be-verified identity information of the smart urban rail cloud platform database cluster access request end is obtained, and accurate authority control is carried out on the database cluster structure. An identity permission cross vector is obtained by crossing a permission mechanism configuration vector and an identity attribute representation vector, and identity attributes are fully considered, so that permission judgment better fits the actual situation of a user. And the access operation behavior preference is spliced to generate an access control judgment basis, the user operation habit is considered, and the judgment accuracy is improved. The generated first permission mechanism linkage graph can clearly present the permission involved state, and the target permission mechanism distribution vector obtained through adjustment is more reasonable. The finally determined access control authority indication can effectively ensure the security of the database, accurately meet the reasonable access requirements of different users, and ensure the orderly and safe operation of the smart urban rail cloud platform database cluster.

Description

Technical Field

[0001] The present application belongs to the technical field of data analysis, and specifically relates to a database access control method and system based on information verification. Background Art

[0002] With the development of smart urban rail systems, cloud platform database clusters play a core role in data storage and management, including the main cloud center database, the backup cloud center database, and the station database. However, traditional database access control technology is difficult to meet the needs of such complex structure database clusters. On the one hand, traditional technologies are often based on simple identity recognition or a single permission rule when determining permissions, and cannot fully consider the differences in the identity attributes of multiple users under the smart urban rail cloud platform, resulting in unreasonable permission allocation and failure to meet the diverse access needs of personnel in different positions (such as operators, maintenance personnel, etc.) for different types of data (such as ticketing data, equipment data, etc.). On the other hand, traditional technologies ignore the impact of user operation behavior habits on permission determination, making permission control inflexible. Furthermore, there is a lack of effective permission coordination mechanism for the complex associations between the various databases in the database cluster, and the involvement status between permissions cannot be accurately described, which is prone to security risks, such as data leakage or misoperation. Summary of the invention

[0003] The present application provides a database access control method and system based on information verification, which can solve or partially solve the technical problems involved in the above-mentioned background technology.

[0004] The embodiment of the present application provides a database access control method based on information verification, which is applied to a database access control system, and the method includes: obtaining identity information to be verified corresponding to an access request end; wherein the access target of the access request end is a database cluster of a smart urban rail cloud platform; the database cluster includes at least a primary cloud center database, a backup cloud center database, and a station database; the permission mechanism configuration vectors corresponding to each set of basic access control permission mechanisms are respectively crossed with the identity attribute representation vector sets mined for each identity attribute in the identity information to be verified, to obtain corresponding identity permission cross vectors; each identity permission cross vector is respectively crossed with the access operation behavior event for the identity information to be verified. The access operation behavior preferences mined from the basic access control permission mechanisms are spliced ​​to obtain corresponding access control judgment bases; the first permission mechanism linkage map is generated by using the access control judgment bases, and based on the first permission mechanism linkage map, the identity permission cross vectors corresponding to the basic access control permission mechanisms are respectively used to adjust the corresponding target permission mechanism allocation vectors; wherein, the first permission mechanism linkage map is used to describe the permission involvement status between the basic access control permission mechanisms; in combination with the target permission mechanism allocation vectors and the identity permission cross vectors respectively determined for the basic access control permission mechanisms, the access control permission indication corresponding to the identity information to be verified is determined in the basic access control permission mechanisms.

[0005] An embodiment of the present application provides a database access control system, comprising at least one processor and a memory; the memory stores computer-executable instructions; the at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the above method.

[0006] An embodiment of the present application provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the above method are implemented.

[0007] In an embodiment of the present application, by obtaining the identity information to be verified of the access request end of the smart urban rail cloud platform database cluster, precise permission control is performed on the database cluster structure (including the main cloud center database, the backup cloud center database and the station database). The identity permission cross vector is obtained by intersecting the permission mechanism configuration vector with the identity attribute representation vector, and the identity attribute is fully considered to make the permission judgment more in line with the actual situation of the user. The access control judgment basis is generated by splicing with the access operation behavior preference, taking into account the user's operating habits and improving the accuracy of the judgment. The first permission mechanism linkage map generated based on this can clearly present the permission-involved status, and it is more reasonable to adjust the target permission mechanism allocation vector. The final access control permission indication can effectively ensure the security of the database, accurately meet the reasonable access needs of different users, and ensure the orderly and safe operation of the smart urban rail cloud platform database cluster. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 A flowchart of a database access control method based on information verification provided in an embodiment of the present application.

[0009] Figure 2 A schematic diagram of the structure of a database access control system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0010] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0011] The terms "first", "second", etc. in this application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are usually a class, and the number of objects is not limited. For example, the first object can be one or more. In addition, in this application, "and / or" represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0012] Figure 1 A database access control method based on information verification is shown, which is applied to a database access control system. The method includes the following steps 101 to 105.

[0013] Step 101: The database access control system obtains the identity information to be verified corresponding to the access request end.

[0014] Among them, the access target of the access request end is the database cluster of the smart urban rail cloud platform; the database cluster at least includes a primary cloud center database, a backup cloud center database and a station database.

[0015] Step 102: The database access control system crosses the permission mechanism configuration vectors corresponding to each set basic access control permission mechanism with the identity attribute representation vector set mined for each identity attribute in the identity information to be verified, to obtain a corresponding identity permission cross vector.

[0016] Step 103: The database access control system combines the cross vectors of each identity authority with the access operation behavior preferences mined from the access operation behavior events of the identity information to be verified, and obtains corresponding access control judgment basis.

[0017] Step 104: The database access control system generates a first permission mechanism linkage map using each access control judgment basis, and based on the first permission mechanism linkage map, adjusts the corresponding target permission mechanism allocation vector through the identity permission cross vectors corresponding to each basic access control permission mechanism.

[0018] Among them, the first permission mechanism linkage map is used to describe the permission involvement status between the basic access control permission mechanisms.

[0019] Step 105: The database access control system combines the target authority mechanism allocation vectors and identity authority cross vectors respectively determined corresponding to the basic access control authority mechanisms, and determines the access control authority indication corresponding to the identity information to be verified in each basic access control authority mechanism.

[0020] The application scenario of this application involves the database access control system in the database cluster access control of the smart urban rail cloud platform. The database cluster includes the main cloud center database, the backup cloud center database, and the station database. For such a complex database cluster with extremely high requirements for stability and security, steps 101-105 record the implementation process of its access control. The implementation process is described below as an example.

[0021] First, in step 101, the database access control system will obtain the identity information to be verified corresponding to the access request end. The access request end in this application is intended to access the database cluster of the smart urban rail cloud platform, and the structure of this database cluster is relatively complex. Different database centers play different roles in the entire system. The main cloud center database may assume the main service provision tasks under normal circumstances, and the backup cloud center database plays a backup role when the main cloud center database fails. The station database also has its corresponding function in the entire system. For example, in a large-scale urban rail operation scenario, the station database may store the ticketing information, equipment status information and other data with strong immediacy of the site. The main cloud center database may summarize the data of each station and conduct overall operation analysis, etc. The backup cloud center database is ready to take over the work of the main cloud center database at any time to ensure the continuity of the system.

[0022] Then, enter step 102. In this step, the system crosses the permission mechanism configuration vectors corresponding to each of the set basic access control permission mechanisms with the identity attribute representation vector set mined for each identity attribute in the identity information to be verified, thereby obtaining the corresponding identity permission cross vector. The implementation method of this step is relatively complex and innovative. For example, there are three basic access control permission mechanisms, namely permission mechanism A, permission mechanism B and permission mechanism C. For permission mechanism A, its permission mechanism configuration vector may include elements such as access level (such as high, medium, and low), access time period (such as working hours and non-working hours). For the identity attributes in the identity information to be verified, for example, the user's position (such as operation management personnel, technical maintenance personnel, ordinary ticketing personnel), the department to which they belong (such as ticketing department, equipment management department), etc., the mined identity attribute representation vector set may be quantitatively represented according to these identity attributes. For example, the identity attribute representation vector corresponding to the operation management personnel may have a higher value on the element representing management authority. Then, through the corresponding cross operation (this operation can be a logical operation based on the correspondence between vector elements), the identity permission cross vector for permission mechanism A is obtained. The same operation will be performed on permission mechanism B and permission mechanism C to obtain their corresponding identity permission cross vectors.

[0023] This is followed by step 103, where the system splices each identity-authority cross vector with the access operation behavior preference mined from the access operation behavior event for the identity information to be verified, thereby obtaining the corresponding access control judgment basis. The access operation behavior preference mined from the access operation behavior event in the present application is also a quantitative representation of factors such as user operation habits. For example, for users who frequently perform data query operations, they may have higher values ​​in elements related to query frequency. Taking the identity-authority cross vector obtained for authority mechanism A as an example, it is spliced ​​with the access operation behavior preference. This splicing operation can be to combine the elements of the two vectors in sequence according to the dimensional order of the vectors to form a new vector. This new vector becomes the access control judgment basis for authority mechanism A. Similarly, such splicing operations will be completed for authority mechanism B and authority mechanism C.

[0024] At step 104, the system generates a first permission mechanism linkage map using each access control discrimination basis. The first permission mechanism linkage map is used to describe the permission involvement status between each basic access control permission mechanism. For example, some permissions in permission mechanism A may be associated with some permissions in permission mechanism B. This association may be reflected in that when a certain permission in permission mechanism A is granted, a certain related permission in permission mechanism B also needs to be adjusted accordingly. Based on this first permission mechanism linkage map, the system adjusts the corresponding target permission mechanism allocation vector through the identity permission cross vectors corresponding to each basic access control permission mechanism. For example, it is found in the map that there is a certain collaborative relationship between permission mechanism A and permission mechanism B. After the identity permission cross vector of permission mechanism A is determined according to the access control discrimination basis, the identity permission cross vector of permission mechanism B is adjusted through this relationship in the map, and finally the respective target permission mechanism allocation vectors are obtained.

[0025] Finally, in step 105, the system combines the target permission mechanism allocation vector and the identity permission cross vector determined for each basic access control permission mechanism, and determines the access control permission indication corresponding to the identity information to be verified in each basic access control permission mechanism. For example, by comprehensively considering the target permission mechanism allocation vector, the identity permission cross vector of permission mechanism A, and the various associations and calculation results in the previous steps, the specific access control permission indication for a certain access request end is determined. This indication can be to allow certain corresponding database operations (such as querying a specific data table, modifying a specific data item), or to deny access to certain data resources. This determination process is based on the complex logical relationships and calculation results constructed in the previous steps of the entire application, ensuring precise control of access to the database cluster, and meeting the reasonable access needs of users with different identities while ensuring system security.

[0026] The database access control system of the present application starts with obtaining the identity information to be verified, and ultimately determines the access control permission indication through a series of innovative vector operations, graph construction and other operations. It comprehensively considers multiple factors such as the complexity of the database cluster, the needs of users with different identities, and security, and is an innovative and effective database access control solution.

[0027] At the same time, the database access control system also cooperates with the database access control strategy based on the "two locations and three centers" architecture. The database cluster under this architecture contains four nodes (DB1 / DB2 / DB3 / DB4), and a pair of virtual IPs (Vips) are configured in each center (primary cloud, backup cloud, and station). After the database access control system determines the access control authority indication, the system also needs to dynamically adjust the virtual IP pair that provides services to the outside world based on the location of the master node of the database cluster to ensure that only one pair of Vips is valid at the same time.

[0028] For example, under normal circumstances, the database node DB1 of the primary cloud center is the main service provider node, and its corresponding virtual IP pair (Vip1-1, Vip1-2) is a valid IP pair. When the database access control system receives the access request and completes the permission verification, if access is allowed, the access request will be directed to the database service corresponding to this valid virtual IP pair. However, if the database of the primary cloud center fails, such as the DB1 node fails, the system will promote the database node of the backup cloud center or station to the main service provider node according to the pre-set disaster recovery backup strategy, and switch the corresponding virtual IP pair to a valid IP pair. For example, the virtual IP pair (Vip3-1, Vip3-2) corresponding to the DB3 node of the backup cloud center is switched to a valid IP pair. In this way, the access request will be directed to the database service corresponding to the new valid IP pair, achieving high availability and seamless switching of database services.

[0029] The above dynamic VIP switching mechanism cooperates with the access control authority determination process of the entire access control system. When switching VIPs, it is still necessary to ensure that only authorized access requests can be directed to the database service corresponding to the new valid IP pair according to the access control authority indication. For example, even if the VIP switches to the database service of the backup cloud center, if the identity information corresponding to the access request does not have sufficient authority to access certain data resources, access will still be denied.

[0030] The database access control system in this application achieves high availability and disaster recovery capabilities, as well as technical features such as delay-free access, through multi-step precise calculations in the process of determining access control permissions and coordination with the dynamic VIP switching mechanism under the "two locations and three centers" architecture. This not only simplifies the database access logic at the application layer, but also significantly improves access efficiency, effectively solves the shortcomings of traditional database architecture in high availability and disaster recovery backup, and is particularly suitable for application scenarios with high requirements for database service stability and data security, such as complex systems such as the smart urban rail cloud platform that have extremely high requirements for data security and service continuity.

[0031] In actual urban rail operation scenarios, a large amount of data needs to be interacted and managed between different database centers. For example, each station generates a large amount of ticket sales data, passenger flow data, equipment operation status data, etc. every day. The main cloud center database needs to summarize this data for comprehensive analysis to formulate operation strategies, arrange train scheduling, etc. People with different identities, such as ticketing staff, operation dispatchers, equipment maintenance personnel, etc., have different access requirements for this data. Ticketing staff may mainly need to query and update ticket sales data, operation dispatchers may need to query and analyze passenger flow data and train operation status data to formulate scheduling plans, and equipment maintenance personnel may need to query equipment operation status data and modify related data when necessary to arrange equipment maintenance.

[0032] The database access control system accurately determines the access control authority indication of each access request end through the above steps, ensuring the security and rational use of data. For example, for ticketing staff, the system determines that they can only access and operate data resources related to ticketing based on their identity attributes (such as position as ticketing staff and department as ticketing department), access operation behavior preferences (such as frequent query and small update operations of ticket sales data), etc., and restricts their access to other important data (such as core algorithm data for train scheduling) through operations from steps 101 to 105. For operation dispatchers, according to their identity attributes and operation behavior preferences, they may be granted the authority to query more types of data (such as ticketing data for analyzing passenger flow trends, and equipment status data for considering the impact of equipment failures on scheduling), but their modification authority to some sensitive data (such as financial data) is still restricted.

[0033] In terms of disaster recovery and backup, for example, the main cloud center database fails due to a natural disaster or a large-scale network attack. According to the strategy in the application, the system will quickly promote the backup cloud center or station database to the main service provider node. During this process, the database access control system still works normally and continues to verify the permissions of access requests. For example, during a failover, only operational dispatchers with legitimate access rights can access passenger flow data in order to adjust train dispatch plans in a timely manner and prevent operational chaos. At the same time, if equipment maintenance personnel need to query equipment status data to assess the impact of the failure on the equipment, they also need to go through the system's permission verification before they can access the relevant data in the backup cloud center or station database.

[0034] The collaborative work of this database access control system and the "two locations and three centers" architecture fully guarantees the stability, security and efficiency of the smart urban rail cloud platform database cluster, and meets the complex needs of data management and access control in smart urban rail operations. Whether it is precisely controlling the access rights of users with different identities under normal operation, or ensuring the continuity of database services and the integrity of data in the face of disasters or failures, the application reflects its innovation and practicality.

[0035] To sum up, the database access control system of the present application provides a comprehensive, efficient and secure access control solution for the database cluster of the smart urban rail cloud platform through the detailed operation process of steps 101 to 105, combined with the database access control strategy based on the "two locations and three centers" architecture. It is a technological innovation of great significance and can play an important role in application scenarios with high requirements for database service stability and data security.

[0036] In addition, in the database access control system, the five technical features of the permission mechanism configuration vector, identity attribute representation vector, identity permission intersection vector, access control judgment basis and target permission mechanism allocation vector all exist in the form of feature vectors, and they play their own unique and interrelated roles in the entire access control system. The following will introduce the above technical features in detail to enrich the technical solution.

[0037] 1. Permission mechanism configuration vector The permission mechanism configuration vector is one of the basic parts of the entire access control system. It essentially defines the internal structure and characteristics of various basic access control permission mechanisms. This vector contains multiple elements, each of which corresponds to a specific aspect of the permission mechanism.

[0038] Taking an actual smart urban rail cloud platform database access control system as an example, the permission mechanism configuration vector is (V_{p}=[v_{p1}, v_{p2}, v_{p3}]), where (v_{p1}) represents the access level, (v_{p2}) represents the access period, and (v_{p3}) represents the data type.

[0039] For the access level (v_{p1}), the corresponding value of the high-level permission is set to (3), the medium-level permission is set to (2), and the low-level permission is set to (1). For example, the access to the core operation data of the urban rail system (such as train scheduling algorithm data, financial data, etc.) is set to a high-level permission, that is, (v_{p1}=3); the access to the daily operation data of the station (such as ticket sales data, basic status data of station equipment) is set to a medium-level permission, (v_{p1}=2); and the access to some public information (such as basic information of urban rail stations, operation timetables, etc.) is set to a low-level permission, (v_{p1}=1).

[0040] For the access period (v_{p2}), during normal operating hours (such as 6 am to 10 pm), the value is set to (2), indicating that there are more regular operation permissions during this time period; while during non-operating hours (10 pm to 6 am), the value is set to (1), indicating that the permissions are relatively limited. For example, some technical maintenance personnel perform real-time queries and necessary modification operations on device status data during normal operating hours (v_{p2}=2), and during non-operating hours, except for emergency maintenance personnel, the modification operations on device status data are limited (v_{p2}=1).

[0041] For data types (v_{p3}), set the value according to the importance and sensitivity of different data types. For example, for ticketing data, it is set to (2), for device status data, it is set to (1.5), and for public information, it is set to (1). The permission mechanism may stipulate that ticketing staff can perform operations such as query, ticket sales, and ticket refunds. However, for financial personnel, in addition to querying ticketing data for financial accounting, they may also be allowed to perform operations related to ticketing revenue statistics and financial report generation, while other personnel may be strictly restricted from accessing ticketing data.

[0042] The construction of the permission mechanism configuration vector can be aided by the classification algorithm in the machine learning algorithm. For example, historical permission setting cases can be used as training data, and various permission-related attributes in the data (such as access level, time period, data type, etc.) can be used as features to build a model through a classification algorithm (such as a decision tree algorithm). This model can automatically generate a permission mechanism configuration vector. Once this vector is constructed, it provides a standard framework for subsequent access control operations.

[0043] 2. Identity Attribute Representation Vector The identity attribute representation vector is mainly a vector obtained by quantifying and extracting the identity information of the access request end. In the scenario of the smart urban rail cloud platform, the identity attribute contains multiple aspects, which are integrated into the identity attribute representation vector.

[0044] For example, the identity attribute representation vector is (V_{i}=[v_{i1}, v_{i2}, v_{i3}, v_{i4}]), where (v_{i1}) represents position information, (v_{i2}) represents the department, (v_{i3}) represents work experience, and (v_{i4}) represents the work location.

[0045] For position information (v_{i1}), positions in urban rail operations include operation managers, technical maintenance personnel, ticketing staff, and financial personnel. Operation managers are set to (3), indicating their extensive access needs for various types of data; technical maintenance personnel are set to (2.5); ticketing staff are set to (2); financial staff are set to (2.5); and ordinary passengers are set to (1). Different positions correspond to different job functions and data needs, and these differences can be reflected by the position elements in the identity attribute representation vector.

[0046] For the department (v_{i2}), for example, the ticketing department is (2), the equipment management department is (2.5), and the operation and scheduling department is (3). The data access needs of personnel in different departments are closely related to the functions of the departments. Taking the equipment management department as an example, the personnel in this department need to frequently access equipment status data, equipment maintenance history data, etc. In the identity attribute representation vector, the component corresponding to the access needs of equipment-related data will be higher.

[0047] For work experience (v_{i3}), it is quantified by years of work experience. For example, work experience of 0-2 years is (1), 2-5 years is (2), 5-10 years is (3), and more than 10 years is (4). People with rich work experience may be granted more extensive permissions, which can be reflected by setting the work experience element in the identity attribute representation vector. For example, technical maintenance personnel with longer work experience may be allowed to access more complex equipment debugging data.

[0048] For the work location (v_{i4}), if it is a local staff of the station, it is set to (2), and if it is a non-local staff, it is set to (1). The work location may also affect the permissions. For example, the local staff of the station may have more local operation permissions on the equipment and ticketing data of the station. This information can also be reflected in the vector.

[0049] The construction of identity attribute representation vectors can use natural language processing technology (if the identity information exists in text form) or feature engineering technology. For example, for text information such as position and department, these texts can be converted into vector form using a word vector model. For numerical or quantifiable information such as work experience and work location, they can be directly normalized and put into the vector. Through these technical means, complex identity attribute information can be converted into a unified, easy-to-calculate vector form, providing a basis for subsequent authority determination.

[0050] 3. Identity-Authority Crossover Vector The identity-authority cross vector is obtained by performing a cross operation between the permission mechanism configuration vector and the identity attribute representation vector. This cross operation is a logical operation based on the correspondence between vector elements. Its purpose is to combine the permission mechanism with the identity attribute and find the correlation between the two.

[0051] Let the identity-authority intersection vector be (V_{ip}=[v_{ip1}, v_{ip2}, v_{ip3}, v_{ip4}]).

[0052] Take the access level element (v_{p1}) in the permission mechanism configuration vector and the position element (v_{i1}) in the identity attribute representation vector mentioned above as an example. For example, the access level element in the permission mechanism configuration vector stipulates that the corresponding value of high-level permissions is (3), medium-level permissions is (2), and low-level permissions is (1); while the corresponding value of the position element in the identity attribute representation vector for operations management personnel is (3), ticketing staff is (2), and ordinary passengers is (1). Through the crossover operation (here, for example, multiplication operation is used as an example), for operations management personnel, the value obtained on the identity permission cross vector component (v_{ip1}) related to this access level and position is (3*3=9), which indicates that operations management personnel have a higher comprehensive weight in the association between access level and position. Similarly, for ticketing staff, (v_{ip1}=2*2=4).

[0053] Let's look at the intersection of the access period element (v_{p2}) in the permission mechanism configuration vector and the work location element (v_{i4}) in the identity attribute representation vector. If the value corresponding to the work location element for the personnel working locally at the station is (2) (indicating a high degree of relevance to local data), and the value of the access period element corresponding to the normal operation period is (2) (indicating that there are more access opportunities during this period), then the identity permission intersection vector component (v_{ip2}) obtained after the intersection of these two elements is (2*2=4), which represents the access relevance weight of the local staff of the station to local data during the normal operation period.

[0054] It can be seen that the above cross operation is similar to the calculation of connection weights between neurons in a neural network. In a neural network, neurons in the input layer (similar to elements in the permission mechanism configuration vector and the identity attribute representation vector) are connected to the neurons in the next layer through corresponding weights (similar to the results obtained by the cross operation). The identity permission cross vector in this application is like the result after being processed by a special "neural network layer", which integrates the relationship between the permission mechanism and the identity attribute, and provides an intermediate result for subsequent more complex access control decisions.

[0055] 4. Access Control Judgment Basis The basis for access control judgment is to combine the identity permission cross vector with the access operation behavior preference mined from the access operation behavior event of the access request end to obtain the vector. The access operation behavior preference is also a quantitative representation of user behavior.

[0056] Suppose the access operation behavior preference vector is (V_{b}=[v_{b1}, v_{b2}, v_{b3}]) and the access control judgment basis vector is (V_{d}=[v_{d1}, v_{d2}, v_{d3}, v_{d4}, v_{d5}, v_{d6}]).

[0057] For example, for users who frequently perform data query operations, there may be a higher value on the access operation behavior preference element (v_{b1}) related to the query frequency. For example, a technical maintenance personnel often queries the device status data, and the access operation behavior preference element (v_{b1}) corresponding to the device status data query frequency is assigned a value of (3) (the numerical values ​​in this application are only examples). If in the previously obtained identity authority cross vector, the value of the technical maintenance personnel on the device status data access association weight (for example, corresponding to (v_{ip3})) is (4), then after splicing the identity authority cross vector with the access operation behavior preference (here, for example, splicing in sequence), in the new access control judgment basis vector, (v_{d1}=v_{ip1}), (v_{d2}=v_{ip2}), (v_{d3}=v_{ip3}), (v_{d4}=v_{ip4}), (v_{d5}=v_{b1}=3), (v_{d6}=0) (for example, the initial other uninvolved elements are (0)). This splicing operation not only takes into account the relationship between the user's identity attributes and the authority mechanism, but also takes into account the user's actual operating behavior habits.

[0058] From the perspective of artificial intelligence, this is similar to integrating various aspects of user information when building a user portrait. In the recommendation system, the user portrait contains the user's basic attributes (such as age, gender, etc.) and the user's behavioral data (such as purchase history, browsing history, etc.). The access control judgment basis in this application is like a user portrait for access control, which comprehensively describes the user's characteristics in terms of permissions, identity and behavior, and provides a richer basis for the final access control decision.

[0059] 5. Target Permission Mechanism Allocation Vector The target permission mechanism allocation vector is a first permission mechanism linkage map generated based on the access control discrimination basis, and is a vector obtained by adjusting the identity permission cross vectors corresponding to each basic access control permission mechanism. The first permission mechanism linkage map describes the permission involvement status between each basic access control permission mechanism.

[0060] Assume that the target permission mechanism allocation vector is (V_{t}=[v_{t1}, v_{t2}, v_{t3}]).

[0061] For example, permission mechanism A mainly involves data query permissions, and permission mechanism B involves data modification permissions. In the linkage map of the first permission mechanism, it is stipulated that when the user's demand for data query reaches a certain level (this level is determined by the relevant elements in the access control judgment basis), the restrictions on the relevant data modification permissions can be appropriately relaxed (in permission mechanism B). For example, in the identity permission cross vector, the component value corresponding to the user's query permission for permission mechanism A (for example, (v_{ip1})) is high, such as (v_{ip1}=8). According to the linkage map, if (v_{ip1}>5), the data modification permissions related to the query permission in permission mechanism B can be adjusted.

[0062] For example, in the identity-authority cross vector, the initial association value with the authority mechanism B (for example, (v_{ip2})) is (3). Then, when the target authority mechanism allocation vector is adjusted, the component value (v_{t2}) corresponding to the data modification authority related to the query authority in the authority mechanism B will be increased accordingly, for example, to (4) (the increase in this application is determined according to the rules in the linkage graph, and the specific values ​​are only examples). At the same time, (v_{t1}) and (v_{t3}) remain unchanged or are adjusted accordingly according to other rules or initial settings.

[0063] The above process is similar to the strategy adjustment in reinforcement learning. In reinforcement learning, the agent adjusts its strategy (similar to adjusting the identity-authority cross vector to obtain the target authority mechanism allocation vector) according to the state of the environment (similar to the state represented by the access control judgment basis and the first authority mechanism linkage map) to achieve the optimal goal (in access control, it is to reasonably allocate permissions to ensure safe and efficient access).

[0064] Therefore, the permission mechanism configuration vector, identity attribute representation vector, identity permission intersection vector, access control judgment basis and target permission mechanism allocation vector accurately quantify and model access control from different aspects, ensuring the security, rationality and efficiency of database access in complex systems such as the smart urban rail cloud platform. These vectors are interrelated and progressive, from the initial definition of permission mechanism and identity attributes to the final target permission mechanism allocation, to build a complete and rigorous access control system.

[0065] In an optional embodiment, after obtaining the corresponding identity-authority cross vector and before adjusting to obtain the corresponding target authority mechanism allocation vector, the method further includes: optimizing the identity-authority cross vectors corresponding to each basic access control authority mechanism respectively according to the generated second authority mechanism linkage map to obtain the corresponding original authority mechanism allocation vector; wherein the second authority mechanism linkage map is determined by identifying the authority coordination state of each basic access control authority mechanism in each historical reference sample in a set historical reference sample set. On this basis, adjusting to obtain the corresponding target authority mechanism allocation vector based on the identity-authority cross vectors corresponding to each basic access control authority mechanism respectively based on the first authority mechanism linkage map includes: optimizing the original authority mechanism allocation vectors corresponding to each basic access control authority mechanism respectively based on the first authority mechanism linkage map to obtain the corresponding target authority mechanism allocation vector.

[0066] In the previous database access control system, starting from the permission mechanism configuration vector and the identity attribute representation vector, the identity permission cross vector is obtained through a cross operation. In this optional embodiment, after obtaining the identity permission cross vector and before adjusting the target permission mechanism allocation vector, a new operation process is introduced.

[0067] First, based on the generated second permission mechanism linkage graph, the identity permission cross vectors corresponding to each basic access control permission mechanism are optimized respectively, so as to obtain the corresponding original permission mechanism allocation vector. This second permission mechanism linkage graph is determined by identifying the permission coordination status of each basic access control permission mechanism in each historical reference sample in the set historical reference sample set.

[0068] For example, a historical reference sample set contains 100 historical reference samples. In each historical reference sample, there are different permission coordination states between the basic access control permission mechanisms. For example, in some historical reference samples, the coordination relationship between permission mechanism A and permission mechanism B is manifested in that when the data query permission in permission mechanism A is used in large quantities, the data modification permission in permission mechanism B is also adjusted accordingly in a certain proportion (such as 30%) of the samples. Through a comprehensive analysis of these 100 historical reference samples, this permission coordination state between the basic access control permission mechanisms is identified, and then a second permission mechanism linkage map is constructed.

[0069] Take permission mechanism A and permission mechanism B as examples. For example, in the identity permission cross vector, the vector corresponding to permission mechanism A is [3, 2, 1], and the vector corresponding to permission mechanism B is [2, 1, 2]. In the process of constructing the second permission mechanism linkage map, it is found that the first element in permission mechanism A (for example, the access frequency corresponding to the high permission level) and the third element in permission mechanism B (for example, the modification permission corresponding to a specific data type) are associated in the historical reference sample set. When the value of the first element of permission mechanism A is greater than 2 (such as 3 in this example), the third element of permission mechanism B will be adjusted accordingly in 70% of the historical reference samples (such as the value increased by 1). Based on this association, the identity permission cross vector is optimized. For the vector [3, 2, 1] of permission mechanism A, since the first element meets the condition of being greater than 2, the vector of permission mechanism B is adjusted according to the permission coordination status in the historical reference sample. The original vector [2, 1, 2] of permission mechanism B is adjusted to [2, 1, 3]. This adjusted vector is the original permission mechanism allocation vector corresponding to permission mechanism B. The same operation will be performed on all basic access control permission mechanisms to obtain the corresponding original permission mechanism allocation vectors.

[0070] On this basis, based on the first permission mechanism linkage map, the original permission mechanism allocation vectors corresponding to each basic access control permission mechanism are optimized respectively to obtain the corresponding target permission mechanism allocation vector. The first permission mechanism linkage map describes the permission involvement status between each basic access control permission mechanism. For example, the first permission mechanism linkage map shows that the second element in permission mechanism A (for example, the access permission corresponding to a specific period of time) is associated with the first element in permission mechanism C (for example, the high-level access permission corresponding to specific data). If in the original permission mechanism allocation vector obtained previously, the vector of permission mechanism A is [4, 3, 2], and the vector of permission mechanism C is [3, 2, 1], and according to the rules of the first permission mechanism linkage map, when the second element of permission mechanism A is greater than 2 (here 3), the first element of permission mechanism C needs to be increased by 1. Then after adjustment, the target permission mechanism allocation vector of permission mechanism C becomes [4, 2, 1]. The same adjustment operation will optimize all the original permission mechanism allocation vectors according to the various associations in the first permission mechanism linkage map, so as to obtain the final target permission mechanism allocation vector.

[0071] In this way, by introducing the concepts of the second permission mechanism linkage map and the original permission mechanism allocation vector, the permission allocation process is further refined and optimized. When constructing the second permission mechanism linkage map, a large amount of data from the historical reference sample set is used to dig out the deep-level associations between permission mechanisms. For example, the synergistic relationship between different permission mechanism elements is accurately analyzed from 100 historical reference samples. This analysis based on historical data makes the permission allocation more in line with actual usage scenarios and needs. In the process of adjusting the original permission mechanism allocation vector to obtain the target permission mechanism allocation vector, the permission involvement status between the permission mechanisms is considered again based on the first permission mechanism linkage map, and multiple rounds of optimization adjustments are performed. For example, in the example of permission mechanism A and permission mechanism C mentioned above, the target permission mechanism allocation vector of permission mechanism C is accurately adjusted through the sequential effects of the two permission mechanism linkage maps. This multi-level permission allocation method based on historical data and permission association relationships can more accurately allocate permissions based on the user's identity attributes, operation behavior preferences, and the inherent relationship between permission mechanisms, thereby improving the accuracy, rationality and security of database access control. At the same time, through the analysis and utilization of a large number of historical reference examples, the entire system can better adapt to different access requirements and permission management scenarios, avoiding the problem of unreasonable permission allocation caused by a single rule or simple judgment.

[0072] It can be seen that the core invention of the above embodiment is that by introducing a second permission mechanism linkage map constructed based on a historical reference sample set, the permission coordination status between the basic access control permission mechanisms is mined, the identity permission cross vector is optimized to obtain the original permission mechanism allocation vector, and then the target permission mechanism allocation vector is further optimized based on the first permission mechanism linkage map. This method uses historical data for deep mining, accurately considers the correlation between permission mechanisms, and optimizes permission allocation in multiple rounds. This improves the accuracy, rationality, and security of database access control, better adapts to different access requirements and permission management scenarios, and avoids unreasonable permission allocation.

[0073] Based on the above optional embodiments, the step of determining the second permission mechanism linkage map includes: obtaining a set historical reference sample set; wherein each historical reference sample includes: a historical reference identity information and corresponding prior information; the prior information includes at least one basic access control permission mechanism; by identifying the permission coordination weights of each two basic access control permission mechanisms in a single prior information, a permission coordination relationship list generated corresponding to each basic access control permission mechanism is obtained, wherein each list unit in the permission coordination relationship list corresponds to a query index used to record the corresponding two basic access control permission mechanisms; the permission coordination relationship list is used to characterize the second permission mechanism linkage map between the basic access control permission mechanisms.

[0074] Furthermore, the permission coordination weights of every two basic access control permission mechanisms in a single prior information are identified to obtain a permission coordination relationship list generated corresponding to the basic access control permission mechanisms, including: for each basic access control permission mechanism, the following processing is implemented: according to the prior information corresponding to each historical reference sample, each collaborative access control permission mechanism that meets the permission coordination conditions with a basic access control permission mechanism in a single prior information is identified, and the permission coordination weights between the one basic access control permission mechanism and each collaborative access control permission mechanism are respectively identified; through each permission coordination weight corresponding to each basic access control permission mechanism, combined with the indexes matched respectively for the basic access control permission mechanisms, and the target coordination weights set for every two basic access control permission mechanisms that do not meet the permission coordination conditions, a permission coordination relationship list is generated.

[0075] Based on the database access control system content previously explained, this part focuses on the specific steps of determining the second permission mechanism linkage map, which is a key part of the entire database access control technical solution and will be explained in depth and comprehensively below.

[0076] The first step is to obtain the set historical reference sample set. This historical reference sample set is the basic data source for the entire operation, and it contains many historical reference samples. Each historical reference sample is a valuable data point, which contains a historical reference identity information and the corresponding prior information. Prior information plays a very important role in this process, and it contains at least one basic access control permission mechanism. For example, the historical reference sample set contains 5,000 historical reference samples, which is a considerable number and can provide sufficient sample basis for subsequent analysis. In the prior information of each historical reference sample, there may be 3 to 5 basic access control permission mechanisms, which can be named permission mechanism A, permission mechanism B, permission mechanism C, etc. The existence and combination of these basic access control permission mechanisms in different historical reference samples, as well as the relationship between them, are the key elements for constructing the second permission mechanism linkage map.

[0077] Next, by identifying the permission coordination weights of each two basic access control permission mechanisms in a single prior information, we can obtain the permission coordination relationship list generated by each basic access control permission mechanism. This is a complex and detailed process that needs to be processed for each basic access control permission mechanism. Taking permission mechanism A as an example, this process is explained in detail.

[0078] According to the prior information corresponding to each historical reference sample, it is necessary to identify the collaborative access control permission mechanisms that meet the permission coordination conditions with permission mechanism A in a single prior information. This process requires checking each historical reference sample. For example, among these 5,000 historical reference samples, permission mechanism A and permission mechanism B meet the permission coordination conditions in 1,500 samples, which means that in 30% of the samples, there is a certain collaborative relationship between the two permission mechanisms. Similarly, permission mechanism C meets the permission coordination conditions in 1,000 samples, that is, there is a collaborative relationship in 20% of the samples. These proportional data reflect the frequency of collaboration between different permission mechanisms in historical data.

[0079] Then, for each pair of permission mechanisms that meet the permission coordination conditions, it is necessary to identify the permission coordination weights between them. For example, for the relationship between permission mechanism A and permission mechanism B, in the 1500 samples that meet the coordination conditions, the permission coordination weight between them is not a fixed value, but varies according to the specific circumstances in each sample. For example, in these samples, the value range of the permission coordination weight is between 0.3 and 0.9. After statistical analysis, the average permission coordination weight is 0.6. For permission mechanism A and permission mechanism C, in the 1000 samples that meet the coordination conditions, the value range of the permission coordination weight is between 0.2 and 0.8, and the average permission coordination weight is 0.4. The values ​​of these permission coordination weights reflect the closeness of the coordination relationship between different permission mechanisms.

[0080] At the same time, the target synergy weight set for every two basic access control permission mechanisms that do not meet the permission synergy conditions must also be considered. For example, for permission mechanism A and permission mechanism D, for example, in the entire 5,000 historical reference samples, there are almost no cases where the permission synergy conditions are met between them. In order to fully reflect the relationship between all permission mechanisms when constructing the permission synergy relationship list, a target synergy weight needs to be set. For example, this target synergy weight is set to 0.1, which is a relatively low value, indicating that the synergy relationship between them is very weak or almost non-existent, but this situation still needs to be considered when constructing the graph.

[0081] Then, the permission coordination relationship list is generated by combining the permission coordination weights corresponding to each basic access control permission mechanism, the indexes matched for each basic access control permission mechanism, and the target coordination weights set for situations where the permission coordination conditions are not met. For example, for permission mechanism A, it has a coordination weight of 0.6 with permission mechanism B, a coordination weight of 0.4 with permission mechanism C, and a target coordination weight of 0.1 with permission mechanism D. At the same time, each permission mechanism has its own index, for example, the index of permission mechanism A is 1, the index of permission mechanism B is 2, the index of permission mechanism C is 3, and the index of permission mechanism D is 4. Then in the permission coordination relationship list, the list units corresponding to permission mechanism A and permission mechanism B may contain the indexes of the two (1 and 2) and the permission coordination weight 0.6 between them. The list units corresponding to permission mechanism A and permission mechanism C contain indexes (1 and 3) and weights 0.4, and the list units corresponding to permission mechanism A and permission mechanism D contain indexes (1 and 4) and weights 0.1. Such list units will continue to increase according to different permission mechanism combinations, thereby constructing a complete permission coordination relationship list. Each list unit in the permission coordination relationship list corresponds to a query index used to record two corresponding basic access control permission mechanisms, and it can comprehensively and meticulously reflect the relationship between the various basic access control permission mechanisms.

[0082] Finally, this permission coordination relationship list is used to represent the second permission mechanism linkage map between the basic access control permission mechanisms. This map is of great significance in the entire database access control system. It is not just a simple data structure, but also an important basis for the entire permission allocation and management.

[0083] Taking a specific numerical example, for example, in subsequent operations, it is necessary to optimize the identity-authority cross vector corresponding to the permission mechanism A according to this second permission mechanism linkage map. For example, the identity-authority cross vector is [3, 2, 1]. If the cooperation weight between the permission mechanism A and the permission mechanism B in the permission coordination relationship list is high (such as 0.6), and according to the previous settings or rules, when this cooperation weight reaches a certain value, it is necessary to adjust a certain element in the identity-authority cross vector. For example, when the cooperation weight is greater than 0.5, it is necessary to increase the first element in the identity-authority cross vector by 1. Then after this operation, the identity-authority cross vector corresponding to the permission mechanism A becomes [4, 2, 1]. This adjusted vector will be used for the subsequent generation of the original permission mechanism allocation vector. Similarly, for other basic access control permission mechanisms, their identity-authority cross vectors will be adjusted according to their relationship in the permission coordination relationship list and the corresponding rules, which will affect the generation of the original permission mechanism allocation vector and ultimately affect the determination of the target permission mechanism allocation vector.

[0084] This method of determining the linkage map of the second permission mechanism starts from a historical reference sample set containing a large number of historical reference samples (such as 5,000) and deeply analyzes the prior information in each sample. Through a detailed analysis of the synergy relationship between different basic access control permission mechanisms, including determining the proportion of samples that meet the synergy conditions, calculating the synergy weight, and setting the target synergy weight that does not meet the synergy conditions, a comprehensive permission synergy relationship list is constructed to characterize the linkage map of the second permission mechanism. This map provides a basis for optimizing the identity permission cross vectors corresponding to each basic access control permission mechanism according to the generated second permission mechanism linkage map, and obtaining the corresponding original permission mechanism allocation vector. It makes the entire database access control process more accurate, reasonable and in line with the permission synergy law reflected by historical data. Through this method of analyzing and constructing a map based on a large amount of historical data, it can better adapt to various complex database access requirements and improve the accuracy, security and efficiency of database access control.

[0085] Therefore, by obtaining a set of historical reference samples containing historical reference identity information and prior information, the permission coordination weights between the basic access control permission mechanisms are identified to construct a permission coordination relationship list to characterize the linkage map of the second permission mechanism. A large number of historical samples (such as 5,000) are used to accurately analyze the permission coordination situation and clarify the weights of coordinated and non-coordinated relationships. This provides a basis for optimizing the identity permission cross vector and obtaining the original and target permission mechanism allocation vectors, making database access control more accurate and reasonable, in line with the historical permission coordination law, improving the accuracy and rationality of permission allocation, and being able to better adapt to complex database access requirements, improving the security and efficiency of database access control.

[0086] Under a possible design idea, the steps of mining the permission mechanism configuration vectors corresponding to each basic access control permission mechanism include: obtaining the corresponding permission mechanism knowledge graph for each basic access control permission mechanism; using a pre-debugging deep convolutional model, using each permission mechanism knowledge graph to embed knowledge vectors respectively, and obtaining the permission mechanism configuration vectors corresponding to each basic access control permission mechanism.

[0087] Based on the previous description of the technical solutions related to the database access control system, we will now explore in depth the important content of the steps of mining the permission mechanism configuration vectors corresponding to each basic access control permission mechanism.

[0088] For each basic access control permission mechanism, we must first obtain the corresponding permission mechanism knowledge graph. These permission mechanism knowledge graphs are the key starting point of the entire mining process, and they contain rich knowledge information about each basic access control permission mechanism. For example, taking permission mechanism A as an example, its corresponding permission mechanism knowledge graph may cover the permission setting scope of permission mechanism A under different data types, the permission allocation mode related to different user roles and permission mechanism A, and the interaction relationship between permission mechanism A and other related mechanisms in historical data. For example, this permission mechanism knowledge graph records the relationship between 10 different data types and permission mechanism A, and has corresponding permission allocation descriptions for 20 different user roles. It also includes interaction history records with another 5 related mechanisms.

[0089] Next, the deep convolutional model that has completed pre-debugging is used to embed knowledge vectors using the knowledge graphs of each permission mechanism, thereby obtaining the permission mechanism configuration vectors corresponding to each basic access control permission mechanism. The deep convolutional model plays a core role in this process. This deep convolutional model has been pre-debugging before. The pre-debugging process is a complex and critical process that involves training and optimizing the model using a large amount of sample data so that the model can accurately process the input permission mechanism knowledge graph. For example, in the pre-debugging process, 1,000 different permission mechanism knowledge graph samples may be used (these samples are similar to the actual permission mechanism knowledge graph in structure and content, but have different permission relationship settings and data distributions). The performance of the model is optimized by continuously adjusting the parameters of the model (such as the size of the convolution kernel, step size, number of layers, etc.) until the model reaches a certain accuracy and stability standard.

[0090] When using this pre-debugged deep convolutional model to embed knowledge vectors into the permission mechanism knowledge graph of permission mechanism A, the model will process the information in the knowledge graph according to its internal convolutional layer, pooling layer and other structures. For example, the convolutional layer of the model may extract features from the permission setting range in the knowledge graph, and use different convolution kernels to scan the numerical distribution in the permission setting range (for example, the permission values ​​for different data types may be between 1-10, and the convolutional layer will extract the distribution characteristics of these values), and the pooling layer will perform dimensionality reduction processing on the features extracted by the convolutional layer to retain key features. In this process, for example, the information about user roles and permission allocation modes in the permission mechanism knowledge graph of permission mechanism A is converted into a feature vector with a dimension of 100 after being processed by the convolutional layer and the pooling layer (this dimension is determined based on the structure and processing method of the model).

[0091] As the model processes the information of each part in the permission mechanism knowledge graph, all the processed information is finally integrated into a complete vector, which is the permission mechanism configuration vector corresponding to permission mechanism A. For example, the permission mechanism configuration vector corresponding to permission mechanism A is [1, 2, 3, 4, 5], where each element corresponds to the quantitative results of different parts of the permission mechanism knowledge graph after being processed by the model. For example, the first element may be related to the permission characteristics related to the data type, and the second element may be related to the permission characteristics related to the user role, etc. Similarly, for other basic access control permission mechanisms, such as permission mechanism B and permission mechanism C, the same process will be used, that is, first obtain their respective permission mechanism knowledge graphs (these permission mechanism knowledge graphs are different from permission mechanism A in content and structure, reflecting the characteristics of their respective permission mechanisms), and then use the pre-debugged deep convolutional model to embed the knowledge vector to obtain the corresponding permission mechanism configuration vectors, such as the permission mechanism configuration vector corresponding to permission mechanism B may be [2, 3, 4, 5, 6], and the permission mechanism configuration vector corresponding to permission mechanism C may be [3, 4, 5, 6, 7], etc.

[0092] This method of mining the permission mechanism configuration vector through the permission mechanism knowledge graph and deep convolution model is an important basis for permission management in the entire database access control system. The permission mechanism configuration vector plays a key role in subsequent operations, such as cross-operation with the identity attribute representation vector to obtain the identity permission cross-vector. For example, when calculating the identity permission cross-vector, the elements in the permission mechanism configuration vector will be operated with the corresponding elements in the identity attribute representation vector according to the corresponding rules. If the value of an element in the permission mechanism configuration vector (such as the permission element related to the data type) is high, and the value of the element corresponding to the access requirement of the data type in the identity attribute representation vector is also high, then in the identity permission cross-vector, the cross-result value related to the data type will be relatively high, which will affect the subsequent access control judgment basis and the determination of the target permission mechanism allocation vector and a series of operations.

[0093] From a more macro perspective, this mining method can make full use of the rich information in the permission mechanism knowledge graph, and with the help of the powerful feature extraction and vector embedding capabilities of the deep convolution model, it can accurately convert complex permission mechanism knowledge into a vector form that is easy to calculate and process. Compared with the traditional permission configuration method, this method is more accurate and flexible. For example, the traditional method may simply set the permission mechanism configuration vector based on some fixed rules and experience, while this method based on the knowledge graph and deep convolution model can perform accurate vector mining based on the actual complex relationships of different permission mechanisms (such as the multi-faceted relationships recorded in the permission mechanism knowledge graph). Moreover, since the deep convolution model has learned the rules in a large amount of sample data during the pre-debugging process, it can better adapt to various complex situations when processing different permission mechanism knowledge graphs, thereby improving the accuracy, reliability and adaptability of the entire database access control system.

[0094] It can be seen that by obtaining the permission mechanism knowledge graph for each basic access control permission mechanism, and then using the pre-debugging deep convolution model to embed the knowledge vector, the permission mechanism configuration vector is obtained. The powerful function of the deep convolution model is used to process the knowledge graph containing various information (such as different data types, user roles, and the interaction relationship between related mechanisms, etc.), such as using 1,000 samples to optimize the model in pre-debugging. The obtained vector is accurate and easy to calculate later. Compared with traditional methods, it is more accurate and flexible, can adapt to complex situations, and improve the accuracy, reliability and adaptability of the database access control system.

[0095] In an alternative technical solution, the identity authentication task in the method is implemented through a debugged target access control authority verification algorithm, and the target access control authority verification algorithm includes: a knowledge interaction branch, which is used to obtain the cross-vector of each identity authority; a linkage graph generation branch, which is used to generate the first authority mechanism linkage graph; a first authority allocation decision branch, which is used to output each target authority mechanism allocation vector; a permission indication output branch, which is used to determine the access control authority indication; and a second permission allocation decision branch, which is used to output each original authority mechanism allocation vector.

[0096] Based on the previous series of explanations on database access control systems, we will now deeply analyze how the identity authentication task in this alternative technical solution is implemented through the debugged target access control permission verification algorithm.

[0097] First, the target access control permission verification algorithm includes a knowledge interaction branch, the main function of which is to obtain the identity permission cross vector. The identity permission cross vector is a key intermediate result in the entire access control system. It is obtained by cross-operating the permission mechanism configuration vector and the identity attribute representation vector involved previously. For example, in the previous operation, if the permission mechanism configuration vector contains multiple elements, such as [3, 2, 1], and the identity attribute representation vector is [2, 3, 1], the identity permission cross vector is obtained through the corresponding cross operation (the specific algorithm of the cross operation is not elaborated here, but it can be clearly understood that it is a logical operation based on vector elements). For example, this identity permission cross vector is [6, 6, 1], which plays an important reference role in the subsequent access control decision process. The knowledge interaction branch is responsible for accurately obtaining such an identity permission cross vector, which may involve reading data from a specific data structure or cache area that stores these vectors, and ensuring the integrity and accuracy of the data.

[0098] Next, the linkage map generation branch is used to generate the first permission mechanism linkage map. The first permission mechanism linkage map describes the permission involvement status between each basic access control permission mechanism. In the process of generating this map, it is necessary to comprehensively sort out and analyze the various permission mechanism relationships in the entire database access control system. For example, in a more complex database system, there may be multiple basic access control permission mechanisms, such as permission mechanism A, permission mechanism B, permission mechanism C, etc. Permission mechanism A may be associated with permission mechanism B in certain data access types. For example, when a certain permission in permission mechanism A is granted, a related permission in permission mechanism B may need to be adjusted according to certain rules. For example, there are 10 different basic access control permission mechanisms in the system, and the linkage map generation branch needs to analyze and record the possible pairwise associations between these 10 permission mechanisms. In this process, it may be necessary to refer to a large amount of system log data or permission history record data. For example, by analyzing 1,000 permission history records, it is found that there are 300 records of a certain association between permission mechanism A and permission mechanism B, which provides a basis for constructing the association between them in the first permission mechanism linkage map. Through such comprehensive and detailed analysis, a complete first-level authority mechanism linkage map is eventually generated.

[0099] Then, the first permission allocation decision branch is used to output each target permission mechanism allocation vector. The target permission mechanism allocation vector is the final permission allocation result obtained after comprehensive consideration of multiple factors. When this branch is working, it will make decisions based on important information such as the identity permission cross vector and the first permission mechanism linkage map obtained previously. For example, when the identity permission cross vector is [6, 6, 1], and according to the association relationship between permission mechanism A and permission mechanism B in the first permission mechanism linkage map, if an element of permission mechanism A (for example, the first element 6) satisfies a rule in the first permission mechanism linkage map (for example, when this element is greater than 5, the relevant permissions of permission mechanism B need to be adjusted), then the first permission allocation decision branch will adjust the permission allocation vector element corresponding to permission mechanism B according to this rule. For example, the original permission allocation vector of permission mechanism B is [2, 3, 1], which may become [3, 3, 1] after adjustment. This adjusted vector is part of the target permission mechanism allocation vector. For other basic access control permission mechanisms, the first permission allocation decision branch will also be adjusted one by one in a similar manner according to different identity permission cross vectors and the rules in the first permission mechanism linkage map, and finally output the allocation vectors of each target permission mechanism.

[0100] Let's look at the permission indication output branch. Its function is to determine the access control permission indication. The access control permission indication is the key result that directly determines whether the access request is allowed and the degree of access allowed. When determining this indication, the permission indication output branch will comprehensively consider various information obtained previously, including the target permission mechanism allocation vector, etc. For example, if an element in the target permission mechanism allocation vector indicates that the access right to a specific data type is 3 (here 3 represents a permission level, such as a high-level permission among high, medium, and low), then the permission indication output branch may determine that the access request is allowed to perform corresponding high-level operations on the corresponding data, such as read and write operations, based on the correspondence between the permission level and the access behavior pre-set by the system. If the element in the target permission mechanism allocation vector indicates a low permission level, then only read operations or limited write operations may be allowed. This branch needs to accurately output the access control permission indication based on various permission allocation results and system rules to ensure the security of the database and the rationality of access.

[0101] Finally, the second permission allocation decision branch is used to output the allocation vectors of each original permission mechanism. The work of this branch is closely related to other parts of the entire permission allocation process. In the process of optimizing the identity permission cross vector through the second permission mechanism linkage map to obtain the original permission mechanism allocation vector mentioned above, the second permission allocation decision branch plays a key decision-making role. For example, after obtaining the identity permission cross vector, the second permission allocation decision branch will adjust according to the permission synergy relationship in the second permission mechanism linkage map. For example, the identity permission cross vector is [4, 3, 2]. The second permission mechanism linkage map shows that there is a synergy relationship between permission mechanism A and permission mechanism B. When the element corresponding to permission mechanism A in the identity permission cross vector (here is 4) meets certain conditions (such as greater than 3), it is necessary to adjust the element of permission mechanism B in the original permission mechanism allocation vector. For example, the initial value of permission mechanism B in the original permission mechanism allocation vector is [2, 3, 1], which may become [3, 3, 1] after adjustment. This is part of the original permission mechanism allocation vector output by the second permission allocation decision branch. For other basic access control permission mechanisms, the second permission allocation decision branch will also adjust the identity permission cross vector in a similar manner according to the different collaborative relationships in the second permission mechanism linkage map, and finally output the allocation vectors of each original permission mechanism.

[0102] The above technical solution for implementing identity authentication tasks through the debugged target access control permission verification algorithm has branches that cooperate with each other and are closely related. The knowledge interaction branch provides the necessary basic data of identity and permission cross vectors for the entire algorithm. The first permission mechanism linkage map constructed by the linkage map generation branch provides a permission relationship framework for permission allocation decisions. The first permission allocation decision branch outputs the target permission mechanism allocation vector based on the previous two. The permission indication output branch determines the access control permission indication according to the target permission mechanism allocation vector. The second permission allocation decision branch outputs the original permission mechanism allocation vector in the intermediate process, which supplements and improves the entire permission allocation process. This collaborative working method makes the identity authentication and permission allocation process of the entire database access control system more accurate, reasonable, and efficient, and can better meet the database security management requirements under different user identities and access requirements.

[0103] With this design, the identity authentication task is achieved through the collaborative work of various branches in the target access control permission verification algorithm. The knowledge interaction branch obtains the identity permission cross vector, the linkage graph generation branch constructs the graph, the first and second permission allocation decision branches output the target and original permission mechanism allocation vectors respectively, and the permission indication output branch determines the permission indication. The branches are closely related, making identity authentication and permission allocation more accurate, reasonable, and efficient, meeting the database security management requirements under different needs.

[0104] On the basis of the above-mentioned replaceable technical scheme, the second permission mechanism linkage map generated is used to optimize the identity permission cross vectors corresponding to each basic access control permission mechanism respectively, and obtain the corresponding original permission mechanism allocation vector, including: adopting the second permission allocation decision branch, taking each basic access control permission mechanism as the corresponding knowledge entity, and performing an X-order loop on each identity permission cross vector through the permission interaction characteristics indicated by the permission collaborative relationship list to obtain the original permission mechanism allocation vector corresponding to each basic access control permission mechanism; wherein X is a set positive integer.

[0105] Based on the previously described replaceable technical solution based on the target access control permission verification algorithm, this paper further explores the process of optimizing the identity permission cross vectors corresponding to each basic access control permission mechanism according to the generated second permission mechanism linkage graph, and then obtaining the corresponding original permission mechanism allocation vector.

[0106] First of all, it is clear that the second permission allocation decision branch is used here to perform relevant operations. In this process, each basic access control permission mechanism is regarded as a corresponding knowledge entity. This means that each basic access control permission mechanism is treated as an independent unit with specific knowledge connotations and permission attributes. For example, in a database access control system, there are basic access control permission mechanisms such as permission mechanism A, permission mechanism B, and permission mechanism C. They each have different permission settings and control logics, which constitute their unique attributes as knowledge entities.

[0107] Then, through the permission interaction characteristics indicated by the permission coordination relationship list, an X-order loop operation is performed on each identity permission cross vector to obtain the original permission mechanism allocation vector corresponding to each basic access control permission mechanism. The permission coordination relationship list here is a key element in the previous process of constructing the second permission mechanism linkage map. It records in detail the permission coordination relationship between each basic access control permission mechanism. For example, the permission coordination relationship list may indicate that there is a certain corresponding permission interaction feature between permission mechanism A and permission mechanism B. This feature may be reflected in that when a certain permission attribute of permission mechanism A changes, it will affect the relevant permission attributes of permission mechanism B in a certain way.

[0108] This process is illustrated with numerical examples. For example, there are three basic access control permission mechanisms, namely permission mechanism A, permission mechanism B, and permission mechanism C. In terms of identity permission cross vectors, for example, the identity permission cross vector corresponding to permission mechanism A is [3, 2, 1], the corresponding one to permission mechanism B is [2, 3, 1], and the corresponding one to permission mechanism C is [1, 2, 3]. For another example, the permission coordination relationship list shows that there is a permission interaction feature between permission mechanism A and permission mechanism B. When the first element of permission mechanism A (value is 3) meets certain conditions (such as greater than 2), it will affect the second element of permission mechanism B. At the same time, there is also a corresponding permission interaction feature between permission mechanism B and permission mechanism C. When the third element of permission mechanism B (value is 1) meets certain conditions (such as equal to 1), it will affect the first element of permission mechanism C.

[0109] Now set X to 3 and start the X-order loop operation. In the first loop, for the relationship between permission mechanism A and permission mechanism B, since the first element 3 of permission mechanism A is greater than 2, the second element of permission mechanism B is adjusted according to the permission interaction characteristics in the permission coordination relationship list. For example, the adjustment rule is to add 1 to the original value, then the identity permission cross vector of permission mechanism B becomes [2, 4, 1]. Then, in this loop, for the relationship between permission mechanism B and permission mechanism C, since the third element 1 of permission mechanism B is equal to 1, the first element of permission mechanism C is adjusted according to the permission interaction characteristics. For example, the adjustment rule is to add 1 to the original value, then the identity permission cross vector of permission mechanism C becomes [2, 2, 3].

[0110] Enter the second cycle and check the relationship between permission mechanism A and permission mechanism B again. At this time, the first element 3 of permission mechanism A is still greater than 2. Continue to adjust the second element of permission mechanism B according to the previous rules (here, for example, the adjustment rules are the same each time), and the identity permission cross vector of permission mechanism B becomes [2, 5, 1]. Then check the relationship between permission mechanism B and permission mechanism C. Since the third element 1 of permission mechanism B is equal to 1, adjust the first element of permission mechanism C again, and the identity permission cross vector of permission mechanism C becomes [3, 2, 3].

[0111] In the third cycle, repeat the above operation. For permission mechanism A and permission mechanism B, the first element 3 of permission mechanism A is greater than 2, and the second element of permission mechanism B is adjusted again to become [2, 6, 1]. For permission mechanism B and permission mechanism C, the third element 1 of permission mechanism B is equal to 1, and the first element of permission mechanism C is adjusted to become [4, 2, 3].

[0112] After this three-order cycle, the original permission mechanism allocation vector corresponding to permission mechanism A is [3, 2, 1] (because no adjustment operation is performed on itself in this process), the original permission mechanism allocation vector corresponding to permission mechanism B is [2, 6, 1], and the original permission mechanism allocation vector corresponding to permission mechanism C is [4, 2, 3].

[0113] This method of obtaining the original permission mechanism allocation vector by performing an X-order cycle on the identity permission cross vector based on the permission interaction characteristics indicated by the permission coordination relationship list through the second permission allocation decision branch, taking the basic access control permission mechanism as the knowledge entity, is of great significance in the entire database access control system. It is based on the complex relationship network between the permission mechanisms reflected by the permission coordination relationship list constructed previously, and gradually optimizes the identity permission cross vector through multiple cycles to obtain the original permission mechanism allocation vector. This process fully considers the mutual influence and coordination relationship between different permission mechanisms, so that the obtained original permission mechanism allocation vector more accurately reflects the permission allocation requirements of the entire system.

[0114] Compared with the traditional permission allocation method, this method is more detailed and precise. The traditional method may simply allocate permissions based on a single permission rule or a fixed permission association relationship, while this method based on X-order loops can deeply explore the dynamic relationship between various permission mechanisms. For example, in a large and complex database system, there may be many basic access control permission mechanisms and complex permission interactions. This method can better adapt to this complexity and ensure the rationality and accuracy of permission allocation. At the same time, by setting a positive integer X, the number of loops can be flexibly adjusted according to the actual needs and complexity of the system, further enhancing the adaptability and customizability of this permission allocation method.

[0115] In this way, through the second permission allocation decision branch, the permission mechanism is taken as the knowledge entity, and the identity permission cross vector is cycled X-order according to the permission interaction characteristics to obtain the original permission mechanism allocation vector. The cycle process is demonstrated with numerical examples, and the complex relationship between permission mechanisms is considered. Multiple rounds of optimization make the vector more accurately reflect the permission requirements. Compared with the traditional method, it is more detailed and accurate, adapts to complex systems, and X can be flexibly adjusted to enhance adaptability and customizability.

[0116] On the basis of the above-mentioned replaceable technical scheme, the method of using each access control judgment basis to generate a first permission mechanism linkage map includes: using the linkage map to generate branches, using each access control judgment basis to respectively calculate the permission coordination weight between each two basic access control permission mechanisms, and based on the calculated permission coordination weight between each two basic access control permission mechanisms, obtaining a permission involvement relationship list generated corresponding to each basic access control permission mechanism, wherein each list unit in the permission involvement relationship list corresponds to a query index used to record the corresponding two basic access control permission mechanisms; using the permission involvement relationship list to characterize the first permission mechanism linkage map between the basic access control permission mechanisms.

[0117] Based on the previous explanation of the replaceable technical solution, this paper deeply explores the key technical solution of using various access control judgment bases to generate the first permission mechanism linkage map.

[0118] First, this process uses linkage graphs to generate branches for operation. The access control judgment basis is an important basis obtained through a series of complex operations in the entire database access control system. It integrates multiple information such as identity permission cross vectors and access operation behavior preferences mined from access operation behavior events on the access request side. For example, an access control judgment basis may contain multiple elements, and the values ​​of these elements reflect different permission-related characteristics.

[0119] When generating the first permission mechanism linkage map, use each access control judgment basis to calculate the permission coordination weight between each two basic access control permission mechanisms. For example, there are 5 basic access control permission mechanisms in the database access control system, which are marked as permission mechanism 1, permission mechanism 2, permission mechanism 3, permission mechanism 4 and permission mechanism 5. For permission mechanism 1 and permission mechanism 2, calculations are performed based on the values ​​of the relevant elements in the access control judgment basis. For example, the values ​​of some elements related to permission mechanism 1 in the access control judgment basis are [3, 2, 1], and the values ​​of some elements related to permission mechanism 2 are [2, 3, 1]. Through the corresponding calculation logic (based on the previously set system logic), the permission coordination weight between them is obtained to be 0.6. Similarly, all possible pairwise combinations of permission mechanism 1 and permission mechanism 3, permission mechanism 1 and permission mechanism 4, permission mechanism 1 and permission mechanism 5 are calculated.

[0120] Continue to calculate the permission coordination weights between permission mechanism 2 and permission mechanism 3. For example, if the values ​​of some elements related to permission mechanism 2 are [2, 3, 1], and the values ​​of some elements related to permission mechanism 3 are [1, 2, 3], the permission coordination weight between them is 0.4. In this way, all basic access control permission mechanisms in pairs are calculated to obtain a complete permission coordination weight matrix.

[0121] Based on the calculated permission coordination weights between every two basic access control permission mechanisms, a permission involvement relationship list generated for each basic access control permission mechanism is obtained. For example, for permission mechanism 1, its permission coordination weight with permission mechanism 2 is 0.6, and its weight with permission mechanism 3 is 0.4, and so on. These weight values ​​and the corresponding permission mechanism indexes are recorded in the permission involvement relationship list. For example, if the index of permission mechanism 1 is 1 and the index of permission mechanism 2 is 2, then in the permission involvement relationship list, the list units corresponding to permission mechanism 1 and permission mechanism 2 may contain three values ​​1, 2 and 0.6, which respectively represent the indexes of the two permission mechanisms and the permission coordination weights between them. Similarly, for other permission mechanism combinations, the relevant information is recorded in the permission involvement relationship list in this way.

[0122] Each list unit in this permission-involved relationship list corresponds to a query index for recording the corresponding two basic access control permission mechanisms. Through such a permission-involved relationship list, the relationship between the basic access control permission mechanisms can be fully and meticulously reflected. For example, when it is necessary to query the relationship between permission mechanism 3 and permission mechanism 5, the corresponding list unit in the permission-involved relationship list can be used to quickly obtain relevant information such as the permission coordination weight between them.

[0123] Finally, this permission-involved relationship list is used to represent the first permission mechanism linkage map between each basic access control permission mechanism. This first permission mechanism linkage map is an important basis for permission management in the entire database access control system. It clearly shows the permission involvement status between each basic access control permission mechanism. For example, when the permission coordination weight between permission mechanism 1 and permission mechanism 2 is high (such as 0.8), this close relationship can be intuitively seen in the first permission mechanism linkage map, which means that in the process of permission allocation and access control decision-making, when it comes to permission adjustment of permission mechanism 1, it may be necessary to focus on the impact on permission mechanism 2, and vice versa.

[0124] This method of generating branches through linkage graphs, calculating permission coordination weights based on access control discrimination, and then constructing a permission-involved relationship list and characterizing the linkage graph of the first permission mechanism is of great significance in many aspects in the database access control system. From the perspective of permission management, it provides a comprehensive perspective to examine the relationship between the basic access control permission mechanisms. By accurately calculating the permission coordination weights between each two permission mechanisms, the degree of association between them can be accurately grasped. For example, in a large database system, there may be many complex permission mechanisms. Without such an accurate relationship graph, confusion or unreasonable situations may occur when making permission allocation and access control decisions.

[0125] To further illustrate with numerical examples, for example, the permission synergy weight between permission mechanism 1 and permission mechanism 4 is 0.9, which indicates that there is a high degree of synergy between them. When allocating permissions, if a permission element of permission mechanism 1 is adjusted, based on the high degree of synergy shown in the linkage diagram of the first permission mechanism, it is necessary to be more cautious when adjusting the relevant permission elements of permission mechanism 4, and it may be necessary to make corresponding adjustments according to certain rules to ensure the rationality and security of permission allocation of the entire system.

[0126] Compared with the traditional permission management method, this method of constructing the linkage map of the first permission mechanism is more scientific and accurate. The traditional method may be based on simple permission classification or fixed permission association rules without in-depth consideration of the dynamic collaborative relationship between the various permission mechanisms. For example, the traditional method may simply divide the permission mechanism into several major categories, and then allocate permissions according to preset rules, without considering the complex interactions that may exist between different permission mechanisms during the actual access operation. This method of constructing the linkage map of the first permission mechanism based on the access control judgment basis can better adapt to the permission management needs of modern complex database systems and improve the accuracy of permission allocation and the security of the system.

[0127] In this way, the linkage graph generation branch uses the access control judgment basis to calculate the permission coordination weight to construct a permission involvement relationship list to characterize the first permission mechanism linkage graph. The impact of the relationship between permission mechanisms on permission allocation is reflected by numerical examples. Compared with the traditional method, it is more scientific and accurate, takes into account dynamic coordination relationships, adapts to complex system requirements, and improves the accuracy of permission allocation and system security.

[0128] On the basis of the above-mentioned replaceable technical scheme, the first permission mechanism linkage map is based on which the identity permission cross vectors corresponding to each basic access control permission mechanism are respectively used to adjust the corresponding target permission mechanism allocation vector, including: adopting the first permission allocation decision branch, taking each basic access control permission mechanism as the corresponding knowledge entity, performing a Y-order loop on each identity permission cross vector through the first permission mechanism linkage map indicated by the permission involvement relationship list, and obtaining the target permission mechanism allocation vector corresponding to each basic access control permission mechanism; wherein Y is a set positive integer.

[0129] Based on the previous explanation of the replaceable technical solutions, this paper further analyzes the technical solution based on the linkage map of the first permission mechanism, and obtains the corresponding target permission mechanism allocation vector by adjusting the identity permission cross vector corresponding to each basic access control permission mechanism.

[0130] First, this operation is performed using the first permission allocation decision branch. In this process, each basic access control permission mechanism is regarded as a corresponding knowledge entity. These knowledge entities each contain rich information related to permission control and are the core objects of the entire permission adjustment process.

[0131] Then, the operation is performed with the help of the first permission mechanism linkage map indicated by the permission involvement relationship list. The first permission mechanism linkage map is constructed through a series of complex operations. It shows in detail the permission involvement status between the basic access control permission mechanisms, and the permission involvement relationship list is a quantitative and indexed representation of this status.

[0132] Next, perform a Y-order loop operation on each identity permission cross vector to obtain the target permission mechanism allocation vector corresponding to each basic access control permission mechanism. Y is a set positive integer, which determines the number of loops, thereby affecting the result of the final target permission mechanism allocation vector.

[0133] In order to explain this process more clearly, for example, there are four basic access control permission mechanisms in the database access control system, namely permission mechanism A, permission mechanism B, permission mechanism C and permission mechanism D. At the same time, for example, the identity permission cross vector corresponding to permission mechanism A is [3, 2, 1], the corresponding to permission mechanism B is [2, 3, 1], the corresponding to permission mechanism C is [1, 2, 3], and the corresponding to permission mechanism D is [3, 1, 2].

[0134] For another example, the permission-involved relationship list includes the relationship information between each permission mechanism. For example, the relationship between permission mechanism A and permission mechanism B in the first permission mechanism linkage map is reflected through the permission-involved relationship list as follows: when the first element of permission mechanism A changes, it will affect the second element of permission mechanism B, and the quantitative relationship of this impact is that if the first element of permission mechanism A is greater than 2, the second element of permission mechanism B needs to increase by 1. The relationship between permission mechanism B and permission mechanism C is that when the third element of permission mechanism B is equal to 1, the first element of permission mechanism C needs to decrease by 1.

[0135] Now set Y to 3 and start the Y-order loop operation.

[0136] In the first cycle, for the relationship between permission mechanism A and permission mechanism B, since the first element 3 of permission mechanism A is greater than 2, the second element of permission mechanism B is adjusted according to the relationship information in the permission-involved relationship list. After the adjustment, the identity-authority cross vector of permission mechanism B becomes [2, 4, 1]. Next, for the relationship between permission mechanism B and permission mechanism C, since the third element 1 of permission mechanism B is equal to 1, the first element of permission mechanism C is adjusted according to the relationship information, and the identity-authority cross vector of permission mechanism C becomes [0, 2, 3].

[0137] Enter the second cycle and check the relationship between permission mechanism A and permission mechanism B again. At this time, the first element 3 of permission mechanism A is still greater than 2. Continue to adjust the second element of permission mechanism B according to the previous rules, and the identity permission cross vector of permission mechanism B becomes [2, 5, 1]. Then check the relationship between permission mechanism B and permission mechanism C. Since the third element 1 of permission mechanism B is equal to 1, adjust the first element of permission mechanism C again, and the identity permission cross vector of permission mechanism C becomes [-1, 2, 3].

[0138] In the third cycle, the above operation is repeated. For permission mechanism A and permission mechanism B, the first element 3 of permission mechanism A is greater than 2, and the second element of permission mechanism B is adjusted again to become [2, 6, 1]. For permission mechanism B and permission mechanism C, the third element 1 of permission mechanism B is equal to 1, and the first element of permission mechanism C is adjusted to become [-2, 2, 3].

[0139] After these three cycles, the target permission mechanism allocation vector corresponding to permission mechanism A is [3, 2, 1] (because no adjustment operation is performed on itself in this process), the target permission mechanism allocation vector corresponding to permission mechanism B is [2, 6, 1], the target permission mechanism allocation vector corresponding to permission mechanism C is [-2, 2, 3], and the target permission mechanism allocation vector corresponding to permission mechanism D is [3, 1, 2] (because no adjustment operation related to permission mechanism D is involved in the entire process).

[0140] This method of using the first permission allocation decision branch, taking the basic access control permission mechanism as the knowledge entity, and performing a Y-order cycle on the identity permission cross vector according to the first permission mechanism linkage graph indicated by the permission involvement relationship list to obtain the target permission mechanism allocation vector is of great significance in the database access control system.

[0141] From the perspective of the permission management of the entire system, this method makes permission allocation more precise and detailed. It fully considers the complex relationship between the basic access control permission mechanisms, and gradually adjusts the identity permission cross vector through multiple cycles to obtain the target permission mechanism allocation vector. Compared with the traditional permission allocation method, the traditional method may only allocate permissions based on simple rules or a single association relationship, while this Y-order cycle-based method can deeply explore the dynamic relationship between the various permission mechanisms.

[0142] For example, in a complex database system, there may be a large number of permission mechanisms and complex permission interactions. Traditional permission allocation methods may not be able to accurately adapt to this complexity, which may easily lead to unreasonable permission allocation or security vulnerabilities. However, this Y-order cycle-based method can better cope with such complex situations and ensure the rationality and security of permission allocation by accurately adjusting the relationship information in the first permission mechanism linkage map.

[0143] At the same time, by setting a positive integer Y, the number of loops can be flexibly adjusted according to the actual needs and complexity of the system. If the system is relatively simple, a smaller value of Y may be sufficient to meet the needs; if the system is very complex, containing numerous permission mechanisms and complex relationships, the value of Y can be appropriately increased to ensure that the target permission mechanism allocation vector is obtained accurately after enough loop adjustments. This flexibility further enhances the adaptability and customizability of this permission allocation method, enabling it to be better applied to database access control systems of different scales and complexities.

[0144] Therefore, through the first authority allocation decision branch, with the authority mechanism as the knowledge entity, the identity authority cross vector is cycled Y-order according to the linkage map indicated by the authority involvement relationship list to obtain the target authority mechanism allocation vector. The cycle process is demonstrated with numerical examples, fully considering the complex relationship between authority mechanisms. Compared with traditional methods, it is more precise and detailed, and can cope with complex system situations. Y can be flexibly set to enhance adaptability and customizability, ensuring reasonable and safe authority allocation.

[0145] Based on the above-mentioned replaceable technical scheme, the debugging step of the target access control permission verification algorithm includes: obtaining each historical reference sample; each historical reference sample includes: a historical reference identity information and corresponding prior information; using the each historical reference sample, the generated original access control permission verification algorithm is debugged in multiple stages to obtain the target access control permission verification algorithm generated after the last stage loop, wherein, in the first stage loop debugging process, the original access control permission verification algorithm is used, based on the called historical reference identity information and the set basic access control permission mechanisms, after outputting the permission indication training information, based on the difference between the permission indication training information and the corresponding prior information, the algorithm weights of each branch in the original access control permission verification algorithm are adjusted.

[0146] Furthermore, the original access control permission verification algorithm is used to output permission indication training information based on the historical reference identity information called and the set basic access control permission mechanisms, including: extracting the identity attribute representation vector set and the access operation behavior preference corresponding to the historical reference identity information called; and obtaining the corresponding set basic access control permission mechanisms, and extracting the obtained permission mechanism configuration vectors respectively; using the original access control permission verification algorithm, using the identity permission cross vector obtained by crossing each permission mechanism configuration vector with the identity attribute representation vector set, combined with the access operation behavior preference, to construct a first permission mechanism linkage map, and through the second permission mechanism linkage map, updating each identity permission cross vector to obtain each original permission mechanism allocation vector, and through the first permission mechanism linkage map, optimizing each original permission mechanism allocation vector to obtain each target permission mechanism allocation vector, and then obtaining the permission indication training information based on the target permission mechanism allocation vector and each identity permission cross vector.

[0147] Based on the previous explanation of the replaceable technical solutions, this paper deeply analyzes the key technical solution of the debugging step of the target access control permission verification algorithm.

[0148] First, obtain each historical reference sample. These historical reference samples play a vital role in the entire debugging process. Each historical reference sample contains a historical reference identity information and corresponding prior information. For example, there are 1,000 historical reference samples. The historical reference identity information in each sample may contain information such as the user's position, department, work experience, etc., while the prior information covers the correct information known about the permissions for the historical reference identity information, including the actual permission allocation under different basic access control permission mechanisms.

[0149] Next, the generated original access control permission verification algorithm is debugged in multiple stages using various historical reference examples. In this process, the focus is on the operation of each stage of loop debugging.

[0150] During the first-order loop debugging process, the original access control permission verification algorithm is first used to output permission indication training information based on the historical reference identity information called and the set basic access control permission mechanisms. This process is relatively complicated, and the specific operations are as follows: extract the identity attribute representation vector set and access operation behavior preference corresponding to the historical reference identity information called. For example, for a certain historical reference identity information, if it is a technician identity related to database operations, its identity attribute representation vector set may contain elements representing positions (such as technicians corresponding to a value of 2), department elements (such as belonging to the core technology department corresponding to a value of 3), etc., and the access operation behavior preference may be reflected in frequent query operations on specific types of data (such as technical parameter data) (higher values ​​on elements representing query frequency).

[0151] At the same time, obtain the corresponding basic access control permission mechanisms, and extract the permission mechanism configuration vectors respectively. For example, there are three basic access control permission mechanisms, namely permission mechanism A, permission mechanism B, and permission mechanism C. The permission mechanism configuration vector of permission mechanism A may be [3, 2, 1], where the elements may correspond to different data access levels, access periods, and permission settings related to data types; the permission mechanism configuration vector of permission mechanism B is [2, 3, 1]; and the permission mechanism configuration vector of permission mechanism C is [1, 2, 3].

[0152] Then, the original access control permission verification algorithm is used to obtain the identity permission cross vector obtained by crossing each permission mechanism configuration vector with the identity attribute representation vector set. Take permission mechanism A as an example. For example, some elements related to permission mechanism A in the identity attribute representation vector set are [2, 3]. Through a specific cross operation (based on the logic set by the previous system), some elements in the identity permission cross vector are obtained, for example, [6, 6]. In the same way, some elements of the identity permission cross vector corresponding to permission mechanism B and permission mechanism C are obtained. Combined with the access operation behavior preference, the first permission mechanism linkage map is constructed. This construction process is based on the previously obtained identity permission cross vector and the inherent relationship between each permission mechanism. For example, permission mechanism A and permission mechanism B may be associated with each other in some data access. When some elements in the identity permission cross vector meet specific conditions, this association relationship will be reflected in the first permission mechanism linkage map.

[0153] Next, through the second permission mechanism linkage map, each identity permission cross vector is updated to obtain each original permission mechanism allocation vector. For example, the second permission mechanism linkage map shows that there is a permission interaction relationship between permission mechanism A and permission mechanism C. When an element of permission mechanism A in the identity permission cross vector (such as 6 obtained previously) meets certain conditions (such as greater than 5), the identity permission cross vector element corresponding to permission mechanism C will be adjusted to obtain an updated identity permission cross vector, and then the original permission mechanism allocation vector will be obtained. For example, the original permission mechanism allocation vector of permission mechanism C after adjustment is [2, 3, 4].

[0154] Afterwards, through the first permission mechanism linkage map, each original permission mechanism allocation vector is optimized to obtain each target permission mechanism allocation vector. For example, the first permission mechanism linkage map shows that there is a correlation between permission mechanism B and permission mechanism C. When an element of permission mechanism B in the original permission mechanism allocation vector meets a specific condition, the target permission mechanism allocation vector of permission mechanism C will be optimized and adjusted. For example, the target permission mechanism allocation vector of permission mechanism C after optimization is [3, 3, 4].

[0155] Finally, based on each target permission mechanism allocation vector and each identity permission cross vector, permission indication training information is obtained. This permission indication training information reflects the permission indication that should be given according to the current algorithm processing result. For example, the elements in the target permission mechanism allocation vector may represent the access permission level for a specific data type. Combined with the relevant elements in the identity permission cross vector, the permission indication training information for the historical reference identity information can be determined, such as whether to allow or not allow read and write operations on certain data.

[0156] After obtaining the permission indication training information, the algorithm weights of each branch in the original access control permission verification algorithm are adjusted based on the difference between the permission indication training information and the corresponding prior information. For example, if the access rights to a certain data indicated in the permission indication training information are inconsistent with the actual correct permissions in the prior information, then it is necessary to analyze which branch of the algorithm caused the difference. For example, if a problem occurs in the branch that constructs the first permission mechanism linkage map, resulting in a deviation in the subsequent permission allocation, the algorithm weight of this branch will be adjusted. For example, the original algorithm weight of the branch is 0.5, and depending on the size and nature of the difference, it may be adjusted to 0.6 or 0.4, etc.

[0157] By performing such multi-stage loop debugging on multiple historical reference samples (such as 1,000), the algorithm weights of each branch in the original access control permission verification algorithm are continuously adjusted, so that the algorithm can get closer and closer to the correct results in the prior information when processing different historical reference samples. Finally, the target access control permission verification algorithm generated after the last stage loop is obtained. This debugging method gradually optimizes the algorithm through a large amount of historical data, fully considering the complex relationship between historical reference identity information, prior information and various permission mechanisms, and ensuring the accuracy and reliability of the algorithm in practical applications.

[0158] In this way, the original access control permission verification algorithm is debugged in multiple stages by obtaining historical reference examples. In the first stage loop, the vector is extracted based on the historical reference identity information and permission mechanism to build a graph, update and optimize the vector to obtain permission indication training information, and then adjust the algorithm weights according to the difference between it and the prior information. Multi-stage debugging is performed using multiple examples (such as 1,000) to make the algorithm close to the correct result, considering multiple complex relationships, and ensuring the accuracy and reliability of the algorithm.

[0159] In summary, by obtaining the identity information to be verified at the access request end of the smart urban rail cloud platform database cluster, accurate permission control is performed on the database cluster structure (including the main cloud center database, the backup cloud center database and the station database). The identity permission cross vector is obtained by intersecting the permission mechanism configuration vector with the identity attribute representation vector, and the identity attribute is fully considered to make the permission judgment more in line with the actual situation of the user. The access control judgment basis is generated by splicing with the access operation behavior preference, taking into account the user's operation habits and improving the accuracy of the judgment. The first permission mechanism linkage map generated based on this can clearly present the permission involvement status, and the adjustment of the target permission mechanism allocation vector is more reasonable. The final access control permission indication can effectively ensure the security of the database, accurately meet the reasonable access needs of different users, and ensure the orderly and safe operation of the smart urban rail cloud platform database cluster.

[0160] Further, Figure 2Schematic diagram of a database access control system 200 provided in an embodiment of the present application. Figure 2 The database access control system 200 shown includes a processor 210, and the processor 210 can call and run a computer program from a memory to implement the method in the embodiment of the present application.

[0161] Alternatively, if Figure 2 As shown, the database access control system 200 may further include a memory 230. The processor 210 may call and run a computer program from the memory 230 to implement the method in the embodiment of the present application.

[0162] The memory 230 may be a separate device independent of the processor 210 , or may be integrated into the processor 210 .

[0163] Alternatively, if Figure 2 As shown, the database access control system 200 may further include a transceiver 220. The processor 210 may control the transceiver 220 to interact with other devices. Specifically, the transceiver 220 may send information or data to other devices, or receive information or data sent by other devices.

[0164] Optionally, the database access control system 200 may implement the corresponding processes corresponding to the storage engine or components in the storage engine (such as a processing module) or a device deployed with a storage engine in each method of the embodiments of the present application, which will not be described in detail here for the sake of brevity.

[0165] It should be understood that the processor of the embodiment of the present application may be an integrated circuit chip with signal processing capabilities.

[0166] It is understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory. It should be noted that the memory of the systems and methods described herein is intended to include but is not limited to suitable types of memory.

[0167] Based on the above, a readable storage medium is provided, on which a program or instruction is stored, and when the program or instruction is executed by a processor, the steps of the above method are implemented.

[0168] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0169] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the present application, all of which are within the protection of the present application.

Claims

1. A database access control method based on information verification, characterized in that: The method is applied to a database access control system, and the method comprises: Obtain the identity information to be verified corresponding to the access request end; wherein the access target of the access request end is the database cluster of the smart urban rail cloud platform; the database cluster at least includes a primary cloud center database, a backup cloud center database and a station database; Crossing the permission mechanism configuration vectors corresponding to each of the set basic access control permission mechanisms with the identity attribute representation vector sets mined for each identity attribute in the identity information to be verified, respectively, to obtain corresponding identity permission cross vectors; The cross vectors of each identity authority are respectively spliced ​​with the access operation behavior preferences mined from the access operation behavior events of the identity information to be verified to obtain the corresponding access control judgment basis; Using each access control discrimination basis, a first permission mechanism linkage map is generated, and based on the first permission mechanism linkage map, the identity permission cross vectors corresponding to each basic access control permission mechanism are respectively used to adjust and obtain the corresponding target permission mechanism allocation vector; wherein the first permission mechanism linkage map is used to describe the permission involvement status between each basic access control permission mechanism; In combination with the target authority mechanism allocation vectors and the identity authority intersection vectors respectively determined corresponding to the basic access control authority mechanisms, the access control authority indication corresponding to the identity information to be verified is determined in each basic access control authority mechanism.

2. The method according to claim 1, characterized in that After obtaining the corresponding identity-authority cross vector and before adjusting to obtain the corresponding target authority mechanism allocation vector, the method further includes: optimizing the identity-authority cross vectors corresponding to the respective basic access control authority mechanisms according to the generated second authority mechanism linkage map, and obtaining the corresponding original authority mechanism allocation vector; wherein the second authority mechanism linkage map is determined by identifying the authority coordination state of each historical reference sample in the set historical reference sample set by the respective basic access control authority mechanisms; Based on the first permission mechanism linkage map, the corresponding target permission mechanism allocation vector is adjusted through the identity permission cross vectors corresponding to each basic access control permission mechanism, including: based on the first permission mechanism linkage map, the original permission mechanism allocation vectors corresponding to each basic access control permission mechanism are optimized to obtain the corresponding target permission mechanism allocation vector.

3. The method according to claim 2, characterized in that The step of determining the second authority mechanism linkage map includes: Acquire a set of historical reference sample sets; wherein each historical reference sample includes: a historical reference identity information and corresponding prior information; the prior information includes at least one basic access control authority mechanism; By identifying the permission coordination weights of each two basic access control permission mechanisms in a single prior information, a permission coordination relationship list generated corresponding to each of the basic access control permission mechanisms is obtained, wherein each list unit in the permission coordination relationship list corresponds to a query index used to record the corresponding two basic access control permission mechanisms; The permission coordination relationship list is used to represent a second permission mechanism linkage map between the basic access control permission mechanisms; The permission coordination weights of each two basic access control permission mechanisms in the single prior information are identified to obtain a permission coordination relationship list generated corresponding to each basic access control permission mechanism, including: For each basic access control permission mechanism, the following processing is performed: according to the prior information corresponding to each historical reference example, each collaborative access control permission mechanism that satisfies the permission coordination condition with a basic access control permission mechanism in a single prior information is identified, and the permission coordination weights between the one basic access control permission mechanism and each collaborative access control permission mechanism are identified respectively; A permission coordination relationship list is generated by using the permission coordination weights corresponding to each basic access control permission mechanism, combined with the indexes matched respectively for each basic access control permission mechanism, and the target coordination weights set for every two basic access control permission mechanisms that do not meet the permission coordination conditions.

4. The method according to claim 1, characterized in that The steps of mining the permission mechanism configuration vectors corresponding to the basic access control permission mechanisms include: For each basic access control permission mechanism, obtain the corresponding permission mechanism knowledge graph; A pre-debugged deep convolutional model is adopted, and knowledge vectors are embedded respectively using the knowledge graphs of each permission mechanism to obtain the permission mechanism configuration vectors corresponding to each basic access control permission mechanism.

5. The method according to any one of claims 2 to 4, characterized in that: The identity authentication task in the method is implemented by a debugged target access control authority verification algorithm, and the target access control authority verification algorithm includes: a knowledge interaction branch, a linkage graph generation branch, a first authority allocation decision branch, an authority indication output branch, and a second authority allocation decision branch; The knowledge interaction branch is used to obtain the cross vector of each identity authority; The linkage map generation branch is used to generate the first authority mechanism linkage map; The first permission allocation decision branch is used to output each target permission mechanism allocation vector; The permission indication output branch is used to determine the access control permission indication; The second permission allocation decision branch is used to output each original permission mechanism allocation vector.

6. The method according to claim 5, characterized in that The step of optimizing the identity permission cross vectors corresponding to the respective basic access control permission mechanisms based on the generated second permission mechanism linkage graph to obtain the corresponding original permission mechanism allocation vectors includes: The second permission allocation decision branch is adopted, with each basic access control permission mechanism as the corresponding knowledge entity, and the permission interaction characteristics indicated by the permission collaboration relationship list are used to perform an X-order loop on each identity permission cross vector to obtain the original permission mechanism allocation vector corresponding to each basic access control permission mechanism; wherein X is a set positive integer.

7. The method according to claim 5, characterized in that The method of generating a first permission mechanism linkage graph by using each access control judgment basis includes: The linkage graph is adopted to generate branches, and each access control discrimination basis is used to calculate the permission coordination weight between each two basic access control permission mechanisms, and based on the calculated permission coordination weight between each two basic access control permission mechanisms, a permission involvement relationship list generated corresponding to each basic access control permission mechanism is obtained, wherein each list unit in the permission involvement relationship list corresponds to a query index used to record the corresponding two basic access control permission mechanisms; The permission involvement relationship list is used to represent the first permission mechanism linkage map between the basic access control permission mechanisms.

8. The method according to claim 5, characterized in that The step of adjusting the corresponding target permission mechanism allocation vector based on the first permission mechanism linkage graph through the identity permission cross vectors corresponding to each basic access control permission mechanism respectively includes: The first permission allocation decision branch is adopted, and each basic access control permission mechanism is taken as the corresponding knowledge entity. Through the first permission mechanism linkage map indicated by the permission involvement relationship list, a Y-order loop is performed on each identity permission cross vector to obtain the target permission mechanism allocation vector corresponding to each basic access control permission mechanism; wherein Y is a set positive integer.

9. The method according to claim 5, characterized in that The debugging steps of the target access control authority verification algorithm include: Obtain each historical reference sample; each historical reference sample includes: a historical reference identity information and corresponding prior information; The generated original access control permission verification algorithm is debugged by multi-order loops using the historical reference examples to obtain the target access control permission verification algorithm generated after the last loop, wherein, in the first-order loop debugging process, the original access control permission verification algorithm is used to output permission indication training information based on the historical reference identity information called and the various basic access control permission mechanisms set, and then the algorithm weights of each branch in the original access control permission verification algorithm are adjusted based on the difference between the permission indication training information and the corresponding prior information; The original access control authority verification algorithm is used to output authority indication training information based on the historical reference identity information called and the set basic access control authority mechanisms, including: Extract the identity attribute representation vector set and the access operation behavior preference according to the historical reference identity information called; and obtain the corresponding basic access control permission mechanisms, and extract the obtained permission mechanism configuration vectors respectively; The original access control permission verification algorithm is adopted, and the identity permission cross vector obtained by crossing each permission mechanism configuration vector with the identity attribute representation vector set is used, combined with the access operation behavior preference, to construct a first permission mechanism linkage map, and through the second permission mechanism linkage map, each identity permission cross vector is updated to obtain each original permission mechanism allocation vector, and through the first permission mechanism linkage map, after optimizing each original permission mechanism allocation vector to obtain each target permission mechanism allocation vector, permission indication training information is obtained based on each target permission mechanism allocation vector and each identity permission cross vector.

10. A database access control system, characterized in that: The method comprises at least one processor and a memory; the memory stores computer-executable instructions; the at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the method according to any one of claims 1 to 9.

Images