Sensitive information identification and authority control method based on large model

Abstract

The invention relates to a sensitive information identification and authority control method based on a large model, which utilizes a large language model and combines context analysis and prompt engineering to realize automatic identification and classification of sensitive information in a complex document. Combining the user behavior log and the multi-dimensional attribute data to construct a dynamic permission decision model; permission configuration with a file as the minimum unit is supported through a visual interface, and setting of access timeliness is supported; and constructing a self-learning mechanism, and continuously optimizing a sensitive information identification model and an authority strategy library. According to the scheme, the problems that when a traditional sensitive information recognition and authority control method faces increasingly complex service scenes and the continuously increasing data volume, sensitive information recognition and screening are difficult, and personnel authority is flexibly deployed are solved. The whole process from sensitive information identification to permission allocation is automatic and intelligent.

Description

Technical Field

[0001] The present invention relates to an information security technology, and in particular to a sensitive information identification and authority control method and system based on a large model. Background Art

[0002] With the rapid development of information technology, businesses and organizations are accumulating massive amounts of data in their daily operations, including a significant amount of sensitive information such as financial performance, private customer data, and transaction records. This information is not only a crucial component of a company's core competitiveness but also directly impacts personal privacy and national security. Therefore, in the era of big data, how to efficiently manage and accurately protect sensitive information has become a key research topic in the field of information security.

[0003] 1. Current main methods and technical status of sensitive information permission control

[0004] 1.1 Role-Based Access Control (RBAC)

[0005] Definition: Role-Based Access Control (RBAC) is a permission management model widely used in information systems. Its core concept is to control access to sensitive information by assigning users to predefined roles, each of which corresponds to a specific set of permissions.

[0006] Advantages: Simplified permission management: Role abstraction significantly reduces the complexity of permission configuration, making it particularly suitable for allocating permissions to large user groups. Improved management efficiency: Centralized role management makes permission changes more convenient and reduces the possibility of human error.

[0007] Limitations: Inadequate flexibility: In dynamic business scenarios, RBAC struggles to quickly adapt to complex changes in permission requirements. Limited scalability: The RBAC model's expressive power is limited for multi-dimensional, fine-grained permission control requirements.

[0008] 1.2 Attribute-Based Access Control (ABAC)

[0009] Definition: Attribute-Based Access Control (ABAC) is a fine-grained permission management mechanism that implements highly flexible dynamic permission control by defining user attributes, resource attributes, environment attributes, and related access rules.

[0010] Advantages: High flexibility: Supports multi-dimensional and dynamic permission control strategies to meet the diverse needs of complex business scenarios. Strong adaptability: Permission strategies can be dynamically adjusted according to real-time environmental changes, significantly improving the system's adaptability.

[0011] Limitations: Complex configuration: Policy design and implementation require a high technical threshold and high maintenance costs. Performance bottleneck: In large-scale data processing scenarios, complex rule matching may lead to system performance degradation.

[0012] 1.3 Data encryption and desensitization technology

[0013] Definition: Data encryption and desensitization technology ensures the security of data during transmission, storage, and use by encrypting or partially hiding sensitive information, preventing unauthorized access and leakage.

[0014] Advantages: Enhanced data security: Encryption technology effectively protects data confidentiality, while desensitization technology reduces the risk of data leakage without affecting business functions. Compliance support: Complies with the requirements of international privacy protection regulations such as GDPR and CCPA, helping enterprises build compliant information security systems.

[0015] Limitations: Performance overhead: The encryption and desensitization process may increase the system's computing burden and affect overall performance. User experience: Over-reliance on desensitization may lead to reduced data analysis accuracy and affect decision support effectiveness.

[0016] 2. In practical applications, existing sensitive information permission control methods face many challenges, mainly reflected in the following two key aspects:

[0017] 2.1. Limitations of Sensitive Information Identification and Screening

[0018] Problem Description: Traditional sensitive information identification methods typically rely on predefined rules and keyword matching mechanisms. However, this approach exhibits significant shortcomings when dealing with complex and diverse sensitive information. For example, in unstructured data such as financial reports and contract documents, sensitive information may be presented in a variety of forms (such as tables, charts, and free text), and its semantic expression may vary depending on the context. Traditional rule-based methods struggle to fully account for these variations, resulting in limited identification capabilities.

[0019] Impact: Inaccurate identification: Due to a lack of in-depth understanding of semantics and context, traditional methods are prone to missed detections or misjudgments, increasing the risk of sensitive information leakage. Insufficient scalability: When facing emerging business scenarios or new types of sensitive information, traditional methods require frequent updates to the rule base, resulting in high maintenance costs and slow response times.

[0020] 2.2. Insufficient flexibility and dynamic adaptability of rights management

[0021] Problem Description: Current permission management systems mostly use static role or attribute definitions, which are difficult to meet rapidly changing business needs and complex access scenarios. For example, employees' job responsibilities, project participation, and permission requirements may change frequently over time. Traditional permission management methods often require manual adjustments to role or attribute configurations, which is inefficient and prone to errors. Furthermore, in scenarios such as cross-departmental collaboration or temporary task assignments, static permission models lack the flexibility to respond to dynamically changing access requirements.

[0022] Impact: Delayed permission allocation: Static permission management models may lead to unreasonable or delayed permission allocation, which in turn may cause security vulnerabilities or operational inconveniences. Degraded user experience: An overly rigid permission system may limit user operational freedom, affecting business operation efficiency and user satisfaction. Summary of the Invention

[0023] To address the challenges of traditional sensitive information identification and permission control methods in the face of increasingly complex business scenarios and growing data volumes, including difficulties in identifying and screening sensitive information and flexibly allocating personnel permissions, we proposed a large-scale model-based sensitive information identification and permission control method and system. By integrating business specialists, advanced natural language processing technology, and an intelligent permission management mechanism, this solution automates and intelligentizes the entire process from sensitive information identification to permission allocation.

[0024] Intelligent identification of sensitive information: Leveraging the natural language processing capabilities of large language models, combined with contextual semantic analysis, this technology enables automatic classification and labeling of sensitive information, significantly improving identification accuracy.

[0025] Dynamic permission control optimization: Based on the reasoning capabilities of large models, user behavior patterns and access intentions are evaluated in real time, and permission policies are dynamically adjusted to ensure the accuracy and timeliness of permission allocation.

[0026] Intelligent operation and maintenance and monitoring: Through the self-learning ability of the large model, it continuously optimizes the permission management rules and provides a visual monitoring interface to help enterprises quickly discover and respond to potential security threats.

[0027] The technical solution of the present invention is:

[0028] A large-model-based sensitive information identification and permission control method uses a large language model, combined with context analysis and prompt engineering, to automatically identify and classify sensitive information in complex documents. It also builds a dynamic permission decision model by combining user behavior logs with multi-dimensional attribute data. It supports permission configuration based on files as the smallest unit through a visual interface and supports setting access timeliness. It also builds a self-learning mechanism to continuously optimize the sensitive information identification model and permission policy library.

[0029] Automatic identification of sensitive information: Supports OCR parsing of PDF, image, and scanned document formats; uses PromptEngineering to guide large models in identifying sensitive information with nested expressions and complex semantics; introduces a feedback mechanism to dynamically optimize prompt words and model parameters based on recognition results;

[0030] Dynamic permission decision model: Builds an access intent model based on user behavior sequence analysis; integrates user attributes, resource attributes, and environment attributes, and uses a rule engine + AI model to jointly determine whether to grant permissions; permission policies support time window effectiveness and automatically expire upon expiration;

[0031] Visual interface: supports permission configuration on a per-file basis; provides permission change audit logs and operation tracing functions; supports batch import and export of permission templates for easy operation and maintenance management;

[0032] Self-learning mechanism: All sensitive information is recorded and stored in encrypted form; the identification process and permission change logs are automatically recorded; abnormal access warnings and a visual monitoring panel are provided.

[0033] Furthermore, the specific implementation is as follows:

[0034] Step 1. Definition of sensitive information

[0035] Step 1.1 Definition Basis: Sensitive information definitions are driven by standardized templates and verified through training with sample datasets. An initial labeling system is established based on the preset templates. Sample datasets are used to train and verify the consistency of model outputs. The sensitive information definition template is regularly updated to support multi-industry expansion. Category definitions include: financial data; customer information; transaction records; and industry-specific information.

[0036] Step 2. File processing

[0037] Step 2.1 OCR Text Extraction: Supported File Types: The system is compatible with a variety of file formats, including PDF, images, and scans. Page Segmentation: Use professional file segmentation tools to split the original document into independent units by page, facilitating subsequent page-by-page processing. Text Extraction: Leveraging Optical Character Recognition (OCR) technology, the segmented files are converted into a structured text format. Quality Control: Automated quality verification of OCR extraction results, combined with manual intervention, ensures the accuracy and completeness of the extracted text.

[0038] Step 3. Identify and mark sensitive information

[0039] Step 3.1 Large Model Selection: Use a large model as the core engine for sensitive information identification; this model has powerful natural language processing (NLP) capabilities and can analyze complex semantics and diverse expressions.

[0040] Step 3.2 Input Preparation: Text and Label Input: Combine the text extracted by OCR with predefined sensitive information category labels as model input data; Prompt Engineering: Write prompts to guide the model to understand the task objectives. Prompts include sensitive information category definitions, recognition rules, and example data.

[0041] Step 3.3 Sensitive Information Identification: Page-by-Page Processing: Identify sensitive information page by page for each segmented file; Dynamic Optimization: Based on the quality feedback of the recognition results, dynamically adjust the prompt words and model parameters to continuously improve the recognition accuracy and recall rate;

[0042] Step 4. Sensitive Information Recording

[0043] Step 4.1 Recording Method: Classified Storage: Identify sensitive information and record it according to predefined categories to form a structured sensitive information list; Metadata Tracking: Record the source file, page number, and extraction time metadata of sensitive information to build a complete data traceability chain;

[0044] Step 4.2 Storage method: Secure database: All sensitive information records are stored in an encrypted database; Backup mechanism: Implement a regular backup strategy;

[0045] Step 5. Permissions adjustment

[0046] Step 5.1: Permission allocation based on files as the smallest unit: Refined management: supports permission allocation based on files as the smallest unit. Administrators can flexibly set user access rights to specific files; Operation permissions: including read, download, and edit operation permissions; Time limit control: set the effective length of time for user access to files, which will automatically expire after the timeout;

[0047] Step 5.2 Permission management interface: Friendly interactive design: Provide an intuitive and easy-to-use permission management interface; Audit log: Automatically record the operation log of each permission change, including change time, operator, and specific content information.

[0048] The beneficial effects of the present invention are:

[0049] Compared with existing technologies, this invention achieves significant technological breakthroughs in sensitive information identification and permission control by integrating the experience of business experts, advanced artificial intelligence technology, and intelligent permission management mechanisms. It has the following core advantages:

[0050] 1. Improve the accuracy and coverage of sensitive information identification

[0051] Clear Definitions and Examples: Leveraging the industry experience of business experts and specific example data, a standardized sensitive information definition framework has been established to ensure the scientific nature, consistency, and scalability of the identification process. This significantly reduces the risk of missed detections and misjudgments due to ambiguous semantics or incomplete rules.

[0052] Powerful natural language processing capabilities: Leveraging the deep semantic understanding and contextual analysis capabilities of large models, it can efficiently process complex and diverse sensitive information (such as implicit sensitive content in unstructured data). Results: Compared to traditional rule-based methods, recognition accuracy and recall rates are significantly improved, effectively addressing the needs of changing business scenarios.

[0053] 2. Enhance the flexibility and dynamic adaptability of rights management

[0054] Fine-grained permission allocation based on files: The system supports permission management based on files as the smallest unit. Administrators can configure permissions for specific files through simple operations, meeting the needs of fine-grained access control. The effect: Easy and flexible operation, suitable for complex scenarios such as cross-departmental collaboration and temporary task allocation.

[0055] Dynamic permission adjustment mechanism: By combining real-time user behavior analysis with changing business needs, the system can dynamically adjust user access rights to ensure the rationality and timeliness of permission allocation. This helps prevent security risks and business interruptions caused by delayed or improper permission configuration.

[0056] Time-sensitive permission control: Supports setting the validity period for user file access, for example, limiting access rights to a specific time period, which will automatically expire after the timeout. Effect: Further enhances the flexibility and security of permission management and reduces the potential risks associated with long-term authorization.

[0057] 3. Improve the security and reliability of the system

[0058] Real-time Monitoring and Audit Logs: The system has built-in real-time monitoring capabilities that comprehensively record user behavior and permission change operation logs (including operation time, operator, and change content), supporting full-process traceability and auditing. Results: Significantly improve system transparency and security, facilitating rapid detection and response to potential threats.

[0059] Multi-layered protection: By combining data encryption, desensitization technology, and strict access control policies, we ensure the security of sensitive information during transmission, storage, and use. Results: We have established a comprehensive protection system from data source to application endpoint, effectively preventing data leakage and unauthorized access.

[0060] 4. Reduce system maintenance costs

[0061] Highly automated processing: From document splitting and OCR text extraction to sensitive information identification and tagging, the entire process is highly automated, significantly reducing the need for manual intervention. The result: improved processing efficiency, reduced labor costs, and the risk of human error.

[0062] Friendly permissions management interface: Provides an intuitive and easy-to-use permissions management interface that allows administrators to quickly view, configure, and adjust user permissions, simplifying operation and maintenance. Results: Significantly reduces the system maintenance difficulty and learning cost, and improves the user experience. DETAILED DESCRIPTION

[0063] The present invention is described in detail below with reference to specific embodiments. This embodiment is implemented based on the technical solution of the present invention, and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to the following embodiments.

[0064] This invention proposes a sensitive information permission control method and system based on a large model, aiming to achieve more efficient and accurate sensitive information protection and permission control by introducing advanced natural language processing (NLP) technology and intelligent permission management mechanisms. The core innovative ideas are as follows: using the powerful semantic understanding ability of the large language model, combined with context analysis and prompt engineering, to achieve automatic identification and classification of sensitive information in complex documents; combining user behavior logs with multi-dimensional attribute data (such as position, department, access time, device type) to build a dynamic permission decision model; supporting permission configuration with files as the smallest unit through a visual interface, and supporting the setting of access timeliness; building a self-learning mechanism to continuously optimize the sensitive information identification model and permission policy library.

[0065] Multimodal sensitive information recognition based on a large model: supports OCR parsing of multiple formats such as PDFs, images, and scans; uses Prompt Engineering to guide the large model in identifying sensitive information with nested expressions and complex semantics; introduces a feedback mechanism to dynamically optimize prompt words and model parameters based on recognition results.

[0066] Dynamic permission decision-making mechanism: Build an access intent model based on user behavior sequence analysis; integrate user attributes, resource attributes, and environmental attributes, and use a rule engine + AI model to jointly determine whether to authorize; permission policies support taking effect by time window and automatically expire after expiration.

[0067] Visualized fine-grained permission management: supports permission configuration on a per-file basis; provides permission change audit logs and operation tracing capabilities; supports batch import and export of permission templates for easier operation and maintenance management.

[0068] Secure storage and intelligent operation and maintenance: All sensitive information is recorded and stored in encrypted form; the identification process and permission change logs are automatically recorded; abnormal access warnings and a visual monitoring panel are provided.

[0069] The specific implementation is as follows:

[0070] 1. Definition of Sensitive Information

[0071] 1.1 Definition basis

[0072] In the present invention, the definition of sensitive information is driven by standardized templates and verified through training with example datasets.

[0073] Definition basis: Establish an initial labeling system based on preset templates (such as "Data Classification and Grading Standards" and "Industry Compliance Requirements"); use sample data sets to train and verify the consistency of model outputs; regularly update sensitive information definition templates to support multi-industry expansion.

[0074] Category definitions include: financial data (income, expenditure, profit, balance sheet); customer information (name, address, contact information, purchase history); transaction records (order number, amount, time); industry-specific information (such as medical records, financial credit records);

[0075] 2. File processing

[0076] 2.1OCR text extraction

[0077] Supported file types: The system is compatible with multiple file formats, including PDF, images (JPEG, PNG), scans, etc., to meet the needs of diverse data sources.

[0078] Page splitting: Use professional file splitting tools to split the original file into independent units by page, which is convenient for subsequent page-by-page processing.

[0079] Text extraction: Using optical character recognition (OCR) technology, the segmented files are converted into structured text format to ensure data availability.

[0080] Quality control: Automated quality verification of OCR extraction results, combined with human intervention mechanisms (such as manual correction), ensures the accuracy and completeness of the extracted text.

[0081] 3. Identification and marking of sensitive information

[0082] 3.1 Large Model Selection

[0083] Core Tools: A large model is used as the core engine for sensitive information identification. This model has powerful natural language processing (NLP) capabilities and can efficiently analyze complex semantics and diverse expressions.

[0084] Advantages: It performs well in processing unstructured data and is particularly suitable for tasks involving sensitive information recognition that is semantically rich and context-dependent.

[0085] 3.2 Input Preparation

[0086] Text and label input: The text extracted by OCR is combined with predefined sensitive information category labels as model input data.

[0087] Prompt Engineering: Develop specialized prompts to guide the model in understanding the task objectives. Prompts include sensitive information category definitions, identification rules, and example data to ensure the accuracy of model output.

[0088] 3.3 Sensitive Information Identification

[0089] Page-by-page processing: Sensitive information is identified page by page for each segmented file to ensure that all potential risk points are covered.

[0090] Dynamic optimization: Based on the quality feedback of the recognition results, the prompt words and model parameters are dynamically adjusted to continuously improve the recognition accuracy and recall rate.

[0091] 4. Sensitive Information Records

[0092] 4.1 Recording Method

[0093] Classified storage: Identified sensitive information is classified and recorded according to predefined categories to form a structured sensitive information list.

[0094] Metadata tracking: Record metadata such as the source file, page number, and extraction time of sensitive information to build a complete data traceability chain for subsequent auditing and management.

[0095] 4.2 Storage Method

[0096] Secure database: All sensitive information records are stored in an encrypted database to ensure data security and tamper-proof capabilities.

[0097] Backup mechanism: Implement regular backup strategies to prevent data loss due to unexpected situations and ensure high reliability of the system.

[0098] 5. Permission allocation

[0099] 5.1 Permission allocation based on files as the smallest unit

[0100] Fine-grained management: Supports permission allocation based on files as the smallest unit, and administrators can flexibly set user access rights to specific files.

[0101] Operation permissions: including read, download, edit and other operation permissions to meet the needs of different business scenarios.

[0102] Time limit control: You can set the effective length of time for users to access files, for example, restrict access to only within a specific time period, and the access will automatically expire after the time limit.

[0103] 5.2 Permission Management Interface

[0104] Friendly interactive design: Provides an intuitive and easy-to-use permission management interface, allowing administrators to quickly configure and adjust user permissions.

[0105] Audit log: Automatically record the operation log of each permission change, including change time, operator, specific content and other information, so that the entire process can be traced.

[0106] The above-described embodiment merely represents one embodiment of the present invention. While the description is relatively specific and detailed, it should not be construed as limiting the scope of the patent. It should be noted that a person skilled in the art would be able to make various modifications and improvements without departing from the spirit of the present invention, and these modifications and improvements fall within the scope of protection of the present invention. Therefore, the scope of protection of the patent for this invention shall be determined by the appended claims.

Claims

1. A sensitive information identification and permission control method based on a large model, characterized in that: Leveraging large language models, combined with contextual analysis and prompt engineering, we can automatically identify and classify sensitive information in complex documents. We also combine user behavior logs with multi-dimensional attribute data to build a dynamic permission decision model. Through a visual interface, it supports permission configuration with files as the smallest unit and supports setting access timeliness; it builds a self-learning mechanism to continuously optimize the sensitive information identification model and permission policy library; Automatic identification of sensitive information: Supports OCR parsing of PDF, image, and scanned document formats; uses Prompt Engineering to guide large models in identifying sensitive information with nested expressions and complex semantics; introduces a feedback mechanism to dynamically optimize prompt words and model parameters based on recognition results; Dynamic permission decision model: Builds an access intent model based on user behavior sequence analysis; integrates user attributes, resource attributes, and environment attributes, and uses a rule engine + AI model to jointly determine whether to grant permissions; permission policies support time window effectiveness and automatically expire upon expiration; Visual interface: supports permission configuration based on a single file; Provides permission change audit log and operation tracing functions; supports batch import and export of permission templates to facilitate operation and maintenance management; Self-learning mechanism: All sensitive information is recorded and stored in encrypted form; the identification process and permission change logs are automatically recorded; Provide abnormal access warnings and visual monitoring panels.

2. The sensitive information identification and permission control method based on a large model according to claim 1 is characterized in that: The specific implementation is as follows: Step 1. Definition of sensitive information Step 1.1 Definition Basis: Sensitive information definitions are driven by standardized templates and validated through training with example datasets; Establish an initial labeling system based on preset templates; The sample dataset is used to train and verify the consistency of the model output; Regularly update sensitive information definition templates to support multi-industry expansion; category definitions include: financial data; customer information; transaction records; industry-specific information; Step 2. File processing Step 2.1 OCR Text Extraction: Supported File Types: The system is compatible with a variety of file formats, including PDF, images, and scans. Page Segmentation: Use professional file segmentation tools to split the original document into independent units by page, facilitating subsequent page-by-page processing. Text Extraction: Leveraging Optical Character Recognition (OCR) technology, the segmented files are converted into a structured text format. Quality Control: Automated quality verification of OCR extraction results, combined with manual intervention, ensures the accuracy and completeness of the extracted text. Step 3. Identify and mark sensitive information Step 3.1 Large Model Selection: Use a large model as the core engine for sensitive information identification; this model has powerful natural language processing (NLP) capabilities and can analyze complex semantics and diverse expressions. Step 3.2 Input Preparation: Text and Label Input: Combine the text extracted by OCR with predefined sensitive information category labels as model input data; Prompt Engineering: Write prompts to guide the model to understand the task objectives. Prompts include sensitive information category definitions, recognition rules, and example data. Step 3.3 Sensitive Information Identification: Page-by-Page Processing: Identify sensitive information page by page for each segmented file; Dynamic Optimization: Based on the quality feedback of the recognition results, dynamically adjust the prompt words and model parameters to continuously improve the recognition accuracy and recall rate; Step 4. Sensitive Information Recording Step 4.1 Recording Method: Classified Storage: Identify sensitive information and record it according to predefined categories to form a structured sensitive information list; Metadata Tracking: Record the source file, page number, and extraction time metadata of sensitive information to build a complete data traceability chain; Step 4.2 Storage method: Secure database: All sensitive information records are stored in an encrypted database; Backup mechanism: Implement a regular backup strategy; Step 5. Permissions Provisioning Step 5.1: Permission allocation based on files as the smallest unit: Refined management: supports permission allocation based on files as the smallest unit. Administrators can flexibly set user access rights to specific files; Operation permissions: including read, download, and edit operation permissions; Time limit control: set the effective length of time for user access to files, which will automatically expire after the timeout; Step 5.2 Permission management interface: Friendly interactive design: Provide an intuitive and easy-to-use permission management interface; Audit log: Automatically record the operation log of each permission change, including change time, operator, and specific content information.