A government affair knowledge base collaborative management method and system based on a multi-level permission model

Abstract

The application provides a government affair knowledge base collaborative management method and system based on a multi-level permission model. First, a multi-dimensional semantic association model is established by analyzing the logical relationship between entries, homomorphic encryption technology is used to implement ciphertext operation on the association strength calculation process, the encrypted network topology is mapped to a multi-dimensional vector space, and a distributed vector representation is generated. Based on the topological distribution characteristics of the vector space, a graph neural network is used to detect a set of non-sensitive entries that have hidden associations with explicit sensitive entries, and to reveal hidden sensitive information transmission links in the knowledge graph. For output requests, a dynamic permission adaptation mechanism is established to implement hierarchical masking of associated content in the non-sensitive set, achieving a dynamic balance between security protection and data utility. The technical solution provided by the application accurately identifies hidden sensitive associations in government affair knowledge bases through encryption modeling and vector analysis, and achieves a balance between security and usability with the help of dynamic permission adjustment semantic masking technology.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of collaborative management, and particularly relates to a government affair knowledge base collaborative management method and system based on a multi-level permission model. BACKGROUND

[0002] In the field of government affair knowledge base collaborative management, with the deepening of cross-department business integration and data sharing needs, multi-dimensional permission management scenarios face three core challenges. First, dynamic permission management under a multi-level organizational structure needs to achieve fine-grained access control from the provincial level to the community level. Second, permission mapping of business flow and data flow requires millisecond-level response to support sudden cross-department collaboration. Third, full-link tracing of sensitive operations needs to break through the traditional log auditing mode to achieve causal correlation analysis of permission changes and data access.

[0003] The current mainstream solution adopts an attribute-based access control model, dynamically analyzes user attributes and environmental attributes through a policy decision point, and generates access rules in combination with the sensitivity labels of knowledge base resources. The system uses a graph database to construct a permission relationship network, uses a computing engine to process permission change events, and records operation tracks through a distributed log system.

[0004] This solution has significant defects. Attribute dynamic updates have a second-level delay, resulting in permission synchronization failure during cross-department collaboration. The coupling degree of policy rules and business scenarios is too high, and hundreds of policies need to be manually adjusted for new businesses, with exponential growth in operation and maintenance complexity. The relationship traversal performance of the graph database sharply decreases when the number of nodes exceeds ten thousand, affecting the permission verification efficiency of sudden large-scale collaboration. SUMMARY

[0005] The present application provides a government affair knowledge base collaborative management method and system based on a multi-level permission model to solve the problem of inconvenient management in the prior art.

[0006] In a first aspect, the present application provides a government affair knowledge base collaborative management method based on a multi-level permission model, comprising:

[0007] In the government affair knowledge base, a semantic association network between knowledge entries is established by analyzing the logical dependency relationships between entries and the sensitive information propagation paths;

[0008] A homomorphic encryption process is performed on the calculation process representing the association strength between entries in the semantic association network, and the association structure between knowledge entries in the encrypted semantic association network is mapped to a multi-dimensional vector space to generate a distributed vector representation reflecting the potential association characteristics between knowledge entries;

[0009] Based on the topological distribution of the distributed vector representation in the semantic space, a set of non-sensitive entries having implicit association with explicit sensitive entries is detected;

[0010] In response to a data output request of the government affair knowledge base, a content masking range of the non-sensitive item set is dynamically adjusted based on the permission level, and the process of adjusting the content masking range of the non-sensitive item set comprises: performing a semantic reservation type fuzzification operation on the associated content beyond the permission, and preserving the original semantic structure for the associated content within the permission.

[0011] Optionally, in response to a data output request of the government affair knowledge base, the content masking range of the non-sensitive item set is dynamically adjusted based on the permission level, comprising:

[0012] The permission level identifier of the data output request of the government affair knowledge base is parsed, and the sensitive item filtering rule and the semantic fuzzification strength parameter associated with the permission level are extracted;

[0013] Based on the semantic fuzzification strength parameter, the maximum association depth threshold allowed by the current permission level is extracted from the semantic association network, and the associated path with indirect reference of more than three levels to the explicit sensitive item in the non-sensitive item set is located according to the sensitive item filtering rule;

[0014] According to the maximum association depth threshold and the sensitive item filtering rule, the associated content of the non-sensitive item set is divided into an in-permission accessible subset and an out-of-permission masking subset;

[0015] For the content of the items in the out-of-permission masking subset, a semantic reservation type fuzzification operation is adopted, and the original semantic features are preserved for the in-permission accessible subset, and only the associated path across the permission boundary is fuzzified.

[0016] Optionally, for the content of the items in the out-of-permission masking subset, a semantic reservation type fuzzification operation is adopted, comprising:

[0017] The associated path segment containing the entity name, attribute value and relationship predicate is extracted from the out-of-permission masking subset;

[0018] According to the preset entity generalization rule, the entity name is replaced by the corresponding category label, and the attribute value is converted into an interval range or a type identifier, so as to obtain the generalized entity name and attribute value;

[0019] The main action of the relationship predicate is extracted, and the modifying words are deleted, so as to generate a simplified predicate expression;

[0020] The generalized entity name and attribute value and the simplified predicate expression are reorganized according to the original syntax structure to form an item content with complete syntax but semantic fuzzification;

[0021] The permission boundary identifier is embedded in the item content, and the permission boundary identifier contains the encrypted hash value of the original path and the type mark of the fuzzification operation.

[0022] Optionally, the original semantic features are retained for the accessible subset within the authority, and only the associated path across the authority boundary is obfuscated, including:

[0023] In the accessible subset within the authority, an associated path across the authority boundary with an explicit sensitive entry is detected;

[0024] The entity name and relationship predicate in the associated path are extracted, the entity original name is retained but the entity name attribute value is replaced with a type identifier, the relationship predicate stem is retained but the modifiers involving sensitive references in the path are deleted, to obtain a processed cross-authority boundary path;

[0025] The processed cross-authority boundary path is spliced with the original content retained within the authority to ensure the semantic integrity of the non-cross-boundary path;

[0026] In the spliced content, an authority isolation marker is added to the cross-authority boundary path segment, and the authority isolation marker includes a path encryption check value and a blurring strength level.

[0027] Optionally, a homomorphic encryption process is performed on the calculation process of the association strength between the knowledge entries in the semantic association network, and the association structure between the knowledge entries in the encrypted semantic association network is mapped to a multi-dimensional vector space to generate a distributed vector representation reflecting the potential association characteristics between the knowledge entries, including:

[0028] Based on the logical dependency relationship and sensitive information propagation path between the knowledge entries, an initial association strength value between each pair of entries is generated, and the initial association strength value is calculated from the frequency of citation, the dependency level and the semantic overlap degree;

[0029] The initial association strength value is encrypted using a homomorphic encryption algorithm, so that the encrypted association strength value retains the addition and multiplication operation characteristics;

[0030] In the encrypted state, all multi-hop association paths between the entries in the semantic association network are traversed, and the encrypted association strength values on each multi-hop association path are attenuated and weighted according to the path length to generate an encrypted weighted path strength;

[0031] For each knowledge entry, the encrypted weighted path strength of all paths ending with the knowledge entry is aggregated to obtain an encrypted global association strength value;

[0032] Based on the encrypted global association strength value, the local density weight and the cross-layer jump frequency of each entry in the encrypted association network are extracted, the local density weight is calculated from the total encrypted association strength of the entry within a preset depth, and the cross-layer jump frequency is generated from the number of association paths between non-continuous levels;

[0033] The local density weight and the cross-layer jump frequency are fused into an entry-level topology coefficient in a preset proportion, and a dynamic propagation vector of the entry is generated by iteratively diffusing and weighting the topology coefficients of adjacent entries in an encrypted state;

[0034] The dynamic propagation vector and an encrypted content vector of the entry are orthogonally spliced, and the encrypted content vector is generated by homomorphic encryption feature extraction of entry attributes and text description;

[0035] According to the relative distance of the spliced vector in the multi-dimensional space, the weight of each dimension is adjusted to generate a distributed vector representation reflecting the potential association characteristics between knowledge entries.

[0036] Optionally, based on the topological distribution of the distributed vector representation in the semantic space, a set of non-sensitive entries having implicit association with the explicit sensitive entry is detected, including:

[0037] Based on the final coordinates of the distributed vector representation, the Euclidean distance between the coordinates of all non-sensitive entries and the center of the coordinates of the explicit sensitive entry is calculated, and the non-sensitive entries with a distance less than a first dynamic threshold are selected as a primary candidate set;

[0038] Each non-sensitive entry in the primary candidate set is traversed in all possible transmission paths in the encrypted association strength matrix, only the transmission paths containing more than three intermediate entries are retained, and the ciphertext association weight values in the transmission paths are extracted;

[0039] The ciphertext association weight values of each transmission path are multiplied, and the operation results of all paths are added in ciphertext. If the decrypted addition value exceeds a second dynamic threshold, it is determined that the non-sensitive entry has a hidden association with the explicit sensitive entry, and the non-sensitive entry is classified into a target non-sensitive entry set.

[0040] Optionally, a semantic association network between knowledge entries is established by analyzing the logical dependency relationship and the sensitive information propagation path between entries, including:

[0041] A cross-department government clause reference tracking model is constructed, direct reference and nested reference relationships are parsed based on normative reference annotations in clause text, and a logical dependency edge set is generated;

[0042] The task node topology structure of the administrative process document is parsed, the timing trigger conditions and data dependency relationships between process nodes are extracted based on natural language processing, and node pairs that meet the preset connection rules are modeled as administrative process connection edges;

[0043] An initial semantic association network is constructed based on the logical dependency edge set and the administrative process connection edge;

[0044] Based on the sensitive item tag database, the indirect diffusion path of the sensitive information through the non-sensitive items is identified by using a back propagation algorithm to trace back along the conduction path of the initial semantic association network layer by layer, and the residual intensity value of the sensitive information on each conduction path is calculated through an association strength attenuation function;

[0045] The hierarchical relationship of the set of logical dependency edges, the dynamic weight parameter of the administrative process connection edge, and the residual intensity value are fused and modeled to generate a semantic association network with a weighted directed graph structure.

[0046] Optionally, according to the maximum association depth threshold and the sensitive item filtering rule, the association content of the set of non-sensitive items is divided into an in-privilege accessible subset and an out-of-privilege shielding subset, comprising:

[0047] The semantic association path of the set of non-sensitive items is recursively traversed, and a path length counter is set on each conduction path;

[0048] Based on the path length counter, when an indirect reference relationship with an explicit sensitive item is detected, a path backtracking mechanism is started and the number of intermediate nodes is recorded to obtain a path backtracking result;

[0049] The path backtracking result is input into an association strength attenuation function for weight correction to generate a corrected association strength value;

[0050] If the corrected association strength value is higher than the visibility threshold corresponding to the current privilege level and the path length does not exceed the maximum association depth, the current item is classified into the in-privilege accessible subset, otherwise it is classified into the out-of-privilege shielding subset.

[0051] In a second aspect, the present application provides a government affair knowledge base collaborative management system based on a multi-level privilege model, comprising:

[0052] A building module is configured to build a semantic association network between knowledge items in a government affair knowledge base by analyzing the logical dependency relationship and the sensitive information propagation path between items;

[0053] A generating module is configured to perform homomorphic encryption processing on the calculation process of the association strength between items in the semantic association network, and map the association structure between knowledge items in the encrypted semantic association network to a multi-dimensional vector space to generate a distributed vector representation reflecting the potential association characteristics between knowledge items;

[0054] A detecting module is configured to detect a set of non-sensitive items having an implicit association with an explicit sensitive item based on the topological distribution of the distributed vector representation in the semantic space;

[0055] The response module is configured to dynamically adjust a content masking range of the non-sensitive item set based on the permission level in response to a data output request of the government affair knowledge base, and the process of adjusting the content masking range of the non-sensitive item set comprises: performing a semantic reservation type fuzzing operation on the associated content beyond the permission, and reserving an original semantic structure for the associated content within the permission.

[0056] In a third aspect, an embodiment of the present application provides a computing device, comprising a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement the method for collaborative management of a government affair knowledge base based on a multi-level permission model as described in the first aspect above.

[0057] The present application establishes a semantic association network by analyzing the logical dependency relationship between the government affair knowledge base items and the sensitive information propagation path, and the technical effect is to realize the systematic modeling of the explicit and implicit association relationship in the knowledge system, and break through the recognition limitation of the traditional association analysis method based on keyword matching in the complex semantic scene. By using the homomorphic encryption technology to process the association strength calculation process and mapping the encrypted network to the multi-dimensional vector space, the technical effect is to generate a distributed vector representation with potential association characteristics under the premise of ensuring data privacy and security, and to provide a quantitative analysis basis for sensitive information detection. Based on the topological distribution detection of the distributed vector representation and the existence of the implicit association of the non-sensitive item set of the explicit sensitive item, the technical effect is to establish an automatic recognition mechanism of the multi-level sensitive information propagation path, and significantly improve the discovery ability of the potential information leakage risk. By dynamically adjusting the content masking range of the non-sensitive item set based on the permission level and performing a semantic reservation type fuzzing operation, the technical effect is to realize fine-grained adaptive access control, to maintain the semantic coherence of the knowledge base while ensuring data security.

[0058] Further, the sensitive item filtering rule and the semantic fuzzing intensity parameter are extracted by analyzing the permission level identifier of the data output request, and the maximum association depth threshold allowed by the permission is extracted from the semantic association network based on the parameter setting, and the technical effect is to establish a configurable hierarchical access control mechanism to realize differentiated security protection. By positioning the association path with more than three indirect references between the non-sensitive item set and the explicit sensitive item and dividing the permission-allowed accessible subset and the unauthorized-need-to-mask subset, the technical effect is to realize accurate identification and classification management of cross-permission boundary association relationship. The semantic reservation type fuzzing technology is used to process the association content in the unauthorized-need-to-mask subset, and the technical effect is to ensure the protection effect of sensitive information while maximizing the semantic value of knowledge, significantly improving the security and usability of government knowledge sharing. By dynamically adjusting the masking range and the fuzzing intensity, the technical effect is to establish an adaptive security protection system to effectively balance the demand contradiction between data security and knowledge usability.

[0059] These aspects or other aspects of the present application will be more apparent in the following description of the embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0060] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiment or prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0061] Figure 1 A flow chart of a government knowledge base collaborative management method based on a multi-level permission model provided by the present application is shown;

[0062] Figure 2 A scene diagram of a government knowledge base collaborative management system based on a multi-level permission model provided by the present application is shown;

[0063] Figure 3 A structural schematic diagram of a government knowledge base collaborative management system based on a multi-level permission model provided by the present application is shown;

[0064] Figure 4 A structural schematic diagram of a computing device provided by the present application is shown. DETAILED DESCRIPTION

[0065] In order to make the person skilled in the art better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application.

[0066] In some of the flowcharts described in the specification and claims of the present application and in the above description of the drawings, a plurality of operations are included in the order in which they occur, but it should be clearly understood that these operations can be executed or performed in parallel or in an order different from that in which they occur in this article, and the serial numbers of the operations such as 101, 102, etc. are only used to distinguish different operations, and the serial numbers themselves do not represent any execution order. In addition, these flowcharts can include more or fewer operations, and these operations can be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc. and do not represent the order of precedence. Also, "first" and "second" are not of different types.

[0067] Research finds that in the field of government knowledge base collaborative management, the existing attribute-based access control model has three major key bottlenecks: first, attribute update delay causes permission synchronization failure, data access conflicts occur when cross-department collaboration, second, policy rules are strongly coupled with business scenarios, and a large number of policies need to be configured manually for new businesses, and the operation and maintenance cost rises exponentially, third, the relationship traversal performance of the graph database drops sharply when the number of nodes exceeds ten thousand, making it difficult to support permission verification for sudden large-scale collaboration. These defects are due to the insufficient adaptability of static permission models to dynamic business environments and the performance limitations of centralized architectures in complex correlation calculations.

[0068] To solve the above problems, the present application proposes a collaborative management method based on semantic association network and dynamic vectorization permission mapping, the core of which is to construct an encrypted semantic association network between knowledge entries, and to realize fine-grained dynamic control of permissions through distributed vector space. Specifically, the entry association strength calculation is processed through homomorphic encryption, the semantic network is mapped to a multi-dimensional vector space to generate a potential association feature representation, and a semantic-preserving fuzzy operation is implemented based on the permission level. This method breaks through the static policy limitations of traditional attribute models, realizes millisecond-level dynamic adjustment through vectorization permission mapping, solves the permission synchronization delay problem, greatly reduces the amount of manual rule configuration through automatic policy generation of the semantic association network, and improves the permission verification efficiency by more than 5 times under the condition of more than ten thousand nodes through distributed vector calculation instead of graph traversal. This fundamentally solves the performance defects and operation and maintenance problems of existing technologies in dynamic collaboration scenarios, and significantly improves the security and collaboration efficiency of government knowledge sharing.

[0069] The technical solutions in the embodiments of the present application will be described clearly and completely in the embodiments of the present application combined with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0070] Figure 1A flowchart of a government knowledge base collaborative management method based on a multi-level permission model is provided for an embodiment of the present application, as shown in Figure 1 The method comprises the following steps.

[0071] 101. In the government knowledge base, a semantic association network between knowledge entries is established by analyzing the logical dependency relationship and the sensitive information propagation path between entries.

[0072] Optionally, step 101 comprises the following steps.

[0073] 1011. A cross-department government clause reference tracking model is constructed, direct reference and nested reference relationships are parsed based on normative reference annotations in clause text, and a logical dependency edge set is generated.

[0074] 1012. The task node topology structure of the administrative process document is parsed, the timing trigger condition and the data dependency relationship between the process nodes are extracted based on natural language processing, and the node pairs that meet the preset connection rules are modeled as administrative process connection edges.

[0075] 1013. An initial semantic association network is constructed based on the logical dependency edge set and the administrative process connection edge.

[0076] 1014. Based on the sensitive entry label database, a back propagation algorithm is used to backtrack layer by layer along the conduction path of the initial semantic association network, to identify the indirect diffusion path of classified data through non-sensitive entries, and to calculate the residual intensity value of sensitive information on each conduction path through an association strength decay function.

[0077] 1015. The hierarchical relationship of the logical dependency edge set, the dynamic weight parameter of the administrative process connection edge, and the residual intensity value are fused and modeled to generate a semantic association network with a weighted directed graph structure.

[0078] In the above scheme, the logical dependency edge set refers to the network edge set formed by parsing the normative reference annotations in the cross-department government clause text, the nested reference relationship refers to the indirect reference chain formed by intermediate clauses, the preset connection rule refers to the pre-defined node connection logic verification condition, the initial semantic association network refers to the basic network structure constructed by integrating the logical dependency edge and the administrative process connection edge, the sensitive entry label database refers to a special database that stores the classified clause identification and its associated features, the back propagation algorithm refers to an algorithm that traces the sensitive information propagation path in reverse along the network edge, the conduction path refers to the transmission link of sensitive information between entries, the association strength decay function refers to a mathematical function that gradually reduces the association strength according to the path length, the residual intensity value refers to the remaining association quantitative value of sensitive information after transmission through non-sensitive entries, and the weighted directed graph structure refers to a network topology model containing directionality and weight attributes.

[0079] In the embodiments of the present application, first, a cross-department government clause reference tracking model is constructed through step 1011, the normative reference mark in the clause text is parsed, and the direct reference and nested reference relationship is identified. For example, the expression "according to Article X of Tax Management Regulations" appears in an environmental protection clause, the referenced tax clause name and clause number are matched using regular expressions, and a direct logical dependency edge from the environmental protection clause to the tax clause is generated. If the tax clause internally references a finance clause, a nested reference edge from the finance clause to the tax clause is further established, forming a three-level dependency chain. All reference relationships are stored in a logical dependency edge set, and each edge records the reference type, level depth, and text location information.

[0080] Secondly, the task node topology structure of the administrative process document is parsed through step 1012, and the temporal trigger condition and data dependency relationship between the process nodes are extracted using dependency syntax analysis technology. For example, in a project approval process document, "material preliminary review completion" is identified as the precondition of "expert evaluation start", and an administrative process connection edge between the two nodes is established through the condition trigger rule. At the same time, it is detected that "expert evaluation result" is the data input dependency of "result publicizing", and a connection edge with data flow direction identifier is generated. All node pairs that meet the preset connection rules are modeled as administrative process connection edges, and the edge attributes include trigger condition expression and data dependency type.

[0081] Then, the logical dependency edge set and the administrative process connection edge are fused through step 1013 to construct an initial semantic association network. For example, the logical dependency edge of the environmental protection clause is connected with the material preliminary review node in the project approval process to form a mixed type semantic edge. The network is stored in a directed graph structure, the node contains the clause text summary and the process node description, and the edge attribute integrates the reference level, the process trigger condition and the data dependency type.

[0082] Then, through step 1014, reverse propagation analysis is performed based on the sensitive clause tag database. For example, after identifying the social security data class sensitive item, the level is backtracked along the out-edge direction of the initial semantic association network. When a three-level transmission path of social security data->population statistics->regional planning is detected, the residual intensity value of sensitive information is calculated using an association strength attenuation function. The specific process is as follows: set the initial path strength to 1.0, apply an exponential attenuation coefficient of 0.6 every time a non-sensitive item is passed, and the residual intensity value after three-level transmission is 1.0 x 0.6 3 = 0.216. The residual intensity values of all transmission paths are stored in the path attribute table.

[0083] Finally, the hierarchical relationship of the logical dependency edge, the dynamic weight parameter of the administrative process connection edge, and the residual strength value are fused by step 1015 to generate a semantic association network with a weighted directed graph structure. For example, for the association edge between the environmental protection clause and the tax clause, the calculation of the maximum weight = logical reference strength (0.8) x process dynamic weight (0.7) + residual strength value (0.216) = 0.776. The network uses dual storage structures of adjacency matrix and adjacency list to support fast traversal and multi-dimensional query.

[0084] In practical applications, taking the environmental protection penalty regulations of a certain city as an example, when the system parses the normative reference annotations in the clause text, it is found that it explicitly references Article 15 of the Tax Management Law. Through regular expression precise extraction of the reference relationship, a direct logical dependency edge from the environmental protection clause to the tax clause is generated, and the initial weight is set to 0.8. Further analysis shows that the tax clause internally nests Article 32 of the Financial Budget Regulations, forming a three-level dependency chain. According to the preset hierarchical attenuation coefficient of 0.7, the weight of the nested reference path is 0.8 x 0.7 2 = 0.392, reflecting the attenuation effect of cross-level references. In the administrative process document, natural language processing technology extracts key node relationships and identifies that “material preliminary review completion” must satisfy the condition of material completeness greater than 90% to trigger “expert review start”. Based on this, an administrative process connection edge with a conditional expression is established, and “expert review result” is marked as the data input dependency of “penalty public notice”. By using the back propagation algorithm to trace the transmission path of the sensitive item “personal social security information”, it is found that it spreads to the enterprise credit public notice system through population statistics, environmental protection penalties, and other non-sensitive items. The residual strength value of the three-level transmission path is calculated using an exponential decay function: the initial strength is 1.0, the attenuation coefficient of each level is 0.6, and the final residual strength is 0.6 3 = 0.216, marking this path as a high-risk link. Finally, the hierarchical weight of the logical dependency edge, the dynamic parameter of the process connection edge, and the residual strength value are fused to construct a semantic network with a weighted directed graph structure, for example, the comprehensive weight of the association edge between the environmental protection clause and the tax clause is 0.392 (logical dependency) + 0.3 (process dynamic weight) = 0.692.

[0085] In the above step 101 scheme, by constructing a cross-department reference tracking model and administrative process topology analysis, a semantic association network that integrates logical dependency and dynamic weight is established. The reference relationship analysis accurately captures the explicit logical chain between clauses, the administrative process connection edge describes the dynamic interaction characteristics of task nodes, and the back propagation algorithm effectively traces the non-explicit transmission path of sensitive information. Combined with hierarchical relationship attenuation and residual strength calculation, a weighted directed graph structure is generated to represent the explicit association and potential transmission risk of knowledge items, laying a multi-dimensional network foundation for subsequent encryption analysis and association mining.

[0086] 102. Perform homomorphic encryption processing on the calculation process of the semantic association network representing the strength of the association between entries, and map the association structure between knowledge entries in the encrypted semantic association network to a multi-dimensional vector space to generate a distributed vector representation reflecting the potential association characteristics between knowledge entries;

[0087] Optionally, step 102 comprises:

[0088] 1021. Based on the logical dependency relationship and sensitive information propagation path between knowledge entries, generate an initial association strength value between each pair of entries, which is calculated by the frequency of citation, dependency level and semantic overlap degree;

[0089] 1022. Encrypt the initial association strength value using a homomorphic encryption algorithm, so that the encrypted association strength value retains the characteristics of addition and multiplication operations;

[0090] 1023. In the encrypted state, traverse all multi-hop association paths between entries in the semantic association network, and attenuate and weight the encrypted association strength value on each multi-hop association path according to the path length to generate an encrypted weighted path strength;

[0091] 1024. For each knowledge entry, aggregate all encrypted weighted path strengths that end with the knowledge entry to obtain an encrypted global association strength value;

[0092] 1025. Based on the encrypted global association strength value, extract the local density weight and cross-layer jump frequency of each entry in the encrypted association network, the local density weight is calculated by the sum of encrypted association strength within a preset depth, and the cross-layer jump frequency is generated by the number of association paths between non-continuous levels;

[0093] 1026. Fuse the local density weight and cross-layer jump frequency into an entry-level topology coefficient according to a preset proportion, and perform weighted superposition of the topology coefficients of adjacent entries in the encrypted state through an iterative diffusion algorithm to generate a dynamic propagation vector of the entry;

[0094] 1027. Orthogonalize and splice the dynamic propagation vector and the encrypted content vector of the entry, the encrypted content vector is generated by homomorphic encryption feature extraction of entry attributes and text description;

[0095] 1028. According to the relative distance of the spliced vector in the multi-dimensional space, adjust the weight of each dimension to generate a distributed vector representation reflecting the potential association characteristics between knowledge entries.

[0096] In the above scheme, the initial association strength value refers to the basic association degree between entries calculated by combining the citation frequency, dependency level, and semantic overlap degree, the homomorphic encryption algorithm refers to an encryption method that supports addition and multiplication operations in a ciphertext state, the multi-hop association path refers to an association link that spans multiple intermediate entries, the encrypted weighted path strength refers to a ciphertext value obtained by attenuating and weighting the encrypted initial association strength in a multi-hop path according to the path length, the encrypted global association strength value refers to the sum ciphertext obtained by aggregating all encrypted path strengths pointing to the target entry, the local density weight refers to the association strength ciphertext accumulation value of the entry within a preset network depth, the cross-layer jump frequency refers to the number of times the entry establishes an association by spanning non-continuous levels, the entry-level topology coefficient refers to a comprehensive index that integrates the local density weight and the cross-layer jump frequency, the iterative diffusion algorithm refers to a calculation method for updating the topology coefficient by transmitting the weight of adjacent nodes in an encrypted state, the dynamic propagation vector refers to a vectorized representation of the topology characteristics of the entry in an encrypted network, the encrypted content vector refers to a text semantic feature vector processed by a homomorphic encryption, and the orthogonal splicing refers to an operation of merging the dynamic propagation vector and the encrypted content vector in an orthogonal dimension.

[0097] In the embodiments of the present application, first, the initial association strength value between each pair of knowledge entries is calculated through step 1021. Specifically, the direct citation frequency between clauses is counted, for example, the environmental protection clause is cited by 3 clauses, so the citation frequency basic value is 3, combined with the dependency level attenuation factor, for example, the second-level citation applies an attenuation coefficient of 0.8, the actual contribution value is 3*0.8=2.4, and then the cosine similarity of the 768-dimensional vector of the clause text is calculated through the BERT model, for example, the semantic similarity between the environmental protection clause and the tax clause is 0.75. Finally, the initial association strength value=2.4*0.75=1.8 is obtained to reflect the explicit logical association strength between clauses.

[0098] Secondly, the initial association strength value is encrypted by step 1022 using the Paillier homomorphic encryption algorithm. The public key pk and the private key sk are generated, and the private key is distributed to multiple participants in the form of secret sharing, ensuring that a single node cannot decrypt the data. The value 1.8 is encrypted, for example, the ciphertext E(1.8)=g 1.8 ·r n modn 2 , where g is the generator, r is a random number, and n is the key parameter. The encrypted ciphertext retains the homomorphic properties of addition and multiplication, for example, E(1.8)+E(0.6)=E(2.4), which supports subsequent ciphertext calculations.

[0099] Then, through step 1023, the multi-level conduction path in the semantic association network is traversed in an encrypted state. For example, a three-level path of environmental protection clause->tax clause->finance clause is detected, the path length is 2, and an exponential attenuation coefficient of 0.7 is applied2 = 0.49. Perform homomorphic multiplication operations on the encryption correlation strength on the path, such as E(1.8) x E(0.75) x 0.49 = E(0.66), and store the result as the weighted path strength feature.

[0100] Then, aggregate the encrypted global correlation strength value of each knowledge item by step 1024. For example, the fiscal clause node receives E(0.74) from the environmental clause path and E(1.2) from the economic clause direct path, which are aggregated by homomorphic addition to E(1.94). Normalize the global strength value according to the number of node in-edges, for example, the normalization coefficient is 1 / 5 when the number of node in-edges is 5, ensuring unbiased centrality calculation.

[0101] Then, extract the local density weight and cross-layer jump frequency by step 1025. The local density weight is calculated as the homomorphic accumulation value of all encrypted correlation strengths within three hops of the node, for example, the local density of the environmental clause is E(5.6), and the cross-layer jump frequency counts the number of transmission paths that cross more than two levels, for example, the environmental clause has 3 cross-level paths, such as clause -> process -> department, and the two are fused to generate the entry-level topology coefficient in a 7:3 ratio.

[0102] Then, generate a dynamic propagation vector by step 1026. Input the topology coefficient into a graph convolution network (GCN), for example, the topology coefficient of the environmental node E(4.62) is superimposed with the adjacent tax node E(3.8) with a weight of 0.6, and after iterative diffusion, a 128-dimensional dynamic propagation vector E(6.9) is generated, representing the global propagation influence of the node in the encrypted network.

[0103] Then, perform orthogonal feature splicing by step 1027. Orthogonally splice the dynamic propagation vector with the encrypted content vector, where the encrypted content vector refers to the 768-dimensional semantic vector generated by Sentence-BERT. Use the Gram-Schmidt algorithm to eliminate dimension redundancy, for example, the first 3 dimensions of the dynamic propagation vector are [0.8, 0.6, 0.4], and the first 3 dimensions of the semantic vector are [0.2, 0.7, 0.5], after splicing, a 896-dimensional composite vector is formed, ensuring that there is no redundancy between structural features and semantic features.

[0104] Finally, adjust the multi-dimensional space weight by step 1028. Use the t-SNE algorithm to reduce the 896-dimensional vector to 32 dimensions, for example, the vector distance between the environmental clause and the tax clause is optimized from 1.2 to 0.3; dynamically adjust the weight of each dimension according to the cosine similarity, for example, the weight coefficient of dimension 3 is increased from 0.5 to 0.8, allowing semantic-related entries to cluster in space.

[0105] In practical applications, for the initial correlation strength value of 1.8 between the environmental clause and the tax clause, the Paillier homomorphic encryption algorithm generates ciphertext E(1.8) = g1.8 ·r n modn 2 The public key parameter n = 2048, and the random number r = 12345. When a three-level transmission path from environmental protection clauses to financial clauses is detected, a path attenuation coefficient of 0.7 is applied to the encryption association strength values ​​E(1.8) and E(0.75) along the path. 2 =0.49, and the weighted path strength calculated by homomorphic multiplication is E(1.8×0.75×0.49)=E(0.66). The strength of all incoming paths to the fiscal clause node is aggregated, including the environmental clause path E(0.66) and the direct path E(1.2) of the economic clause, and the global association strength E(1.86) is obtained through homomorphic addition. The local density weight E(5.6) within three hops and the cross-layer hop frequency of 3 times for the environmental clause are extracted and fused at a 7:3 ratio to generate the topological coefficient E(5.6×0.7+3×0.3)=E(4.62). After iterative diffusion through a graph convolutional network, a 128-dimensional dynamic propagation vector is generated. This vector is orthogonally concatenated with the 768-dimensional semantic vector generated by Sentence-BERT to form an 896-dimensional composite vector. The dimensionality is reduced to 32 dimensions using the t-SNE algorithm, optimizing the vector distance between the environmental clause and the tax clause from 1.2 to 0.3, accurately reflecting the semantic association.

[0106] In the scheme of step 102 above, a privacy-preserving vectorized representation of the association characteristics of knowledge items is achieved by calculating the multi-hop path strength under homomorphic encryption and fusing topological features. Encryption strength value calculation ensures the computational security of sensitive association data, dynamic propagation vectors capture the implicit propagation influence of items in the encrypted network, and orthogonal concatenation ensures the independent expression of semantic and topological features. The resulting distributed vector representation effectively preserves the potential association patterns between items within the encrypted space, providing a computationally achievable and secure feature space for hidden relationship detection.

[0107] 103. Based on the topological distribution of the distributed vector representation in the semantic space, detect the set of non-sensitive entries that have implicit associations with the explicit sensitive entries;

[0108] Optionally, step 103 includes:

[0109] 1031. Based on the final coordinates of the distributed vector representation, with the coordinates of the explicit sensitive entries as the center, calculate the Euclidean distance between the coordinates of all non-sensitive entries and the center, and filter out non-sensitive entries with a distance less than the first dynamic threshold as the primary candidate set;

[0110] 1032. Traverse all possible propagation paths of each non-sensitive entry in the primary candidate set in the encrypted association strength matrix, retain only the propagation paths containing intermediate entries of level three or above, and extract the ciphertext association weight values ​​in the propagation paths.

[0111] 1033、performing a multiplication operation on the ciphertext correlation weight value of each conduction path, and performing ciphertext accumulation on the operation results of all paths, if the decrypted superposition value exceeds the second dynamic threshold value, determining that the non-sensitive item and the explicit sensitive item exist in hidden correlation, and classifying the non-sensitive item into a target non-sensitive item set.

[0112] In the above scheme, the first dynamic threshold value refers to a Euclidean distance critical value adaptively adjusted according to vector space density, the conduction path refers to a propagation link formed between items through multi-level correlation, the ciphertext correlation weight value refers to a reserved value of path correlation strength in an encrypted state, the multiplication operation refers to an operation of continuously multiplying weights of each segment of the path in a ciphertext state, the ciphertext accumulation refers to summing up the encrypted operation results of multiple paths, the second dynamic threshold value refers to a strength critical value for determining hidden correlation after decryption, and the hidden correlation determination refers to a logical judgment of confirming that the non-sensitive item and the sensitive item exist in hidden correlation by the decrypted superposition value exceeding the threshold value.

[0113] In the embodiment of the application, first, the Euclidean distance between the non-sensitive item and the explicit sensitive item is calculated and the primary candidate set is screened through step 1031. In the distributed vector space, the coordinates of the explicit sensitive item are (0.3, 0.5, 0.7), and the coordinates of the non-sensitive item “regional population statistics” are (0.35, 0.52, 0.68). The distance between the two is calculated by the Euclidean distance formula as follows: If the current first dynamic threshold value is 0.1, and 0.057<0.1, the non-sensitive item is included in the primary candidate set. For example, in a certain detection, 25 of the 100 non-sensitive items have distance values lower than the threshold value, forming the primary candidate set.

[0114] Secondly, the conduction path of each item in the primary candidate set is traversed through step 1032. Specifically, the three-level conduction path “regional planning -> population statistics -> community management -> personal identity information” of the non-sensitive item “regional planning” to the explicit sensitive item “personal identity information” is detected, and the path length is 3. The ciphertext correlation weight values on the path are extracted, such as E(0.8), E(0.6), and E(0.5), and the path attenuation coefficient 0.7 is applied 3 =0.343, and the weighted path strength is calculated by homomorphic multiplication as E(0.8×0.6×0.5×0.343)=E(0.082). Only the three-level and above conduction paths are screened, and short path interference is excluded.

[0115] Then, the ciphertext weighted path strength is accumulated and determined by step 1033. Specifically, homomorphic addition is performed on all the transmission paths of a non-sensitive item, for example, the ciphertext values of 5 paths are E(0.082), E(0.076), E(0.063), E(0.055), and E(0.042), and the accumulated result is E(0.318). After decryption, the superposition value is 0.318, and if the second dynamic threshold is 0.3, since 0.318>0.3, it is determined that the item has hidden association. For example, in a certain detection, 8 superposition values of 25 items in the primary candidate set exceed the threshold, and the target non-sensitive item set is obtained.

[0116] In actual application, in the distributed vector space, the coordinates of the explicit sensitive item “personal ID number” are (0.3, 0.5, 0.7), and the coordinates of the non-sensitive item “regional population statistics” are (0.35, 0.52, 0.68). The distance between the two is calculated by the Euclidean distance formula which is lower than the first dynamic threshold 0.1, and the item is included in the primary candidate set. When traversing the transmission path, the third-level path “regional statistics -> community management -> identity information” is found, the encrypted weight values E(0.8), E(0.6), and E(0.5) on the path are extracted, the decay coefficient 0.7 3 =0.343 is applied, and the weighted path strength is calculated as E(0.8*0.6*0.5*0.343)=E(0.082). Homomorphic accumulation is performed on the ciphertext values of 5 similar paths, and the decrypted superposition value is 0.318, which exceeds the second dynamic threshold 0.3, and it is determined that the item has hidden association with sensitive information. For example, in a certain detection, 8 decrypted values of 25 items in the primary candidate set exceed the threshold, and the system automatically classifies them into the target non-sensitive item set and marks the transmission path.

[0117] In the scheme of step 103, the distance screening based on the encrypted vector space and the multi-level transmission path ciphertext calculation realize the accurate positioning of the non-sensitive item with hidden association of the explicit sensitive item. The dynamic threshold mechanism adapts to the density difference of different semantic regions, the multi-hop path strength superposition eliminates the interference of short paths, and the ciphertext operation guarantees the privacy of the sensitive transmission weight. Under the premise of ensuring data security, this method effectively reveals the hidden association between the non-sensitive item and the sensitive information through complex transmission paths, and improves the identification dimension of the risk of sensitive information diffusion.

[0118] 104. In response to a data output request of the government affair knowledge base, the content masking range of the non-sensitive item set is dynamically adjusted based on the permission level, and the process of adjusting the content masking range of the non-sensitive item set includes: performing a semantic reservation type fuzzing operation on the associated content exceeding the permission, and retaining the original semantic structure of the associated content within the permission.

[0119] Optionally, step 104 includes:

[0120] 1041. Analyze the permission level identifier of the data output request of the government affair knowledge base, extract the sensitive entry filtering rule and semantic fuzzification strength parameter associated with the permission level;

[0121] 1042. Based on the semantic fuzzification strength parameter, extract the maximum association depth threshold allowed by the current permission level from the semantic association network, and locate the association path with indirect reference of more than three levels with the explicit sensitive entry in the non-sensitive entry set according to the sensitive entry filtering rule;

[0122] 1043. According to the maximum association depth threshold and the sensitive entry filtering rule, divide the association content of the non-sensitive entry set into a permission-allowed accessible subset and a need-to-mask unauthorized subset;

[0123] Wherein, step 1043 specifically includes: recursively traversing the semantic association path of the non-sensitive entry set, and setting a path length counter on each transmission path; based on the path length counter, when detecting the indirect reference relationship with the explicit sensitive entry, starting the path backtracking mechanism and recording the number of intermediate nodes to obtain the path backtracking result; input the path backtracking result into the association strength attenuation function for weight correction to generate the corrected association strength value; if the corrected association strength value is higher than the visibility threshold corresponding to the current permission level and the path length does not exceed the maximum association depth, the current entry is divided into the permission-allowed accessible subset, otherwise it is divided into the need-to-mask unauthorized subset.

[0124] 1044. For the entry content in the need-to-mask unauthorized subset, adopt the semantic reservation type fuzzification operation, and for the permission-allowed accessible subset, reserve the original semantic features, and only perform fuzzification processing on the association path across the permission boundary.

[0125] In the step 1044, the associated path segment containing the entity name, attribute value and relation predicate is extracted from the unauthorized need-to-mask subset; the entity name is replaced by the corresponding category label and the attribute value is converted into an interval range or type identifier according to the preset entity generalization rule to obtain the generalized entity name and attribute value; the relation predicate is subjected to main action extraction and the modifying words are deleted to generate a simplified predicate expression; the generalized entity name and attribute value and the simplified predicate expression are reorganized according to the original syntax structure to form an entry content with complete syntax but fuzzy semantics; and the permission boundary identifier containing the encrypted hash value of the original path and the type label of the fuzzing operation is embedded in the entry content. In the permission-in-access subset, the associated path crossing the permission boundary with the explicit sensitive entry is detected; the entity name and relation predicate in the associated path are extracted; the entity original name is retained but the entity name attribute value is replaced by the type identifier; the relation predicate main body is retained but the modifying words related to the sensitive reference in the path are deleted to obtain the processed cross-permission boundary path; the processed cross-permission boundary path and the original content retained in the permission-in are spliced to ensure the semantic integrity of the non-cross boundary path; and the permission isolation label containing the encrypted check value of the path and the fuzzing strength level is added to the cross-permission boundary path segment in the spliced content.

[0126] In the above scheme, the permission level refers to the current data access permission level of the user, the content masking range refers to the associated content set that needs to be hidden or fuzzed according to the permission, the semantic retention type fuzzing operation refers to a processing method for replacing sensitive information while maintaining the syntax structure, the permission boundary identifier refers to an encrypted label marking the unauthorized access path, the encrypted hash value refers to a unique path identifier generated by a hash function, the fuzzing operation type label refers to metadata recording the operation category such as replacement, generalization or deletion, and the permission isolation label refers to an encrypted label used to identify the path segment crossing the permission boundary.

[0127] In the embodiment of the present application, first, the permission level identifier of the data output request is parsed by the step 1041 and the corresponding sensitive filtering rule is loaded. For example, when the request party is the basic level permission Level-2, the system extracts the allowed maximum associated path depth of 2 levels, the address information needs to be fuzzed to the city level unit, the numerical accuracy needs to be preserved to the order of magnitude but the last two digits are hidden from the permission parameter table. The specific operation is to generalize Beijing Haidian Zhongguancun to Beijing, convert the monthly income of 25000 yuan to about 25,000 yuan, and load the sensitive entity blacklist such as ID number and social security number to match the fields that need to be masked. At this time, the system also loads the visibility threshold 0.35 which is used for subsequent path weight judgment.

[0128] Secondly, the overreach association path is located and the attenuation weight is calculated based on the semantic association network through step 1042. Taking the regional planning of a certain government entry as an example, the conduction path from it to the sensitive entry personal identity information is “regional planning -> population statistics -> community management -> identity information”, and the path length is 3 levels. The attenuation weight is calculated by applying the formula attenuation weight = original weight multiplied by 0.7 raised to the power of path length, wherein the original weight is 1.0, the path length is 3 levels, and the corrected weight is 1.0 multiplied by 0.7 raised to the power of 3, which is equal to 0.343. Since the visibility threshold of the basic level authority Level-2 is 0.35, 0.343 is less than 0.35, it is determined that the path is an overreach path, and the intermediate nodes population statistics and community management are recorded in the log and marked as authority boundary points. For example, 10 such paths are detected, 3 of which involve social security data and 7 of which involve financial data, all of which trigger the masking rule.

[0129] Then, the association path is recursively traversed and the subsets are dynamically divided through step 1043. For the two conduction paths of the entry regional planning, the depth of path 1 is 2 levels, and the weight is 0.49, because 0.49>0.35, it is divided into the authority-in-accessible subset, and the original description of the association between regional planning and population statistics data is returned; the depth of path 2 is 3 levels, and the weight is 0.343, because 343<0.35, it is divided into the overreach masking subset, and the sensitive path segment in the content is replaced by regional planning to the authority boundary to personal identity information. At the same time, the metadata label MASK_LEVEL equal to 3 is added to the masked path, and the fuzzification range is marked in the returned result, for example, when a basic level user queries, only the regional planning data and the association between the municipal statistics are displayed, which affects the community service.

[0130] Finally, the semantic-preserving fuzzing operation is implemented and the audit identifier is embedded through step 1044. Specifically, the entity information in the unauthorized path is generalized, for example, “Zhang, ID 1101011980XXXX” is replaced by “certain user, ID number belongs to Beijing”; the numerical value “monthly income 25000 yuan” is converted to “about 2.5 ten thousand yuan”, retaining the order of magnitude but hiding the exact value; the relationship description “directly leading to loan approval failure” is simplified to “influencing financial business evaluation”. The gradient fuzzing strength is dynamically adjusted according to the path depth, for example, 70% of the original information is retained for a two-level path, such as Beijing Chaoyang District, and only 30% is retained for a three-level path, such as Beijing. The audit identifier is embedded at the end of the fuzzed content, in the format “#permission ID-time stamp-operation type”, for example, “#6a3b1c-20250520T1430-MASK3” indicates a three-level fuzzing operation performed by the account with ID 6a3b1c on May 20, 2025 at 14:30, and the SHA-256 hash value of the original path is stored in the audit log, such as SHA-256 hash value a1b2c3d4, ensuring that the operation is traceable and the content is irreversible. For example, the end of the result returned by a certain query is appended with “#6a3b1c-20250520T1430-MASK3”, and the background can verify the operation compliance through the hash value, but the original sensitive information cannot be restored.

[0131] In actual application, when the basic user Level-2 initiates a data request, the system loads the permission rules: maximum correlation depth 2 levels, address fuzzing to city level, numerical value precision retention thousand. When detecting that the “environmental protection penalty” item exists in the three-level transmission path “penalty record->enterprise credit->legal person identity information”, the path weight is modified to 0.343 by the decay function, which is lower than the visibility threshold 0.35, and is included in the unauthorized masking subset. When recursively traversing the path, the path counter shows that the number of intermediate nodes is 3, triggering the fuzzing operation. The original description “Zhang (ID 1101011980XXXX) was punished 3 million yuan for environmental violations” is replaced by “certain legal person was punished about 3 million yuan for environmental problems”, and the audit identifier #6a3b1c-20250520T1430-MASK3 is embedded, and the SHA-256 hash value a1b2c3d4 of the original path is recorded to the audit log. The authorized path “environmental protection penalty->enterprise credit” retains the original description, and only the cross-authorization segment “enterprise credit->legal person identity information” implements semantic-preserving fuzzing, generating “enterprise credit data affects certain legal person credit evaluation #6a3b1c-20250520T1430-MASK2”. The final output result not only meets the requirements of permission control, but also realizes operation traceability through the audit identifier, meeting the compliance requirements of the “Data Security Law”.

[0132] In the scheme of step 104, the hierarchical security control of government knowledge output is realized through dynamic permission-driven masking range adjustment and semantic reservation-type fuzzing technology. The dual constraints of path depth threshold and visibility threshold accurately divide the accessible content boundary. Entity generalization and predicate simplification eliminate sensitive semantic details while maintaining the syntax structure. Permission isolation markers ensure complete tracing of unauthorized operations. This scheme ensures that low-privilege users can access valid information while blocking indirect leakage of sensitive information through associated paths, achieving a dynamic balance between security and usability.

[0133] The following is a complete embodiment for steps 101-105, as shown in Figure 2

[0134] In the intelligent management of government knowledge base, constructing a semantic association network is the first step to achieve dynamic control of sensitive information. The system automatically identifies direct and nested reference relationships by parsing the normative reference annotations of cross-department clauses. For example, when a certain environmental protection clause references Article X of the Tax Management Regulations, the system uses regular expressions to accurately match the tax clause name and clause number, generating a direct logical dependency edge from the environmental protection clause to the tax clause. When the tax clause further references the finance clause, the system constructs a three-level dependency chain: environmental protection -> tax -> finance, and quantifies the dependency strength through hierarchical decay coefficients, such as a two-level reference weight of 0.8. At the same time, when parsing administrative process documents, dependency syntax analysis technology is used to extract the temporal trigger conditions between task nodes: for example, identifying "material preliminary review completed" as a prerequisite for "expert review initiation", establishing a process connection edge, and labeling data flow, such as expert review results -> result publicizing. The fusion of logical dependency edges and process connection edges forms an initial semantic network, with edge attributes including reference level, trigger condition, and data dependency type, and node attributes storing clause abstracts and process descriptions, providing a structured foundation for subsequent analysis.

[0135] Based on the above network structure, the system introduces a homomorphic encryption mechanism to protect the association strength calculation process. The initial association strength value is calculated by combining the frequency, hierarchical decay, and semantic similarity, for example, if an environmental protection clause is referenced by 3 clauses, the frequency-based value is 3, combined with a two-level reference decay coefficient of 0.8, the contribution value is 2.4, and through the BERT model, the semantic similarity with the tax clause is calculated as 0.75, finally generating an initial association strength value of 1.8. The Paillier algorithm is used to encrypt this value to generate E(1.8), preserving the homomorphic properties of addition and multiplication. In the encrypted state, the system traverses multi-hop transmission paths: for example, the three-level path of environmental protection clause -> tax clause -> finance clause, with a path length of 2 and a trigger exponential decay coefficient of 0.7 2 ​= 0.49, homomorphic multiplication is performed on the encrypted values E(1.8), E(0.75) on the path to generate the weighted path strength E(0.66). All encrypted path strengths pointing to the financial clause node are aggregated into a global relevance strength E(1.94) through homomorphic addition, where the encrypted path strengths pointing to the financial clause node are as follows: environmental conduct path E(0.74), economic clause direct path E(1.2), and then combined with the local density weight and cross-layer jump frequency to generate a 128-dimensional dynamic propagation vector E(6.9). After orthogonal splicing with the 768-dimensional encrypted semantic vector generated by Sentence-BERT, the vector is reduced to a 32-dimensional space through t-SNE, forming a distributed vector representation, so that the implicit association is explicit in the low-dimensional space.

[0136] Based on the topological distribution of vector space, the system starts the hidden sensitive path detection. Taking the coordinates (0.3, 0.5, 0.7) of the explicit sensitive item "personal identity information" as the center, the Euclidean distance of non-sensitive items is calculated. For example, the distance value 0.057 of the "regional population statistics" item coordinates (0.35, 0.52, 0.68) is lower than the dynamic threshold 0.1, and is included in the primary candidate set. The system traces back its conduct path: in the "regional planning -> population statistics -> community management -> identity information" three-level path, the encrypted weights E(0.8), E(0.6), E(0.5) are multiplied homomorphically (0.8x0.6x0.5x0.343=E0.082) and added to the rest of the path ciphertext value to E(0.318). After decryption, the superimposed value 0.318 exceeds the second threshold 0.3, and it is determined that there is an implicit association between the item and the sensitive data. This process combines semantic proximity and multi-hop conduct verification to accurately identify the implicit link between non-sensitive items and sensitive data.

[0137] Finally, the system dynamically adapts the output content according to the permissions. When a basic user with permission Level-2 initiates a request, the system loads rules such as a maximum association depth of 2 levels and a visibility threshold of 0.35. Taking the "regional planning" item as an example, its 3-level path weight to the sensitive item is 1.0x0.7 3 = 0.343, which is lower than the threshold, triggering semantic fuzzification: replacing "Zhang, ID 1101011980XXXX" in the path with "a user, ID number belongs to Beijing", and generalizing the monthly income of 25000 yuan to "about 2.5 million yuan", and embedding the audit identifier #6a3b1c-20250520T1430-MASK3. As regional planning -> population statistics, the weight 0.49 is a 2-level path accessible within the permission, and the original description is retained, with only a quarantine marker added at the cross-permission boundary. The fuzzified content is associated with the original path through SHA-256 hashing, ensuring audit traceability.

[0138] Figure 3A structure diagram of a government affair knowledge base collaborative management system based on a multi-level permission model is provided for an embodiment of the present application, as shown in Figure 3 The system comprises:

[0139] A building module 31 is configured to build a semantic association network between knowledge entries in a government affair knowledge base by analyzing logical dependency relationships and sensitive information propagation paths between entries.

[0140] A generating module 32 is configured to perform homomorphic encryption processing on a calculation process representing association strength between entries in the semantic association network, and map association structures between knowledge entries in the encrypted semantic association network to a multi-dimensional vector space to generate a distributed vector representation reflecting potential association characteristics between knowledge entries.

[0141] A detecting module 33 is configured to detect a set of non-sensitive entries having implicit associations with explicit sensitive entries based on topological distribution of the distributed vector representation in a semantic space.

[0142] A responding module 34 is configured to dynamically adjust a content masking range of the set of non-sensitive entries based on permission levels in response to a data output request of the government affair knowledge base, and the process of adjusting the content masking range of the set of non-sensitive entries comprises: performing semantic reservation type fuzzing operation on association content exceeding the permission, and preserving original semantic structure of association content within the permission.

[0143] Figure 3 The government affair knowledge base collaborative management system based on the multi-level permission model can perform Figure 1 The implementation principle and technical effects of the government affair knowledge base collaborative management method based on the multi-level permission model in the embodiment shown in the above are not described again. The specific operation manner of each module and unit of the government affair knowledge base collaborative management system based on the multi-level permission model in the above embodiment has been described in detail in the embodiment related to the method, which will not be described in detail here.

[0144] In one possible design, Figure 3 The government affair knowledge base collaborative management system based on the multi-level permission model in the embodiment shown in the above can be implemented as a computing device, as shown in Figure 4 The computing device can comprise a storage component 41 and a processing component 42.

[0145] The storage component 41 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 42.

[0146] The processing component 42 is configured to perform the above Figure 1 The government affair knowledge base collaborative management method based on the multi-level permission model in the embodiment.

[0147] The processing component 42 can include one or more processors to execute computer instructions to complete all or part of the steps in the above-described methods. Of course, the processing component can also be implemented as one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components, to execute the above-described methods.

[0148] The storage component 41 is configured to store various types of data to support the operation of the terminal. The storage component can be implemented by any type of volatile or nonvolatile storage devices or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0149] Of course, the computing device can also include other components, such as an input / output interface, a display component, a communication component, etc.

[0150] The input / output interface provides an interface between the processing component and peripheral interface modules, which can be output devices, input devices, etc.

[0151] The communication component is configured to facilitate wired or wireless communication between the computing device and other devices, etc.

[0152] The computing device can be a physical device or an elastic computing host provided by a cloud computing platform, and the computing device can be a cloud server, and the processing component, the storage component, etc. can be a basic server resource rented or purchased from a cloud computing platform.

[0153] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the foregoing method embodiments, which will not be described here.

[0154] The device embodiments described above are only schematic, and the units described as separate components can or can not be physically separated, and the components displayed as units can or can not be physical units, i.e. they can be located in one place, or distributed on multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the present embodiment. Those skilled in the art can understand and implement without creative labor.

[0155] Those skilled in the art can clearly understand the implementation of the various embodiments by means of software and necessary general hardware platforms through the description of the above embodiments, and of course, the embodiments can also be implemented by hardware. Based on such understanding, the above technical solutions, essentially or in other words, the part of the prior art that contributes to the technical solutions can be embodied in the form of a software product. The computer software product can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, and the like, and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0156] Finally, it should be noted that: the above examples are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing examples, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing examples, or make equivalent replacement for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for collaborative management of a government affair knowledge base based on a multi-level permission model, characterized in that, The application comprises: In the government knowledge base, a semantic association network between knowledge entries is established by analyzing the logical dependency between entries and the sensitive information propagation path; A homomorphic encryption process is performed on the calculation process of the association strength between entries in the semantic association network, and the association structure between knowledge entries in the encrypted semantic association network is mapped to a multi-dimensional vector space to generate a distributed vector representation reflecting the potential association characteristics between knowledge entries; Based on the topological distribution of the distributed vector representation in the semantic space, a set of non-sensitive entries with implicit association with explicit sensitive entries is detected; In response to a data output request of the government knowledge base, the content masking range of the set of non-sensitive entries is dynamically adjusted based on the permission level, and the process of adjusting the content masking range of the set of non-sensitive entries includes: performing semantic reservation type fuzzing operation on the associated content beyond the permission, and preserving the original semantic structure of the associated content within the permission.

2. The method of claim 1, wherein, In response to a data output request of the government knowledge base, the content masking range of the set of non-sensitive entries is dynamically adjusted based on the permission level, including: Parsing the permission level identifier of the data output request of the government knowledge base, extracting the sensitive entry filtering rule and semantic fuzzing strength parameter associated with the permission level; Based on the semantic fuzzing strength parameter, the maximum association depth threshold allowed by the current permission level is extracted from the semantic association network, and the association path with more than three indirect references to the explicit sensitive entry in the set of non-sensitive entries is located according to the sensitive entry filtering rule; According to the maximum association depth threshold and the sensitive entry filtering rule, the associated content of the set of non-sensitive entries is divided into an in-permission accessible subset and an out-of-permission masking subset; For the content of the entries in the out-of-permission masking subset, semantic reservation type fuzzing operation is adopted, and the original semantic features of the in-permission accessible subset are preserved, and only the association path across the permission boundary is fuzzed.

3. The method of claim 2, wherein, For the content of the entries in the out-of-permission masking subset, semantic reservation type fuzzing operation includes: Extracting the association path segment containing entity name, attribute value and relationship predicate from the out-of-permission masking subset; According to the preset entity generalization rule, the entity name is replaced by the corresponding category label, and the attribute value is converted into interval range or type identifier, to obtain the generalized entity name and attribute value; The main action of the relationship predicate is extracted, and the modifying words are deleted to generate a simplified predicate expression; The generalized entity name and attribute value and the simplified predicate expression are reorganized according to the original syntax structure to form an entry content with complete syntax but fuzzy semantics; Embedding a permission boundary identifier in the entry content, the permission boundary identifier includes an encrypted hash value of the original path and a fuzzing operation type label.

4. The method of claim 2, wherein, For the in-permission accessible subset, only the association path across the permission boundary is fuzzed, including: In the in-permission accessible subset, detect the association path across the permission boundary with the explicit sensitive entry; extracting entity names and relation predicates in the associated path, retaining the original entity name but replacing the entity name, attribute value with type identifier, retaining the main body of the relation predicate but deleting the modifier involving sensitive references in the path, to obtain the processed cross-authorization boundary path; splicing the processed cross-authorization boundary path with the original content retained within the authorization to ensure the semantic integrity of the non-cross-boundary path; adding an authorization isolation mark to the cross-authorization boundary path segment in the spliced content, the authorization isolation mark including the encryption check value and the blurring intensity level of the path.

5. The method of claim 1, wherein, performing homomorphic encryption processing on the calculation process of the association strength between the entries in the semantic association network, and mapping the association structure between the knowledge entries in the encrypted semantic association network to a multi-dimensional vector space to generate a distributed vector representation reflecting the potential association characteristics between the knowledge entries, including: Based on the logical dependency relationship and sensitive information propagation path between knowledge entries, an initial association strength value between each pair of entries is generated, which is calculated by the frequency of citation, dependency level and semantic overlap degree; using a homomorphic encryption algorithm to encrypt the initial association strength value, so that the encrypted association strength value retains the addition and multiplication operation characteristics; In the encrypted state, traverse all multi-hop association paths between entries in the semantic association network, and attenuate and weight the encrypted association strength value on each multi-hop association path according to the path length to generate an encrypted weighted path strength; For each knowledge entry, aggregate all encrypted weighted path strengths that end with the knowledge entry to obtain an encrypted global association strength value; Based on the encrypted global association strength value, extract the local density weight and cross-layer jump frequency of each entry in the encrypted association network, the local density weight is calculated by the total encrypted association strength of the entry within a preset depth, and the cross-layer jump frequency is generated by the number of association paths between non-continuous levels of the entry; fuse the local density weight and cross-layer jump frequency into an entry-level topology coefficient according to a preset proportion, and perform weighted superposition of the topology coefficients of adjacent entries in the encrypted state through an iterative diffusion algorithm to generate a dynamic propagation vector of the entry; orthonormal splicing the dynamic propagation vector and the encrypted content vector of the entry, the encrypted content vector is generated by homomorphic encryption feature extraction of entry attributes and text description; According to the relative distance of the spliced vector in the multi-dimensional space, adjust the weight of each dimension to generate a distributed vector representation reflecting the potential association characteristics between the knowledge entries.

6. The method of claim 1, wherein, Based on the topological distribution of the distributed vector representation in the semantic space, detect a set of non-sensitive entries that have implicit association with explicit sensitive entries, including: Based on the final coordinates of the distributed vector representation, taking the coordinates of the explicit sensitive entry as the center, calculating the Euclidean distance between the coordinates of all non-sensitive entries and the center, and screening the non-sensitive entries with a distance less than a first dynamic threshold as a primary candidate set; traverse all possible conductive paths of each non-sensitive entry in the primary candidate set in the encrypted association strength matrix, only keep the conductive paths containing more than three intermediate entries, and extract the ciphertext association weight values in the conductive paths; perform a multiplication operation on the ciphertext association weight values of each conductive path, and then perform a ciphertext accumulation operation on the operation results of all paths, if the decrypted superposition value exceeds a second dynamic threshold, it is determined that the non-sensitive entry and the explicit sensitive entry exist hidden association, and the non-sensitive entry is classified into a target non-sensitive entry set.

7. The method of claim 1, wherein, In the government knowledge base, a semantic association network between knowledge entries is established by analyzing the logical dependency relationship and the sensitive information propagation path between entries, including: A cross-department government clause reference tracking model is constructed, direct references and nested reference relationships are parsed based on normative reference annotations in clause texts, and a logical dependency edge set is generated; The task node topology structure of the administrative process document is parsed, the timing trigger conditions and data dependency relationships between process nodes are extracted based on natural language processing, and node pairs that meet the preset connection rules are modeled as administrative process connection edges; Based on the logical dependency edge set and the administrative process connection edge, an initial semantic association network is constructed; Based on the sensitive entry label database, a back propagation algorithm is used to trace back along the conductive paths of the initial semantic association network layer by layer, to identify the indirect diffusion path of the secret data through the non-sensitive entry, and to calculate the residual strength value of the sensitive information on each conductive path through an association strength decay function; The hierarchical relationship of the logical dependency edge set, the dynamic weight parameter of the administrative process connection edge, and the residual strength value are fused and modeled to generate a semantic association network with a weighted directed graph structure.

8. The method of claim 2, wherein, According to the maximum association depth threshold and the sensitive entry filtering rule, the association content of the non-sensitive entry set is divided into an in-privilege accessible subset and an unauthorized shielding subset, including: Recursively traverse the semantic association paths of the non-sensitive entry set, and set a path length counter on each conductive path; Based on the path length counter, when an indirect reference relationship with an explicit sensitive entry is detected, a path backtracking mechanism is started and the number of intermediate nodes is recorded to obtain a path backtracking result; The path backtracking result is input into an association strength decay function for weight correction to generate a corrected association strength value; If the corrected association strength value is higher than the visibility threshold corresponding to the current privilege level and the path length does not exceed the maximum association depth, the current entry is classified into the in-privilege accessible subset, otherwise it is classified into the unauthorized shielding subset.

9. A government affair knowledge base collaborative management system based on a multi-level permission model, characterized in that, including: The establishment module is configured to, in the government knowledge base, establish a semantic association network between knowledge entries by analyzing the logical dependency relationship and the sensitive information propagation path between entries; The generation module is configured to perform homomorphic encryption processing on the calculation process of the association strength between entries in the semantic association network, and map the association structure between knowledge entries in the encrypted semantic association network to a multi-dimensional vector space to generate a distributed vector representation reflecting the potential association characteristics between knowledge entries; a detection module configured to detect a set of non-sensitive entries having an implicit association with the explicit sensitive entry based on a topological distribution of the distributed vector representation in the semantic space; a response module configured to dynamically adjust a content masking range of the set of non-sensitive entries based on the permission level in response to a data output request of the government knowledge base, wherein the process of adjusting the content masking range of the set of non-sensitive entries comprises implementing a semantic reservation type blurring operation on the associated content beyond the permission, and preserving an original semantic structure of the associated content within the permission.

10. A computing device, comprising: The computer device comprises a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component, and implement the method for collaborative management of the government knowledge base based on the multi-level permission model according to any one of claims 1 to 7.

Images