A fine-grained control authorization method based on domain ontology
Through the fine management and authorization method based on the domain ontology, a hierarchical concept system and formal language description are built to realize the fine classification and hierarchical management of data, solving the shortcomings of traditional authorization strategies in business scenario adaptability and security, and achieving efficient and accurate authorization management and data security.
Patent Information
- Application Number
- CN202411739356.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-29
- Publication Date
- 2025-04-08
AI Technical Summary
Traditional authorization strategies are based on the static allocation of roles or permissions, and are difficult to adapt to complex and changeable business scenarios, and are prone to the risk of privacy leakage and abuse, and the accuracy and flexibility of authorization decisions are poor.
The fine management and authorization method is adopted based on the domain ontology, and by building a hierarchical conceptual system and formal language description, the fine classification and hierarchical management of data are realized, different access permissions and management strategies are set for data at different levels, accurate authorization strategies are formulated, and the corresponding relationship between access users and access resources is clearly specified.
It realizes authorization management with high security and accurate decision-making, which can better meet business needs, improve the flexibility and adaptability of the system, significantly improve the security of data, protect users' privacy rights and interests, and promote efficient use and secure sharing of data.
Smart Images
Figure CN119783124A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of precise data authorization, and in particular to a fine-grained control authorization method based on domain ontology construction. Background Art
[0002] Domain ontology is a standardized description of concepts, entities and their relationships in a specific domain. It provides a shared, formalized conceptual model to describe the knowledge in the domain. The construction of domain ontology usually involves steps such as determining the scope of the domain, collecting domain knowledge, defining concepts and relationships, and building the ontology structure. High-quality domain ontology can be efficiently constructed through manual construction by experts, assistance from automated tools, or a combination of the two.
[0003] Although data precision authorization technology plays an important role in improving data management efficiency, protecting data privacy and ensuring data security, traditional authorization strategies are often based on static allocation of roles or permissions, which are difficult to adapt to complex and changing business scenarios, prone to risks of privacy leakage and abuse, and poor in the accuracy and flexibility of authorization decisions. Summary of the invention
[0004] In view of the above-mentioned deficiencies in the prior art, the technical problem to be solved by this patent application is how to provide a fine-grained control authorization method based on domain ontology with high security and accurate decision-making.
[0005] In order to solve the above technical problems, the present invention adopts the following technical solutions:
[0006] A fine-grained control authorization method based on domain ontology construction includes the following steps: S1: constructing a domain ontology according to the needs of the domain, forming a hierarchical concept system, and describing it in a formal language; S2: based on the hierarchical concept system in step S1, finely classifying and hierarchically managing data, setting different access rights and management strategies for data at different levels; S3: formulating precise authorization strategies according to business needs and security requirements, and the authorization strategies clearly specify the corresponding relationship between access users and access resources.
[0007] As an optimization, in step S1, the construction of the domain ontology includes the following steps: A1: clarify the domain where the ontology needs to be constructed, and collect the basic knowledge of the domain; A2: define the concepts in the domain, clarify their connotation and extension, and classify the concepts to form a hierarchical concept system; A3: define the relationship between concepts, and use formal language to describe these relationships; A4: take specific entities or actual data as instances, fill them into the ontology, and assign attribute values and relationship values to the instances; A5: evaluate the constructed ontology, check its completeness, consistency, and accuracy, and dynamically optimize and adjust according to the evaluation results.
[0008] As an optimization, in step A1, the basic knowledge includes but is not limited to professional terms, concepts, and relationships; in step A3, the relationship between concepts includes but is not limited to inclusion relationship, inheritance relationship, and attribute relationship; in A3, the formal language includes but is not limited to OWL and RDF, which are used to describe the above relationships.
[0009] As an optimization, in step S2, when setting different access permissions for data at different levels, the role-based access control (RBAC) or attribute-based access control (ABAC) method is used to achieve fine-grained control of permissions.
[0010] As an optimization, in step S2, when different management strategies are set for data at different levels, the quality of the data is monitored and evaluated in real time through the rules and constraints in the domain ontology, so that data quality issues can be discovered and handled in a timely manner to ensure the accuracy and consistency of the data.
[0011] As an optimization, step S2 also includes utilizing the knowledge representation and reasoning capabilities in the ontology to realize automated processing of business processes.
[0012] As an optimization, in step S3, when formulating precise authorization policies, attribute information in the domain ontology is used to implement attribute-based authorization decisions, and matching and authorization are performed according to the attributes of the user and the attributes of the data.
[0013] As an optimization, in step S3, the authorization policy is dynamically adjusted according to factors such as user behavior and environmental changes, and intelligent algorithms or A1 learning technology are used to predict user behavior and adjust the authorization policy in advance.
[0014] As an optimization, in step S3, when formulating a precise authorization policy, the authorization process is audited and traced, and the basis and results of the authorization decision are recorded.
[0015] The present invention has the following advantages:
[0016] As an advanced form of knowledge representation, domain ontology uses formal language to accurately describe concepts, attributes, relationships and instances within a domain. This knowledge representation method not only improves the structuring of information, but also provides a solid foundation for subsequent reasoning and decision-making. Precision authorization technology based on domain ontology realizes flexible customization and dynamic adjustment of authorization policies by introducing dynamic factors such as attributes and context. Compared with traditional authorization policies, which are often based on static allocation of roles or permissions, authorization policies can better meet business needs and improve the flexibility and adaptability of the system. Precision authorization technology not only relies on the construction of domain ontology, but can also be combined with cutting-edge technologies such as blockchain, privacy computing, and federated learning to provide a more secure, efficient and reliable solution for precision authorization.
[0017] Precision authorization technology based on domain ontology breaks the shackles of traditional authorization models and proposes a new authorization concept centered on knowledge and driven by data. This concept emphasizes the fine management and precise authorization of data, aiming to achieve efficient use and secure sharing of data resources. In the process of achieving precise authorization, the technology adopts advanced attribute-based access control methods. These methods achieve fine-grained control of access rights by introducing attributes as a dynamic factor. At the same time, combined with the knowledge and rules in the domain ontology, the accuracy and intelligence of authorization decisions can be further improved. Precision authorization technology has broad application prospects in many fields, such as medical care, finance, education, etc. In these fields, data security and privacy are crucial. Precision authorization technology based on domain ontology can provide customized authorization solutions for these fields to meet their specific business needs and security requirements.
[0018] Through precise authorization technology, we can achieve fine management and access control of data resources. Only authorized users or systems can access specific data resources, thus effectively preventing data leakage and illegal access. This mechanism can significantly improve data security and protect the privacy rights of users. Precise authorization technology can be combined with business processes to realize the automation and intelligent processing of business processes. By introducing knowledge and rules in the domain ontology, it can automatically determine the user's authority and access requirements and provide corresponding services or resources for them. This mechanism can optimize business processes and improve business processing efficiency and accuracy. Under the premise of protecting data privacy, precise authorization technology can also promote the sharing and exchange of data between different organizations or systems. By introducing technical means such as privacy computing, data sharing and computing can be achieved without exposing the original data. This mechanism can break the phenomenon of data islands and promote the circulation and utilization of data to maximize its value. BRIEF DESCRIPTION OF THE DRAWINGS
[0019] Figure 1 This is a flow chart of a fine-grained control authorization method based on domain ontology construction described in the present invention. DETAILED DESCRIPTION
[0020] The present invention is further described in detail below in conjunction with the accompanying drawings. In the description of the present invention, it should be understood that the directions or positional relationships indicated by directional words such as "upper, lower" and "top, bottom" are usually based on the directions or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description. Unless otherwise stated, these directional words do not indicate or imply that the devices or components referred to must have a specific direction or be constructed and operated in a specific direction, and therefore cannot be understood as limiting the scope of protection of the present invention; the directional words "inside and outside" refer to the inside and outside relative to the contours of each component itself.
[0021] like Figure 1 As shown, a fine-grained control and authorization method based on domain ontology construction includes the following steps: S1: constructing the domain ontology according to the needs of the domain, forming a hierarchical concept system, and describing it in a formal language; S2: based on the hierarchical concept system in step S1, finely classifying and hierarchically managing the data, setting different access rights and management strategies for data at different levels; S3: formulating precise authorization strategies according to business needs and security requirements, and the authorization strategies clearly specify the correspondence between access users and access resources.
[0022] In this embodiment, in step S1, the construction of the domain ontology includes the following steps: A1: clarify the domain in which the ontology needs to be constructed, and collect the basic knowledge of the domain; A2: define the concepts in the domain, clarify their connotation and extension, and classify the concepts to form a hierarchical concept system; A3: define the relationship between concepts, and use formal language to describe these relationships; A4: take specific entities or actual data as instances, fill them into the ontology, and assign attribute values and relationship values to the instances; A5: evaluate the constructed ontology, check its completeness, consistency, and accuracy, and dynamically optimize and adjust according to the evaluation results.
[0023] In this embodiment, in step A1, the basic knowledge includes but is not limited to professional terms, concepts, and relationships; in step A3, the relationship between concepts includes but is not limited to inclusion relationship, inheritance relationship, and attribute relationship; in A3, the formal language includes but is not limited to OWL and RDF, which are used to describe the above relationships.
[0024] In this embodiment, in step S2, when different access permissions are set for data at different levels, a role-based access control (RBAC) or attribute-based access control (ABAC) method is used to implement fine-grained control of permissions.
[0025] In this embodiment, in step S2, when different management strategies are set for data at different levels, the quality of the data is monitored and evaluated in real time through the rules and constraints in the domain ontology, and data quality problems are discovered and handled in a timely manner to ensure the accuracy and consistency of the data.
[0026] In this embodiment, step S2 also includes utilizing the knowledge representation and reasoning capabilities in the ontology to realize automated processing of the business process.
[0027] In this embodiment, in step S3, when formulating a precise authorization strategy, attribute information in the domain ontology is used to implement attribute-based authorization decisions, and matching and authorization are performed according to the attributes of the user and the attributes of the data.
[0028] In this embodiment, in step S3, the authorization policy is dynamically adjusted according to factors such as user behavior and environmental changes, and intelligent algorithms or A1 learning technology are used to predict user behavior and adjust the authorization policy in advance.
[0029] In this embodiment, in step S3, when formulating a precise authorization policy, the authorization process is audited and traced, and the basis and results of the authorization decision are recorded.
[0030] The present invention has the following advantages:
[0031] As an advanced form of knowledge representation, domain ontology uses formal language to accurately describe concepts, attributes, relationships and instances within a domain. This knowledge representation method not only improves the structuring of information, but also provides a solid foundation for subsequent reasoning and decision-making. Precision authorization technology based on domain ontology realizes flexible customization and dynamic adjustment of authorization policies by introducing dynamic factors such as attributes and context. Compared with traditional authorization policies, which are often based on static allocation of roles or permissions, authorization policies can better meet business needs and improve the flexibility and adaptability of the system. Precision authorization technology not only relies on the construction of domain ontology, but can also be combined with cutting-edge technologies such as blockchain, privacy computing, and federated learning to provide a more secure, efficient and reliable solution for precision authorization.
[0032] Precision authorization technology based on domain ontology breaks the shackles of traditional authorization models and proposes a new authorization concept centered on knowledge and driven by data. This concept emphasizes the fine management and precise authorization of data, aiming to achieve efficient use and secure sharing of data resources. In the process of achieving precise authorization, the technology adopts advanced attribute-based access control methods. These methods achieve fine-grained control of access rights by introducing attributes as a dynamic factor. At the same time, combined with the knowledge and rules in the domain ontology, the accuracy and intelligence of authorization decisions can be further improved. Precision authorization technology has broad application prospects in many fields, such as medical care, finance, education, etc. In these fields, data security and privacy are crucial. Precision authorization technology based on domain ontology can provide customized authorization solutions for these fields to meet their specific business needs and security requirements.
[0033] Through precise authorization technology, we can achieve fine management and access control of data resources. Only authorized users or systems can access specific data resources, thus effectively preventing data leakage and illegal access. This mechanism can significantly improve data security and protect the privacy rights of users. Precise authorization technology can be combined with business processes to realize the automation and intelligent processing of business processes. By introducing knowledge and rules in the domain ontology, it can automatically determine the user's authority and access requirements and provide corresponding services or resources for them. This mechanism can optimize business processes and improve business processing efficiency and accuracy. Under the premise of protecting data privacy, precise authorization technology can also promote the sharing and exchange of data between different organizations or systems. By introducing technical means such as privacy computing, data sharing and computing can be achieved without exposing the original data. This mechanism can break the phenomenon of data islands and promote the circulation and utilization of data to maximize its value.
[0034] Finally, it should be noted that those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims and their equivalents, the present invention is also intended to include these modifications and variations.
Claims
1. A fine control authorization method based on domain ontology, characterized in that: The following steps are involved: S1: According to the needs of the domain, construct the domain ontology, form a hierarchical concept system, and use formal language to describe it; S2: Based on the hierarchical concept system in step S1, finely classify and hierarchically manage the data, and set different access rights and management policies for data at different levels; S3: Develop precise authorization policies based on business needs and security requirements. The authorization policies clearly specify the correspondence between access users and access resources.
2. According to a method for fine-grained control and authorization based on domain ontology construction according to claim 1, it is characterized in that: In step S1, the construction of the domain ontology includes the following steps: A1: Identify the domain in which the ontology needs to be constructed and collect the basic knowledge of the domain; A2: Define the concepts in the field, clarify their connotation and extension, and classify the concepts to form a hierarchical concept system; A3: Define the relationships between concepts and describe these relationships using formal language; A4: Take specific entities or actual data as instances, fill them into the ontology, and assign attribute values and relationship values to the instances; A5: Evaluate the constructed ontology, check its completeness, consistency, and accuracy, and dynamically optimize and adjust it based on the evaluation results.
3. According to a method for fine-grained control and authorization based on domain ontology construction according to claim 2, it is characterized in that: In step A1, the basic knowledge includes but is not limited to professional terms, concepts, and relationships; in step A3, the relationships between concepts include but are not limited to inclusion relationships, inheritance relationships, and attribute relationships; in A3, formal languages include but are not limited to OWL and RDF, which are used to describe the above relationships.
4. According to the method of fine control authorization based on domain ontology construction according to claim 3, it is characterized in that: In step S2, when setting different access permissions for data at different levels, the role-based access control (RBAC) or attribute-based access control (ABAC) method is used to achieve fine-grained control of permissions.
5. According to a method for fine-grained control and authorization based on domain ontology construction according to claim 4, it is characterized in that: In step S2, when different management strategies are set for data at different levels, the quality of the data is monitored and evaluated in real time through the rules and constraints in the domain ontology, and data quality issues are discovered and handled in a timely manner to ensure the accuracy and consistency of the data.
6. According to the method of fine control authorization based on domain ontology construction according to claim 5, it is characterized in that: Step S2 also includes utilizing the knowledge representation and reasoning capabilities in the ontology to realize automated processing of business processes.
7. According to claim 6, a fine control authorization method based on domain ontology construction is characterized in that: In step S3, when formulating precise authorization strategies, attribute information in the domain ontology is used to implement attribute-based authorization decisions, and matching and authorization are performed according to the attributes of the user and the attributes of the data.
8. According to the method of fine control authorization based on domain ontology construction according to claim 7, it is characterized in that: In step S3, the authorization policy is dynamically adjusted according to factors such as user behavior and environmental changes, and intelligent algorithms or A1 learning technology are used to predict user behavior and adjust the authorization policy in advance.
9. According to the method of fine control authorization based on domain ontology construction of claim 8, it is characterized in that: In step S3, when formulating a precise authorization policy, the authorization process is audited and traced, and the basis and results of the authorization decision are recorded.