Government affair data access control method based on identity verification

Abstract

The invention belongs to the technical field of information security, and particularly relates to a government affair data access control method based on identity verification, which comprises the following steps: establishing an access content-access frequency accumulation histogram of all access IPs; obtaining the credibility of each access IP based on the rule of the access content of the access IP and the access amount; establishing a government affair data network based on the access content accessed in the login mode; obtaining a plurality of I-class access content clusters; according to the consistency of the access request content of the user and the access IP of the access record of the user, obtaining the initial credibility of the user; and according to the distribution similarity of the access records of the user who has accessed the request access content and the corresponding user who requests the access content in each class I access content cluster, determining the final credibility of the user who requests the access content, and completing the authority control of the request access content of the user. According to the invention, the accuracy and efficiency of government affair data access control are improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology. More specifically, the present invention relates to a method for accessing and controlling government affairs data based on identity authentication. Background Art

[0002] Government affairs data refers to various data resources legally collected, generated, stored, and managed by government departments at all levels and their technical support units during the performance of their duties. Due to its high sensitivity and public nature, it has high value. In order to prevent the leakage of government affairs data from harming government departments and causing economic losses, it is necessary to authenticate the client accessing the government affairs data to control permissions.

[0003] In order to ensure the access security and efficiency of government affairs data, multi-dimensional identity authentication and dynamic permission allocation are often adopted at present. In related technologies, for example, a Chinese patent document with the authorization announcement number CN119004426B discloses a multi-dimensional factor security management system for government affairs documents, which discloses a multi-level authentication and risk assessment strategy for users through multi-dimensional factors such as login time, accurately confirms the user identity and evaluates the risk level, and can effectively prevent data leakage and unauthorized access. A Chinese patent document with the authorization announcement number CN10559210B discloses a method for accessing and controlling a government affairs cloud based on attribute encryption, which discloses a CP-ABE that can calculate an outsourced multi-attribute authority, revoke user attributes without changing the ciphertext, and can dynamically allocate permissions to achieve fine-grained access control of government affairs data.

[0004] However, there is a problem of insufficient applicability in evaluating user risks based on user login behavior. For example, users who need to work in multiple locations have a relatively high risk due to time zone and geographical location differences, resulting in restricted access and affecting the access efficiency of government affairs data. In addition, when controlling user access permissions based on user attributes, there are many types of user attributes in government departments, and all government affairs data needs to be allocated permissions according to user attributes. The more accurate the allocation, the more manpower is required, and the flexibility is insufficient. Whenever there is new data, permission allocation is required, and inaccurate allocation will pose a risk of data leakage. Summary of the Invention

[0005] To solve the above technical problems of insufficient flexibility in accessing and controlling government affairs data through identity authentication, resulting in insufficient access efficiency of government affairs data and potential data leakage risks, the present invention provides a method for accessing and controlling government affairs data based on identity authentication, including: Obtain the access records of several users. The access records of the users include several access units within a preset time range. The access units include access IPs and access contents. Based on the access frequencies of different access contents for each access IP, establish a stacked bar chart of access content - access frequency for all access IPs. Based on the performance of the access content patterns and access volumes of access IPs in the stacked bar chart of access content - access frequency for all access IPs, obtain the credibility of each access IP. Based on the access contents accessed in the login mode, establish a government affairs data network. Based on the similarity of the corresponding users of the access contents in the government affairs data network, cluster the type-I access contents to obtain several type-I access content clusters. According to the consistency between the requested access content of the user and the access IP in the user's access record, obtain the preliminary credibility of the user. According to the distribution similarity of the access records of the users who have already accessed the requested access content and the corresponding users of the requested access content in each type-I access content cluster, determine the final credibility of the requesting access user. Based on the final credibility of the user, perform permission control on the requested access content of the user.

[0006] The present invention classifies access contents and determines the final credibility of a user according to the access situations of similar users to the requested access content, which can avoid the insufficient efficiency of government affairs data access caused by untrustworthy user access information. The present invention combines the access records of users to judge the permissions of the requested access content of users, avoids users accessing irrelevant access contents, and improves the security of government affairs data access.

[0007] Preferably, the obtaining of the credibility of each access IP includes: Based on the login status of the access record, establish an access status function; The credibility of the i-th access IP satisfies the expression: ; In the formula, represents the number of access units of the i-th access IP; represents the access status function; represents the h-th access unit of the i-th access IP; represents the number of access contents; , represent the access frequencies of all access IPs and the i-th access IP to the c-th access content; represents the set of access frequencies of all access IPs to each access content; represents the normalization function.

[0008] The present invention determines the credibility of an access IP according to the access frequencies of different access contents for the access IP, analyzes the access behavior of the access IP, and makes the access control of users more precise.

[0009] Preferably, the establishment of the access content - access frequency stacked bar chart for all access IPs includes: Count the number of access units for each access IP, obtain all the access content of each access IP, count the access frequency of each access IP for each access content, use the access content as the horizontal axis and the access frequency as the vertical axis to construct a coordinate system, and draw the access content - access frequency stacked bar chart for all access IPs.

[0010] Preferably, the access status function satisfies the expression: ; In the formula, represents the access status function, and the access status is 1 when the access unit is in the login mode and 0 when the access unit is in the guest mode; represents the h-th access unit of the i-th access IP.

[0011] The present invention differentiates the access modes of access units by constructing an access status function, providing a basis for the credibility of access IPs.

[0012] Preferably, the establishment of the government affairs data network based on the access content accessed in the login mode includes: extracting all the access content accessed in the login mode, denoted as type-I access content; regarding the users whose access content includes type-I access content as type-I users; taking each type-I access content and each type-I user as entities, and connecting each type-I user entity with all the type-I access content entities accessed correspondingly to obtain the government affairs data network.

[0013] The present invention can visually represent the connection between users and access content by constructing the government affairs data network, providing a basis for the classification of access content and the similarity of users.

[0014] Preferably, the obtaining of several type-I access content cluster classes includes: based on the differences of the users connected by different access content in the government affairs data network, obtaining the similarity between any two type-I access contents; presetting an initial number of seeds, uniformly selecting initial seed points in the government affairs data network, and performing region growing on the initial seed points. During the region growing process, type-I access content can grow in different growing regions; the growing condition is that the similarity between the initial seed point and the neighboring type-I access content is greater than a first threshold; when there is no type-I access content in the neighborhood of each growing region whose similarity with the type-I access content in the corresponding growing region is greater than the first threshold, stop the region growing; obtain several growing regions, and regard any growing region as a type-I access content cluster class.

[0015] Preferably, obtaining the similarity between any two type-I access contents includes: taking the ratio of the intersection to the union of all type-I users who connect the m-th type-I access content and the n-th type-I access content as the similarity between the m-th type-I access content and the n-th type-I access content.

[0016] Preferably, obtaining the preliminary credibility of a user includes: Obtaining the number of access units of each access IP of the r-th user; obtaining the access IP of the access content of the r-th user's query, and obtaining the number of access units in the access record of the r-th user that have the same access IP as the access IP of the access content of the query; ; In the formula, represents the preliminary credibility of the r-th user; represents the number of access IPs of the r-th user; represents the number of access units in the access record of the r-th user that have the same access IP as the access IP of the access content of the query; represents the credibility set of each access IP of the r-th user; represents the normalization function.

[0017] The present invention obtains the preliminary credibility of a user through the credibility of each access IP of the user and the number of access units of the user on the access IP, improving the accuracy of access control for user government affairs data.

[0018] Preferably, obtaining the final credibility of a user includes: taking the user corresponding to the requested access content as the target user; obtaining the users whose access records contain the requested access content, denoted as the related users of the target user; taking the type-I access content cluster class to which the access record of the target user belongs as the target type-I access content cluster class; obtaining the number of access units in the access records of the target user and the related users of the target user that belong to each target type-I access content cluster class; obtaining the difference between the access contents of the target user and all related users, performing negative correlation normalization, and then multiplying it by the preliminary credibility of the target user to obtain the final credibility of the target user.

[0019] Preferably, the difference between the access contents of the target user and all related users satisfies the expression: ; In the formula, Z represents the number of target type-I access content cluster classes; represents the number of related users of the target user; , represent the number of access units in the access records of the target user and the v-th related user of the target user that belong to the z-th target type-I access content cluster class; represents the absolute value function.

[0020] The beneficial effects of the present invention are as follows: (1) The present invention judges the credibility of the content of the user's access request by referring to the user's access records, which can avoid the leakage of government affairs data of non-regular access content caused by account loss, improve the accuracy of government affairs data access control, and avoid the limitations of identity authentication; (2) By referring to the access situations of users with access content similar to that of the user, the present invention can improve the efficiency of the user's access to government affairs data and avoid insufficient access efficiency caused by problems such as untimely permission allocation. Description of the Drawings

[0021] Figure 1 is a flowchart schematically showing the method for access control of government affairs data based on identity authentication in the present invention; Figure 2 is a schematic diagram schematically showing the access content - access frequency stacked bar chart. Detailed Embodiments

[0022] The embodiment of the present invention discloses a method for access control of government affairs data based on identity authentication, referring to Figure 1 , including steps S1 - step S4: S1: Obtain the access records of a number of users.

[0023] It should be noted that the government affairs platform is a public platform. Therefore, the users accessing the government affairs data involve various groups of people, including relevant personnel of the government affairs platform, ordinary users, and also those who steal government affairs data. In order to distinguish the access habits of various groups of people and obtain abnormal behaviors, the present invention obtains the access records of a number of users, so as to further analyze the users.

[0024] Specifically, for the government affairs platform, obtain the access records of a number of users within a preset time range. The preset time range is set by the implementer according to the actual implementation situation and can be set to one month. The access records of the users include several access units of the users within the preset time range, and the access unit includes the access IP and the access content.

[0025] It should be noted that the government affairs platform has a login mode and a guest mode. When a user accesses the government affairs platform, it may be in the login mode or the guest mode. Therefore, the access records of the user include all access units in the login mode of the user, and also all access units accessed by the client with the same access IP as the login mode in the guest mode.

[0026] So far, the access records of a number of users have been obtained.

[0027] S2: Obtain the credibility of each access IP based on the regularity and access volume of the access content of the access IP.

[0028] It should be noted that, according to confidentiality requirements, government affairs data is divided into public data, restricted data, and sensitive data. Public data is the data that can be accessed in the tourist mode. Both restricted data and sensitive data are the data that can be accessed in the login mode, and different ranges of access can be performed according to the permissions of the login account. However, there is also value hidden in public data. If a large amount of data is accessed abnormally and data leakage occurs, it may cause incalculable losses. Therefore, the present invention first analyzes the access IP, that is, the access record of the client, and judges the credibility of each access IP by combining the login situation of the access IP.

[0029] It should be noted that when an access IP usually accesses data in the login mode and the access content is regular and focused, it indicates that the possibility of the corresponding user's normal access behavior is relatively high. When an access IP quickly accesses a small amount of data in the tourist mode, it indicates that the corresponding user is purposefully looking for the required data, and the possibility of normal access behavior is relatively high. If an access IP accesses a large amount of data irregularly in the tourist mode, it indicates that the purpose of the access IP is more likely to be abnormal. Therefore, the present invention obtains the credibility of each access IP based on the regularity and access volume of the access content of the access IP.

[0030] Specifically, all access content of each access IP is obtained, the access frequency of each access IP to each access content is counted, a coordinate system is constructed with the access content as the horizontal axis and the access frequency as the vertical axis, and an access content - access frequency stacked bar chart of all access IPs is drawn. It should be noted that, as Figure 2 is a schematic diagram of the access content - access frequency stacked bar chart, which includes three access IPs, namely A1, A2, and A3, and four access contents, namely a1, a2, a3, and a4. Figure 2 Among them, the access frequencies of A1 to a1, a2, a3, and a4 are 1, 2, 1, and 0 respectively. The access frequencies of A2 to a1, a2, a3, and a4 are 3, 1, 10, and 0 respectively. The access frequencies of A3 to a1, a2, a3, and a4 are 0, 1, 0, and 1 respectively.

[0031] It should be noted that the access content with a higher cumulative access frequency is relatively more popular and is concerned by more people. Therefore, the corresponding access IP has a higher credibility. For the access content with a lower access frequency, if the access IP accesses it in the tourist mode and there are a large number of access behaviors, it indicates that the credibility of the access IP is lower.

[0032] Preferably, the credibility of any access IP satisfies the expression: ; ; ; In the formula, represents the credibility of the i-th access IP; represents the number of access units of the i-th access IP; represents the access status function. When the access unit is in the login mode it is 1, and when the access unit is in the guest mode it is 0; represents the h-th access unit of the i-th access IP; represents the number of access contents; represents the access frequency of all access IPs to the c-th access content; represents the set of access frequencies of all access IPs to each access content; represents the access frequency of the i-th access IP to the c-th access content; represents the set of access frequencies of the i-th access IP to each access content; represents the normalization function.

[0033] In the formula, represents the cumulative access status of the i-th access IP, represents the ratio of the access units in the login mode among all the access units of the i-th access IP. The larger this value is, the more the i-th access IP tends to log in for access, and thus the higher the credibility of the i-th access IP.

[0034] In the formula, represents the total access frequency of all access contents, represents the proportion of the access frequency of the c-th access content in the total access frequency of all access contents. The larger this value is, the more popular the c-th access content is and the more times the c-th access content is accessed, indicating that the access behavior to the c-th access content is more normal; represents the proportion of the access frequency of the i-th access IP to the c-th access content in the total access frequency of the i-th access IP to all access contents. The larger this value is, the more the i-th access IP focuses on the c-th access content; The larger it is, it means that when the access behavior to the c-th access content is relatively normal, the more the i-th access IP accesses the c-th access content, indicating that the access behavior of the i-th access IP to the c-th access content is more normal; represents the normal performance of the access behavior of the i-th access IP to all access contents. The larger this value is, the more normal the access behavior of the i-th access IP to all access contents is, and thus the higher the credibility of the i-th access IP.

[0035] Thus, the credibility of each access IP is obtained.

[0036] S3: Based on the accessed content under the login mode, establish a government affairs data network; cluster the type-I accessed content based on the similarity of the corresponding users of the accessed content in the government affairs data network to obtain several type-I accessed content clusters; obtain the preliminary credibility of the user according to the consistency between the requested accessed content of the user and the accessed IP of the user's access record; determine the final credibility of the user requesting access according to the distribution similarity of the users who have already accessed the requested accessed content and the access records of the corresponding users of the requested accessed content in each type-I accessed content cluster.

[0037] It should be noted that S2 has conducted a preliminary analysis on the access records of the access IPs, and can display different ranges of government affairs data for different access IPs based on the credibility of the access IPs, improving the overall security of government affairs data. However, for users who have the right to access restricted data and sensitive data, due to certain loopholes in identity verification, such as the leakage of account passwords, it may cause more serious leakage of government affairs data. Therefore, the present invention further analyzes the access units under the login mode of each user.

[0038] It should be noted that users who have certain permissions to access restricted data and sensitive data are responsible for the management of certain government affairs data in the government affairs platform. All users who can access restricted data and sensitive data enable the government affairs platform to operate by managing the government affairs data related to their own responsibilities. Therefore, first extract the users who can access restricted data and sensitive data, and construct a government affairs data network based on the access records of these users. Considering that a knowledge graph constructs a data association network by connecting a number of entities with relationships, the present invention establishes a government affairs data association network through a knowledge graph.

[0039] It should be further noted that in the government affairs data network, the accessed data content and permissions of different users are different. To ensure the security of government affairs data, it is necessary to restrict the access permissions of the data that is not part of the user's responsibilities. To avoid insufficient robustness and affecting the efficiency of permission allocation due to overly fine-grained permission restrictions, the present invention clusters the accessed content and determines several accessed content clusters based on the number of similar users between the accessed content in the government affairs data network. On this basis, if the user's identity verification information is weak, such as when the user accesses government affairs data from an unusual access IP and the credibility of each access IP is low, the accessed content cluster category to which the user's requested accessed content belongs can be determined first, and then the final credibility of the user can be determined according to the access situation of the corresponding users of the accessed content cluster category to the requested accessed content, so as to finally determine the access permission of the user to the requested accessed content.

[0040] Specifically, extract all the accessed contents accessed in the login mode, denoted as type-I accessed contents; denote the users whose accessed contents include type-I accessed contents as type-I users; take each type-I accessed content and each type-I user as entities, and connect each type-I user entity to all the type-I accessed content entities corresponding to the access, to obtain a government affairs data network.

[0041] It should be noted that for any two type-I accessed contents, the higher the proportion of the same connected type-I users, the higher the similarity of the two type-I accessed contents.

[0042] Preferably, denote the ratio of the intersection to the union of all the type-I users connected by the m-th type-I accessed content and the n-th type-I accessed content as the similarity between the m-th type-I accessed content and the n-th type-I accessed content.

[0043] It should be noted that the higher the similarity between the m-th type-I accessed content and the n-th type-I accessed content, the more consistent the permissions of the m-th type-I accessed content and the n-th type-I accessed content. Therefore, in order to perform preliminary permission allocation on the government affairs data network, the government affairs data network can be divided into several type-I accessed content clusters with relatively strong permission consistency.

[0044] Preferably, according to the similarity of type-I accessed contents, cluster the type-I accessed contents to obtain several type-I accessed content clusters: preset an initial number of seeds, uniformly select initial seed points in the government affairs data network, perform region growing on the initial seed points, and type-I accessed contents can grow in different growing regions during the region growing process; the growing condition is that the similarity between the initial seed point and the neighboring type-I accessed content is greater than a first threshold; when there is no type-I accessed content in the neighborhood of each growing region whose similarity with the type-I accessed content in the corresponding growing region is greater than the first threshold, stop the region growing; obtain several growing regions, and denote any growing region as a type-I accessed content cluster. It should be noted that the initial number of seeds and the first threshold are set by the implementers according to the actual implementation situation. For example, the initial number of seeds can be set to 100, and the first threshold can be set to 0.5.

[0045] It should be noted that the user's access records can reflect the user's access habits. For example, the access IPs of users at fixed office locations are usually the same. If not at a fixed office location, the user will have several access IPs. Then, accessing government data with an infrequent access IP does not necessarily indicate abnormal access by the user. Therefore, the present invention compares the access IP of the user's requested access content with the user's access records. When the user has more access IPs, the appearance of the access IP of the user's requested access content in the access records indicates a relatively high initial credibility of the user. When the user has fewer access IPs, the higher the frequency of the appearance of the access IP of the user's requested access content in the access records, the higher the initial credibility of the user. In addition, if the credibility of all the user's access IPs is relatively high, the initial credibility of the user is relatively high.

[0046] Preferably, obtaining the initial credibility of the user according to the consistency between the access IP of the user's requested access content and the user's access records includes: Obtaining the number of access units of each access IP of the r-th user; obtaining the access IP of the r-th user's requested access content, and obtaining the number of access units in the r-th user's access records that are the same as the access IP of the requested access content.

[0047] The initial credibility of the user satisfies the expression: ; In the formula, represents the initial credibility of the r-th user; represents the number of access IPs of the r-th user; represents the number of access units in the r-th user's access records that are the same as the access IP of the requested access content; represents the credibility set of each access IP of the r-th user; represents the normalization function.

[0048] In the formula, represents the average credibility of the access IP of the r-th user, and the larger this value is, the greater the initial credibility of the r-th user; indicates that based on the credibility of the access IP of the r-th user, the more access IPs there are and the more access units that are the same as the access IP of the requested access content, the higher the initial credibility of the r-th user.

[0049] It should be noted that when the corresponding user who requests to access the content makes an access request using a new access IP, since there is no access unit in the access record of the corresponding user who requests to access the content that is the same as the new access IP, the initial credibility of the corresponding user who requests to access the content is relatively low, which will affect the timely viewing of government affairs data by the requesting access user. Therefore, the final credibility of the requesting access user can be determined based on the distribution of the access records of the users who have already accessed the content and the corresponding user who requests to access the content in each cluster of type-I access content.

[0050] Preferably, according to the access records of the users who have already accessed the content and the corresponding user who requests to access the content, and the distribution similarity in each cluster of type-I access content, the final credibility of the requesting access user is obtained, including: Denote the corresponding user who requests to access the content as the target user; obtain the users whose access records contain the content requested to be accessed, and denote them as the relevant users of the target user; denote the cluster of type-I access content to which the access record of the target user belongs as the target cluster of type-I access content; obtain the number of access units in each target cluster of type-I access content that belong to the access records of the target user and the relevant users of the target user.

[0051] The final credibility of the target user satisfies the expression: ; In the formula, represents the final credibility of the target user; represents the initial credibility of the target user; Z represents the number of target clusters of type-I access content; represents the number of relevant users of the target user; 、 represent the number of access units in the access records of the target user and the v-th relevant user of the target user that belong to the z-th target cluster of type-I access content; represents the absolute value function; represents the exponential function with the natural constant as the base.

[0052] In the formula, represents the difference in the number of access units in the access records of the target user and the v-th relevant user of the target user that belong to the z-th target cluster of type-I access content, represents the sum of the differences in the number of access units in the access records of the target user and the v-th relevant user of the target user that belong to each target cluster of type-I access content. The larger this value is, the greater the difference in the accessed content between the target user and the v-th relevant user of the target user, the smaller the similarity between the target user and the v-th relevant user of the target user, and the lower the final credibility of the target user; Indicates the difference in the accessed content between the target user and all relevant users. The larger this value is, the greater the difference in the accessed content between the target user and all relevant users, and the lower the final credibility of the target user.

[0053] Thus, the final credibility of the user is obtained.

[0054] S4: Based on the final credibility of the user, perform permission control on the content requested by the user for access.

[0055] It should be noted that when the user requests access, based on the content requested by the user for access, obtain the final credibility of the user, set a threshold. When the final credibility of the user is greater than the preset threshold, it indicates that the user's request is safe, so the user can successfully access.

[0056] Specifically, preset a second threshold. When the user clicks to request access to the content, obtain the final credibility of the user through the methods in steps S1 - S3. If the final credibility of the user is greater than the second threshold, the user can access the requested content. If the final credibility of the user is less than or equal to the second threshold, the user cannot access the requested content. It should be noted that the second threshold is set by the implementer according to the actual implementation situation. For example, the first threshold can be set to 0.7.

[0057] Thus, the access control of the user to the government affairs data is completed.

[0058] Although this specification has shown and described multiple embodiments of the present invention, it is obvious to those skilled in the art that such embodiments are provided only by way of example. Those skilled in the art will think of many changes, alterations, and alternative ways without departing from the spirit and idea of the present invention.

Claims

1. An authentication-based government data access control method, characterized in that, Including: Obtain the access records of a number of users. The access records of the users include a number of access units within a preset time range. The access units include access IPs and access contents. Based on the access frequencies of different access contents for each access IP, establish an access content - access frequency stacked bar chart for all access IPs; based on the access content - access frequency stacked bar chart of all access IPs for the patterns of access contents and the performance of access volumes of access IPs, obtain the credibility of each access IP. Based on the access contents accessed in the login mode, establish a government affairs data network; based on the similarity of the corresponding users of the access contents in the government affairs data network, cluster the type-I access contents to obtain a number of type-I access content clusters; according to the consistency between the requested access content of the user and the access IP in the user's access record, obtain the preliminary credibility of the user; according to the distribution similarity of the access records of the users who have already accessed the requested access content and the corresponding users of the requested access content in each type-I access content cluster, determine the final credibility of the requesting access user. Based on the final credibility of the user, perform permission control on the requested access content of the user.

2. The authentication-based government data access control method according to claim 1, wherein The obtaining the credibility of each access IP includes: Based on the login status of the access record, establish an access status function. The credibility of the i-th access IP satisfies the expression: ； Wherein, represents the number of access units of the i-th access IP; represents the access status function; represents the h-th access unit of the i-th access IP; represents the number of access contents; 、 represent the access frequencies of all access IPs and the i-th access IP to the c-th access content; represents the set of access frequencies of all access IPs to each access content; represents the normalization function.

3. The authentication-based government data access control method according to claim 1, wherein The establishing the access content - access frequency stacked bar chart for all access IPs includes: Count the number of access units of each access IP, obtain all access contents of each access IP, count the access frequencies of each access IP for each access content, use the access content as the horizontal axis and the access frequency as the vertical axis to construct a coordinate system, and draw the access content - access frequency stacked bar chart for all access IPs.

4. The authentication-based government data access control method according to claim 2, wherein, The access status function satisfies the expression: ； Wherein, represents the access status function, where the access status is 1 when the access unit is in the login mode and 0 when the access unit is in the visitor mode; represents the h-th access unit of the i-th access IP.

5. The authentication-based government data access control method according to claim 1, wherein The establishing the government affairs data network based on the access contents accessed in the login mode includes: Extract all access contents accessed in the login mode, denoted as type-I access contents; denote the users whose access contents include type-I access contents as type-I users; use each type-I access content and each type-I user as entities, and connect each type-I user entity to all type-I access content entities corresponding to the access to obtain the government affairs data network.

6. The authentication-based government data access control method according to claim 1, wherein The obtaining a number of type-I access content clusters includes: Based on the differences of the users connected by different access contents in the government affairs data network, obtain the similarity between any two type-I access contents. Preset an initial number of seeds, uniformly select initial seed points in the government affairs data network, perform region growing on the initial seed points, and the type-I access contents can grow in different growth regions during the region growing process; the growth condition is that the similarity between the initial seed point and the neighboring type-I access content is greater than a first threshold; when there is no type-I access content in the neighborhood of each growth region whose similarity with the type-I access content in the corresponding growth region is greater than the first threshold, stop the region growing; obtain a number of growth regions, and denote any growth region as a type-I access content cluster.

7. The authentication-based e-government data access control method according to claim 6, wherein The obtaining the similarity between any two type-I access contents includes: The ratio of the intersection to the union of all Class-I users connecting the m-th Class-I access content and the n-th Class-I access content is denoted as the similarity between the m-th Class-I access content and the n-th Class-I access content.

8. The authentication-based government data access control method according to claim 1, characterized in that The obtaining of the preliminary credibility of a user includes: Obtaining the number of access units of each access IP of the r-th user; obtaining the access IP of the access content of the r-th user's query; obtaining the number of access units with the same access IP as the access content of the r-th user's query in the access record of the r-th user. ； In the formula, represents the initial credibility of the r-th user; represents the number of access IPs of the r-th user; represents the number of access units in the access record of the r-th user that have the same access IP as the access content of the question; represents the credibility set of each access IP of the r-th user; represents the normalization function.

9. The authentication-based government data access control method according to claim 1, wherein The obtaining of the final credibility of a user includes: Denoting the corresponding user of the requested access content as the target user; obtaining the users whose access records contain the requested access content, and denoting them as the relevant users of the target user; denoting the Class-I access content cluster to which the access record of the target user belongs as the target Class-I access content cluster; obtaining the number of access units belonging to each target Class-I access content cluster in the access records of the target user and the relevant users of the target user. Obtaining the difference between the access content of the target user and all relevant users, performing negative correlation normalization, and then multiplying it by the preliminary credibility of the target user to obtain the final credibility of the target user.

10. The authentication-based government data access control method according to claim 9, wherein The difference between the access content of the target user and all relevant users satisfies the expression: ； Wherein, Z represents the number of target class-I access content cluster classes; represents the number of relevant users of the target user; , represents the number of access units belonging to the z-th target class-I access content cluster class in the access records of the target user and the v-th relevant user of the target user; represents the absolute value function.

Images