A file security access control method and device

Abstract

The application discloses a kind of file security access control method and device, method includes: obtaining several user history access characteristic values;According to several user history access characteristic values, construct dynamic weight function;According to dynamic weight function, determine user authority;Using hybrid encryption strategy, original file is encrypted and handled, and ciphertext, encryption session key and integrity check value are obtained;If user authority is readable and writable, ciphertext, encryption session key and integrity check value are sent to client, and client is used to decrypt and handle ciphertext according to encryption session key and integrity check value, and original file is obtained;If user authority is only read, after original file is obtained by decryption processing, original file is subjected to multi-layer watermark embedding processing, and watermark embedding file is obtained.The application realizes file security access control, improves system security and user experience.The application can be widely applied in file security technical field.

Description

Technical Field

[0001] This invention relates to the field of document security technology, and in particular to a document security access control method and apparatus. Background Technology

[0002] With the development of information technology, data plays an increasingly crucial role in the daily operations of enterprises, institutions, and individuals. As a vital carrier of data, files face security challenges. Existing access control models are mostly based on static user permission settings, making it difficult to dynamically perceive user behavior and environmental changes. When a user's device is maliciously attacked or abnormal user behavior occurs, static user permission settings may allow unauthorized users to gain high-level access to files, resulting in low system security. Alternatively, legitimate users may be unable to access files normally due to temporary device malfunctions, leading to a poor user experience.

[0003] In summary, the technical problems existing in the relevant technologies need to be improved. Summary of the Invention

[0004] This invention provides a file security access control method and apparatus, which effectively improves system security and user experience.

[0005] On one hand, embodiments of the present invention provide a file security access control method, including the following steps:

[0006] Obtain several user historical access feature values;

[0007] Based on the aforementioned user historical access feature values, a dynamic weight function is constructed;

[0008] User permissions are determined based on the dynamic weighting function.

[0009] The original file is encrypted using a hybrid encryption strategy to obtain ciphertext, encryption session key, and integrity check value;

[0010] If the user's permissions are read and write, the ciphertext, the encryption session key, and the integrity check value are sent to the client. The client is used to decrypt the ciphertext according to the encryption session key and the integrity check value to obtain the original file.

[0011] If the user's permission is read-only, the ciphertext, the encryption session key, and the integrity check value are sent to the client. The client is used to decrypt the ciphertext according to the encryption session key and the integrity check value to obtain the original file, and to perform multi-layer watermark embedding on the original file to obtain a watermarked file.

[0012] In some embodiments, constructing a dynamic weight function based on the plurality of user historical access feature values ​​includes:

[0013] Calculate the feature value influence factor based on the aforementioned user historical access feature values ​​and user set;

[0014] Calculate the file structure complexity influence factor based on the file structure complexity, the preset maximum file structure complexity, and the file structure complexity influence coefficient;

[0015] The influence factor of user equipment hardware aging degree is calculated based on the user equipment hardware aging degree, the preset maximum value of user equipment hardware aging degree, and the influence coefficient of user equipment hardware aging degree.

[0016] Calculate the semantic complexity impact factor of the file;

[0017] The dynamic weight function is constructed based on the feature value influence factor, the file structure complexity influence factor, the user device hardware aging influence factor, the file semantic complexity influence factor, the difference between the current access time and the previous access time, and the total number of features.

[0018] In some embodiments, the calculation of the file semantic complexity impact factor includes:

[0019] The semantic complexity of a file is calculated based on lexical richness, sentence complexity, semantic relation network complexity, semantic topic diversity, semantic inference chain length, and semantic and contextual dependence.

[0020] The file semantic complexity influence factor is calculated based on the file semantic complexity, the preset maximum file semantic complexity, and the file semantic complexity influence coefficient.

[0021] In some embodiments, determining user permissions based on the dynamic weight function includes:

[0022] Calculate the user permission value based on the dynamic weight function and the several user historical access feature values;

[0023] The biometric stability index is calculated based on the number of biometric data collections, biometric values, and mean biometric values.

[0024] Calculate the network connection jitter rate based on the number of network connection jitter samples, the network connection jitter value, and the mean network connection jitter.

[0025] The user permissions are determined based on the user permission value, the biometric stability index, and the network connection jitter rate.

[0026] In some embodiments, determining the user permissions based on the user permission value, the biometric stability index, and the network connection jitter rate includes:

[0027] If the user permission value, the biometric stability index, and the network connection jitter rate all meet the preset requirements, then the user permission is determined to be readable and writable.

[0028] If one or both of the user permission value, the biometric stability index, and the network connection jitter rate meet the preset requirements, then the user permission is determined to be read-only.

[0029] If the user permission value, the biometric stability index, and the network connection jitter rate all fail to meet the preset requirements, then the user permission is determined to be inaccessible.

[0030] In some embodiments, the step of encrypting the original file using a hybrid encryption strategy to obtain ciphertext, an encryption session key, and an integrity check value includes:

[0031] A key pair is generated using an algebraic geometric code cryptosystem, the key pair including a public key and a private key, the private key being distributed to the user through a secure channel;

[0032] Generate a random initial session key;

[0033] According to the interleaved feedback mode, the original file is encrypted using the initial session key to obtain the ciphertext;

[0034] According to a multivariate public-key cryptosystem, the initial session key is encrypted using the public key to obtain the encrypted session key;

[0035] The integrity check value is calculated using the fractal hashing method based on the ciphertext and the encrypted session key.

[0036] In some embodiments, the step of decrypting the ciphertext based on the encryption session key and the integrity check value to obtain the original file includes:

[0037] The initial session key is obtained by decrypting the encrypted session key using the private key.

[0038] Based on the ciphertext and the encrypted session key, the verification value to be compared is calculated using the fractal hashing method.

[0039] If the verification value to be compared and the integrity verification value are equal, the ciphertext is decrypted using the initial session key to obtain the original file.

[0040] In some embodiments, performing multi-layer watermark embedding processing on the original file to obtain a watermark-embedded file includes:

[0041] The user identifier watermark, access time watermark, file version watermark, and biometric watermark are embedded into the original file to obtain the watermarked file.

[0042] On the other hand, embodiments of the present invention provide a file security access control device, including:

[0043] The first module is used to obtain several user historical access feature values;

[0044] The second module is used to construct a dynamic weighting function based on the aforementioned user historical access feature values;

[0045] The third module is used to determine user permissions based on the dynamic weight function;

[0046] The fourth module is used to encrypt the original file using a hybrid encryption strategy to obtain ciphertext, encryption session key, and integrity check value;

[0047] The fifth module is used to send the ciphertext, the encryption session key, and the integrity check value to the client if the user's permission is read and write. The client is used to decrypt the ciphertext according to the encryption session key and the integrity check value to obtain the original file.

[0048] The sixth module is used to send the ciphertext, the encryption session key, and the integrity verification value to the client if the user's permission is read-only. The client is used to decrypt the ciphertext according to the encryption session key and the integrity verification value to obtain the original file, and to perform multi-layer watermark embedding processing on the original file to obtain a watermarked file.

[0049] On the other hand, embodiments of the present invention provide a computer device, including:

[0050] At least one processor;

[0051] At least one memory for storing at least one program;

[0052] When the at least one program is executed by the at least one processor, the at least one processor implements the method.

[0053] On the other hand, embodiments of the present invention provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described thereon.

[0054] The beneficial effects of this invention are as follows:

[0055] This invention first obtains several historical access feature values ​​of users, then constructs a dynamic weight function based on these features, determines user permissions using the dynamic weight function, and then encrypts the original file using a hybrid encryption strategy to obtain ciphertext, an encryption session key, and an integrity check value. If the user's permissions are read-write, the ciphertext, encryption session key, and integrity check value are sent to the client, allowing the client to decrypt the ciphertext using the encryption session key and integrity check value to obtain the original file. If the user's permissions are read-only, after decrypting the original file, multi-layer watermark embedding is performed on the original file to obtain a watermarked file. This allows for secure file access control based on different user permissions, thereby improving system security and user experience.

[0056] Other features and advantages of the invention will be set forth in the following description, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the description and the drawings. Attached Figure Description

[0057] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0058] Figure 1 This is a flowchart of a file security access control method according to an embodiment of the present invention;

[0059] Figure 2 This is a schematic diagram of the structure of a file security access control device according to an embodiment of the present invention;

[0060] Figure 3 This is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. Detailed Implementation

[0061] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit it. In the following description, when referring to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with those of this application; they are merely examples of apparatuses and methods consistent with some aspects of the embodiments of this application as detailed in the appended claims.

[0062] It is understood that the terms “first,” “second,” etc., used in this application may be used herein to describe various concepts, but unless otherwise stated, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of the embodiments of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the words “if,” “when,” or “in response to a determination” as used herein may be interpreted as “when…” or “when…” or “in response to a determination.”

[0063] As used in this application, the terms "at least one", "multiple", "each", "any", etc., "at least one" includes one, two or more, "multiple" includes two or more, "each" refers to each of the corresponding multiples, and "any" refers to any one of the multiples.

[0064] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0065] Before providing a detailed description of the embodiments of this application, some of the nouns and terms involved in the embodiments of this application will be explained first. The nouns and terms involved in the embodiments of this application are subject to the following interpretations.

[0066] Public-key cryptography (also known as asymmetric cryptography) is an encryption technique based on mathematical functions. Its core lies in using a pair of related keys: a public key and a private key. The public key is used to encrypt data or verify signatures and can be shared publicly. The private key is used to decrypt data or generate signatures and must be kept strictly confidential. The sender uses the recipient's public key to encrypt the data, and only the recipient can decrypt it using their private key. The recipient uses their own private key to decrypt the data, ensuring that the information is only accessible to authorized individuals.

[0067] In related technologies, with the rapid development of information technology, data plays an increasingly crucial role in the daily operations of enterprises, institutions, and individuals. As a vital carrier of data, files face unprecedented security challenges. In the current information environment, file security protection primarily focuses on encryption and access control technologies. Existing access control models are mostly based on static user permission settings, lacking dynamic awareness of user behavior and environmental changes. For example, while role-based access control models simplify permission management to some extent, once roles are set, user permissions are relatively fixed and cannot be flexibly adjusted based on real-time user behavior (such as unusually frequent access or abnormal access times) and device status (such as aging devices or existing security vulnerabilities). When a user's device is maliciously attacked or abnormal user behavior occurs, static permission settings may lead to unauthorized users gaining high-privilege access to files, or legitimate users being unable to access files normally due to temporary device malfunctions, reducing system security and user experience.

[0068] In view of this, the embodiments of the present invention first obtain several user historical access feature values, then construct a dynamic weight function to determine user permissions, and then use a hybrid encryption strategy to encrypt the original file to obtain ciphertext, encryption session key, and integrity verification value. If the user permission is read-write, the ciphertext, encryption session key, and integrity verification value are sent to the client so that the client can decrypt the ciphertext to obtain the original file. If the user permission is read-only, after decryption to obtain the original file, multi-layer watermark embedding processing is performed on the original file to obtain a watermarked file. This enables secure file access control based on different user permissions, thereby improving system security and user experience.

[0069] This application provides a file security access control method, relating to the field of file security technology. This file security access control method can be applied to a terminal, a server, or software running on a terminal or server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, or in-vehicle terminal, but is not limited thereto; the server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network; the software can be an application implementing a file security access control method, but is not limited to the above forms.

[0070] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0071] The embodiments of this application will be explained in detail below with reference to the accompanying drawings:

[0072] Figure 1 This is an optional flowchart of a file security access control method provided in an embodiment of this application. Figure 1 The method may include, but is not limited to, steps S101 to S106.

[0073] Step S101: Obtain several user historical access feature values;

[0074] Step S102: Construct a dynamic weight function based on several user historical access feature values;

[0075] Step S103: Determine user permissions based on the dynamic weight function;

[0076] Step S104: Use a hybrid encryption strategy to encrypt the original file to obtain ciphertext, encryption session key, and integrity check value;

[0077] Step S105: If the user's permissions are read and write, the ciphertext, encryption session key, and integrity check value are sent to the client. The client uses the encryption session key and integrity check value to decrypt the ciphertext and obtain the original file.

[0078] Step S106: If the user's permission is read-only, the ciphertext, encryption session key, and integrity check value are sent to the client. The client is used to decrypt the ciphertext according to the encryption session key and integrity check value to obtain the original file, and then perform multi-layer watermark embedding on the original file to obtain a watermarked file.

[0079] Steps S101 to S106 as shown in the embodiments of this application realize secure file access control, thereby improving system security and user experience.

[0080] In step S101 of some embodiments, several user historical access feature values ​​can be obtained through user historical access logs. These user historical access feature values ​​can also be obtained through other methods, not limited to these. For example, various user feature information can be collected in an orderly manner, with each user feature corresponding to a user historical access feature value xU,i. User features cover a wide range and can include behavioral features, identity features, and device features. Among behavioral features, the user's historical access frequency, i.e., the number of times a user accesses files or system resources within a certain period, reflects the user's activity level in using resources; the access time interval, such as the time difference between two consecutive accesses, can be used to analyze the user's usage habits and patterns. Among identity features, the user's identity identifier, such as user account type (ordinary user, administrator, etc.), with different account types typically corresponding to different permission levels; the department or organization to which the user belongs, which in an enterprise or institutional environment can be used to restrict cross-departmental resource access. Among device features, the type of device the user uses (e.g., PC, mobile device, etc.), with different device types potentially presenting different security risks and usage requirements; and the device's operating system version, with older operating system versions potentially having security vulnerabilities that affect access security.

[0081] In some embodiments, step S102, constructing a dynamic weight function based on several user historical access feature values, may include, but is not limited to, the following steps:

[0082] Calculate the influence factor of the feature values ​​based on several historical access feature values ​​of users and user sets;

[0083] Calculate the file structure complexity influence factor based on the file structure complexity, the preset maximum file structure complexity, and the file structure complexity influence coefficient;

[0084] The influence factor of user equipment hardware aging degree is calculated based on the user equipment hardware aging degree, the preset maximum value of user equipment hardware aging degree, and the influence coefficient of user equipment hardware aging degree.

[0085] Calculate the semantic complexity impact factor of the file;

[0086] A dynamic weighting function is constructed based on the influence factors of feature values, file structure complexity, user device hardware aging, file semantic complexity, the difference between the current access time and the previous access time, and the total number of features.

[0087] In some embodiments, the feature value influence factor can be calculated first based on several user historical access feature values ​​and user sets, wherein the formula for calculating the feature value influence factor is: In the formula, γ ij (xU,j) is the eigenvalue influence factor, xU,j is the user's historical access eigenvalue, maxU′ is the maximum value of the j-th eigenvalue among all users in the user set, and U is the user set. It can be understood that j in the user's historical access eigenvalue is used to identify a specific historical access characteristic dimension (such as access frequency, access duration, etc.). Simultaneously, the system finds the maximum value of the j-th eigenvalue among all users in the user set U, i.e., maxU′∈xU,j. This step is to establish a benchmark to measure the performance of the current user U relative to other users on this characteristic dimension. The eigenvalue influence factor adjusts its weight based on the weight of each eigenvalue xU,j. Different user eigenvalues ​​will affect γ. ij The different values ​​of (xU,j) affect the dynamic weighting function. For example, if xU,j represents the user's historical access frequency, a higher access frequency may result in a higher γ value. ij The larger the value of (xU,j), the stronger the user's influence on permission assessment based on this feature. In this way, the system can adjust the weight of permission assessment accordingly based on the user's specific behavior and attribute characteristics.

[0088] In the calculation of the eigenvalue influence factor, when xU,j>0, it is done through... Calculate the eigenvalue influence factor. Among them, This part calculates the relative proportion of user U's feature values ​​within the user set, reflecting how prominent the user is compared to other users in that feature dimension. This means that the better a user performs relatively on a certain feature (…), the better they are in that feature. The larger the value, the greater the influence factor of the feature value, and the stronger the influence of this feature on the calculation of user permission values ​​in subsequent scenarios involving permission assessment. When xU,j≤0, γ ij (xU,j) = 1 indicates that the user does not have a significant positive performance in this feature dimension. Their contribution to the feature value influence factor is a base value of 1, and they participate in calculations such as permission assessment with the usual weight. Furthermore, the calculated feature value influence factor will participate in the dynamic weight function ω. i In the calculation, it works together with factors such as file structure complexity, user device hardware aging, and file semantic complexity to comprehensively determine the weight of each user feature in the current situation for user permission evaluation, thereby affecting the calculation of user permission values ​​and ultimately determining the user's access permissions to files and other resources, thus achieving refined management of user permissions.

[0089] Then, based on the file structure complexity, the preset maximum file structure complexity, and the file structure complexity influence coefficient, the file structure complexity influence factor is calculated. The formula for calculating the file structure complexity influence factor is as follows: In the formula, δ i (S file S is the file structure complexity influencing factor. file For the file structure complexity, S max φ is the maximum preset file structure complexity. i This represents the impact coefficient of file structure complexity. It's understandable that file structure complexity can be measured by metrics such as the nesting levels of data elements within the file and the number of relationships. The more complex the file structure (S... file The larger the value, the greater the δ i (S file The value of ) will change accordingly, thus reflecting the impact of file structure on user permission assessment in the dynamic weight function. For example, files with complex structures may require users with higher privileges to access and process them, so corresponding adjustments will be made in the weight calculation. In quantifying file structure complexity, it is necessary to first determine the file structure complexity S. file This is typically achieved by analyzing the nesting levels of data elements within the file, the number of relationships between them, and the diversity of data types. For example, for an XML file, the more nested the tags and the more complex the relationships between them, the higher the file structure complexity S. file The higher the value, the better; for a database file, the relationships between tables and the nesting of fields will affect S. file The value of .

[0090] In the process of calculating the file structure complexity influence factor, the file structure complexity S is obtained. file Then, combined with the preset maximum file structure complexity S max and the coefficient φ associated with feature i i The calculation is performed according to the formula for the file structure complexity impact factor. Among them, This part calculates the ratio of the current file structure complexity to a set maximum value, reflecting the relative extent of the file structure complexity within the entire possible range. Multiplied by φ i Then, based on different features i and actual needs, adjust the contribution of file structure complexity to the influencing factor. For example, if feature i is closely related to the security of file operations, and the current application scenario is more concerned about the security risks caused by file structure complexity, a larger φ can be set. i The value is such that when the file structure complexity is high, the improvement effect on the impact factor is more significant. Finally, adding 1, we get the file structure complexity impact factor δ. i (Sfile This ensures that even if the file structure complexity is 0, the influence factor has a base value of 1, allowing it to stably participate in subsequent calculations. Furthermore, the calculated file structure complexity influence factor δ... i (S file It will participate in the dynamic weight function ω i In the calculation, it works together with other influencing factors (such as eigenvalue influencing factor, user device hardware aging influencing factor, file semantic complexity influencing factor, etc.) to comprehensively determine the weight of each factor in user permission evaluation, thereby affecting the calculation of user permission value and ultimately determining the user's access permissions to files and other resources, thus realizing refined permission management based on file structure complexity.

[0091] Then, based on the user equipment hardware aging level, the preset maximum user equipment hardware aging level, and the user equipment hardware aging level influence coefficient, the user equipment hardware aging level influence factor is calculated. The formula for calculating the user equipment hardware aging level influence factor is as follows: In the formula, ε i (H device H represents the factor influencing the aging level of user equipment hardware. device H represents the degree of aging of user equipment hardware. max To preset the maximum value of user equipment hardware aging, θ i This refers to the impact coefficient of user equipment hardware aging. It's understandable that the degree of user equipment hardware aging can be quantified based on indicators such as equipment usage time and the number of hardware failures. The higher the degree of equipment aging (H... device A higher ε value may indicate more safety hazards or performance degradation in the equipment. i (H device The system will adjust weights based on this situation, taking into account the impact of device status on user operation security during permission assessment. For example, severely aged devices may restrict user access to certain files with high security requirements. In determining the degree of device aging, the hardware aging level H of the user device must be determined. device This is typically achieved by acquiring relevant data in various ways. For example, based on the usage time of the device, the longer the usage time, the higher the degree of aging may be; by counting the number of hardware failures, frequent failures indicate that device aging may lead to performance instability; and by detecting changes in the performance indicators of hardware components, such as decreased hard drive read / write speeds and increased memory error rates. All of this information is then used to quantify the degree of hardware aging of the user's device, H. device .

[0092] In the calculation of the influencing factor of user equipment hardware aging degree, the user equipment hardware aging degree H is known. device 1. Preset maximum value H for user equipment hardware aging level maxAnd the influence coefficient θ of the aging degree of user equipment hardware i The calculation is performed according to the formula for calculating the impact factor of user equipment hardware aging. Among them, This calculates the ratio of the current hardware aging level of the device relative to a set maximum value, reflecting the relative extent of the device's aging within the entire possible range. Multiplied by θ i Then, based on different application scenarios and the level of importance attached to equipment aging, the strength of the influence factor on the degree of equipment hardware aging is adjusted. If θ i A larger θ indicates a more significant reduction in the impact factor due to increased equipment aging, meaning that equipment aging has a greater negative impact on user permissions; conversely, a smaller θ indicates a greater reduction in the impact factor. i The smaller the value, the weaker the impact of equipment aging. Subtracting the above product from 1 yields the influence factor ε of the user equipment hardware aging level. i (H device When the device aging level is 0, the impact factor is 1, indicating that the device is in good condition and has no negative impact on permission assessment. As the device aging level increases, the impact factor gradually decreases, reflecting the restrictive effect of device aging on user permissions. Furthermore, the calculated impact factor ε of the user device hardware aging level... i (H device It will participate in the dynamic weight function ω i In the calculation, it works in conjunction with eigenvalue influence factors, file structure complexity influence factors, and file semantic complexity influence factors to comprehensively determine the weight of each factor in user permission evaluation, thereby affecting the calculation of user permission values ​​and ultimately determining the user's access permissions to files and other resources, achieving refined permission management that takes into account the aging of device hardware.

[0093] Finally, the file semantic complexity influencing factor was calculated. The analysis of file semantic complexity started with lexical richness, statistically analyzing the diversity and uniqueness of words in the file; it also delved into the complexity of the semantic relationship network, analyzing the logical connections and mutual influences between semantic terms. This multi-dimensional information collection and analysis provided a rich and accurate data foundation for subsequent permission assessment. Furthermore, based on the eigenvalue influencing factor, file structure complexity influencing factor, user device hardware aging influencing factor, file semantic complexity influencing factor, the difference between the current access time and the previous access time, and the total number of features, a dynamic weight function was constructed. The expression for the dynamic weight function is: In the formula, ω i For the dynamic weight function value, α i β i All are constant parameters, where Δt is the difference between the current access time and the previous access time, n is the total number of features, and γ is a constant parameter. ij (xU,j) is the eigenvalue influence factor, δ i (S fileε is the file structure complexity influencing factor. i (H device This is a factor affecting the aging level of user equipment hardware. This is a factor influencing the semantic complexity of the file. It is understandable that... This part, over time (Δt increases), The value of will gradually decrease (because the exponent is negative), which means that the longer the time, the weaker the influence of this factor on the dynamic weighting function will be. It reflects a time decay mechanism; for example, certain user operation characteristics in the past may become less important for the current permission evaluation over time.

[0094] Furthermore, the dynamic weighting function integrates multiple factors in its calculation through a numerator and denominator. The numerator reflects the contribution of the current user's situation under each factor to the weight, while the denominator represents a normalization process for all possible scenarios, ensuring that the weight calculation for each factor is performed within a unified system. The calculated dynamic weighting function value ω... i When calculating user permission values ​​later, the user's feature values ​​xU,i, etc. will be combined to jointly determine the user's final permissions, thereby achieving refined and dynamic management of user permissions.

[0095] In some embodiments, calculating the semantic complexity impact factor of a file includes:

[0096] The semantic complexity of a file is calculated based on lexical richness, sentence complexity, semantic relation network complexity, semantic topic diversity, semantic inference chain length, and semantic and contextual dependence.

[0097] The file semantic complexity influence factor is calculated based on the file semantic complexity, the preset maximum file semantic complexity, and the file semantic complexity influence coefficient.

[0098] In some embodiments, the semantic complexity of a file can be calculated first based on lexical richness, sentence complexity, semantic relation network complexity, semantic topic diversity, semantic inference chain length, and semantic and contextual dependencies. The formula for calculating the semantic complexity of a file is: C semantic =ρ1·V rich +ρ2·S comp +ρ3·R net +ρ4·T div +ρ5·L inf +ρ6·D ctx In the formula, C semantic For, V rich For vocabulary richness, e comp For statement complexity, R net Let T be the semantic relation network complexity. divFor semantic subject diversity, L inf D is the length of the semantic reasoning chain. ctx To represent the degree of semantic and contextual dependence, ρ1, ρ2, ρ3, ρ4, ρ5, and ρ6 are all weighting factors, which determine the relative importance of each semantic dimension in calculating the semantic complexity of a file.

[0099] Understandably, vocabulary richness (V) can be measured by the number of unique words in statistical documents, the proportion of specialized terms, and vocabulary diversity indicators. rich For example, a scientific document containing a large number of specialized terms and a wide variety of vocabulary has a relatively high lexical richness; while simple everyday text has a lower lexical richness. Sentence complexity S can be quantified based on sentence length and the complexity of its grammatical structure. comp For example, the more complex and nested clauses a long sentence contains, the higher its sentence complexity; conversely, texts with simple subject-verb-object structures have lower sentence complexity. The semantic relation network complexity R can be obtained by analyzing the logical connections and referential relationships between semantic elements in a file. net For example, the more complex the mutual references, causal relationships, and hierarchical relationships between concepts in a document, the higher the semantic relationship network complexity; texts with simple and direct semantic relationships have a lower value for this dimension. The semantic topic diversity T can be obtained by examining the diversity of semantic topics involved in the document. div If a document covers content from multiple different domains or topics, and the transformations and relationships between these topics are complex, then the semantic topic diversity is high; documents that revolve around only a single topic have a lower semantic topic diversity value. Using technologies such as knowledge graphs, we can analyze the length of the longest reasoning path formed when the semantic information extracted from the document is used for reasoning within the knowledge graph, thus obtaining the semantic reasoning chain length L. inf For documents requiring deep semantic reasoning and knowledge association, such as the logical argumentation sections of academic research papers, the semantic reasoning chain is relatively long; while for simple declarative texts, the reasoning chain is shorter. The degree of semantic and contextual dependence can be assessed by analyzing the degree to which the semantics of words or sentences change in different contexts. ctx For example, some words have drastically different meanings in different contexts. The more content in a file where such semantics are highly dependent on the context, the higher the value of this dimension; files with relatively independent semantics that do not depend on the context have a lower value of this dimension.

[0100] Then, based on the file semantic complexity, the preset maximum file semantic complexity, and the file semantic complexity influence coefficient, the file semantic complexity influence factor is calculated. The formula for calculating the file semantic complexity influence factor is as follows: In the formula, C is the factor affecting the semantic complexity of a document.max v is the maximum value of the preset file semantic complexity. i This represents the coefficient affecting the semantic complexity of a file. It's understandable that file semantic complexity can be determined from multiple aspects, including lexical richness, sentence complexity, and semantic relation network complexity. The more complex the file semantics (C...), the higher the coefficient. semanic The larger the value, This will change accordingly, reflecting the file's semantic security requirements and the user's ability to understand and manipulate the file in the dynamic weight function. For example, highly specialized and semantically complex files may only be accessible and manipulated by users with the corresponding knowledge and permissions; this access control is achieved through weight adjustments. In quantifying semantic complexity, the file's semantic complexity C needs to be determined. semantic This requires a comprehensive assessment of multiple factors. From a lexical perspective, it involves analyzing lexical richness, including the number of unique words and the proportion of specialized terms in the document; studying sentence complexity, considering sentence length and the complexity of grammatical structures; and dissecting the complexity of the semantic relationship network, clarifying the logical connections and referential relationships between semantic elements. Through a comprehensive analysis of these aspects, the semantic complexity C of the document can be quantified. semantic The specific value.

[0101] In the calculation of the file semantic complexity influencing factor, the file semantic complexity C is known. semantic 1. Preset maximum semantic complexity C for files max and the file semantic complexity impact coefficient v i Then, the calculation is performed according to the formula for calculating the semantic complexity impact factor of a document. Among them, This represents the ratio of the current file's semantic complexity to the set maximum value, reflecting the relative degree of the file's semantic complexity across all possible scenarios. Multiplied by v i Then, based on different application scenarios and the degree of attention paid to semantic complexity, the strength of the influence factor of file semantic complexity is adjusted. If v i For files with higher semantic complexity, the impact of semantic complexity on the influence factor is more pronounced; that is, files with higher semantic complexity will be subject to stricter access restrictions during permission assessment. i The smaller the value, the weaker the impact on semantic complexity. Adding 1 gives the file semantic complexity impact factor. When the semantic complexity of a file is 0, the influence factor is 1, indicating simple semantics and no additional impact on permission assessment. As semantic complexity increases, the influence factor increases, reflecting a stronger restriction on user permissions. More specifically, the calculated file semantic complexity influence factor... It will participate in the dynamic weight function ω iIn the calculation, it works synergistically with eigenvalue influence factors, file structure complexity influence factors, and user device hardware aging influence factors to comprehensively determine the weight of each factor in user permission assessment, thereby affecting the calculation of user permission values ​​and ultimately determining the user's access permissions to files and other resources, achieving refined permission management based on file semantic complexity.

[0102] In some embodiments, step S103, determining user permissions based on a dynamic weight function, may include, but is not limited to, the following steps:

[0103] Calculate user permission values ​​based on a dynamic weighting function and several historical user access characteristics.

[0104] The biometric stability index is calculated based on the number of biometric data collections, biometric values, and mean biometric values.

[0105] Calculate the network connection jitter rate based on the number of network connection jitter samples, the network connection jitter value, and the mean network connection jitter.

[0106] User permissions are determined based on user permission values, biometric stability indicators, and network connection jitter rate.

[0107] In some embodiments, the user permission value can be calculated first based on a dynamic weighting function and several historical user access feature values, wherein the formula for calculating the user permission value is: In the formula, P(U) is the user permission value, n is the total number of features, and ω i The dynamic weighting function is calculated by comprehensively considering factors such as time, user feature values, file structure complexity, user device hardware aging, and file semantic complexity. It reflects the importance of each user feature in the current situation. xU,i represents the i-th historical access feature value of user U. Multiplying each feature value by its corresponding weight and summing the results yields the user permission value. This user permission value quantifies the user's overall permission level in the current system environment. This step is like scoring the user's permissions; a higher score reflects the user's permissions on the file in the current situation.

[0108] Then, based on the number of biometric data collections, biometric values, and mean biometric values, a biometric stability index is calculated. The formula for calculating the biometric stability index is as follows: In the formula, B(U) is the biometric stability index, N is the number of biometric data collections, and b k The biometric value collected in the kth iteration is... Let U' be an element in set U, representing the biological characteristic mean. k U′ For the k-th biometric value related to user U′, b -U′Let U' be the mean of user's biometrics. The biometric stability index is obtained by calculating the difference between each collected biometric value and the mean, comparing it with the maximum difference among other users in the user set, and then averaging the differences. This index measures the consistency of a user's biometrics across multiple collections; a higher index value indicates more stable biometrics and a higher level of credibility in the user's identity.

[0109] Then, based on the number of network connection jitter samples, the network connection jitter value, and the mean network connection jitter, the network connection jitter rate is calculated. The formula for calculating the network connection jitter rate is: In the formula, J(U) is the network connection jitter rate, M is the number of network connection jitter samples, and j l This represents the network connection jitter value. The mean network connection jitter is calculated. The network connection jitter rate is obtained by averaging the absolute values ​​of the deviations of each network connection jitter value from the mean. This metric reflects the stability of the network connection; a lower jitter rate indicates a more stable network connection, which is more conducive to secure and stable file access operations. Finally, user permissions are determined based on user permission values, biometric stability indicators, and the network connection jitter rate.

[0110] In some embodiments, determining user permissions based on user permission values, biometric stability indicators, and network connection jitter rate includes:

[0111] If the user permission value, biometric stability index, and network connection jitter rate all meet the preset requirements, then the user permission is determined to be readable and writable.

[0112] If one or two of the user permission value, biometric stability index, and network connection jitter rate meet the preset requirements, the user permission is determined to be read-only.

[0113] If the user's permission value, biometric stability index, and network connection jitter rate all fail to meet the preset requirements, then the user's permission is determined to be inaccessible.

[0114] In some embodiments, user biometric stability indicators (such as the similarity change of each feature point match during fingerprint recognition) and network connection jitter (real-time fluctuations in network signals) can be combined with a pre-defined permission threshold vector for detailed comparison and reasoning. The permission thresholds correspond to access permission standards for files at different security levels. By comparing and determining whether the user's permission value meets the requirements of the corresponding file security level, the specific permissions the user has for the file—whether they have read / write permissions or only read-only permissions—are determined, enabling precise judgment and management of user permissions. The user permission value, biometric stability indicators, and network connection jitter can be judged separately. If all three meet the preset requirements, for example, the user permission value P(U) is greater than or equal to the user permission threshold P(U), then the user permission value is considered valid. ′ The biometric stability index B(U) is greater than or equal to the biometric stability threshold B. min The network connection jitter rate J(U) is less than or equal to the network connection jitter threshold J. max If user U has read and write permissions to the file, then user U's permissions are determined to be read-write. If one or two of the user permission value, biometric stability index, and network connection jitter rate meet the preset requirements, then user U has read-only permissions to the file, and user U's permissions are determined to be read-only. If none of the user permission value, biometric stability index, and network connection jitter rate meet the preset requirements, then user U does not have access to the file, and user U's permissions are determined to be inaccessible, thus prohibiting access to the file and ensuring file security.

[0115] In some embodiments, step S104 involves encrypting the original file using a hybrid encryption strategy to obtain ciphertext, an encryption session key, and an integrity verification value. This process may include, but is not limited to, the following steps:

[0116] A key pair is generated using an algebraic geometric code cryptosystem. The key pair includes a public key and a private key, and the private key is distributed to the user through a secure channel.

[0117] Generate a random initial session key;

[0118] Based on the interleaved feedback mode, the original file is encrypted using the initial session key to obtain the ciphertext;

[0119] Based on a multivariate public-key cryptosystem, the initial session key is encrypted using the public key to obtain the encrypted session key.

[0120] The integrity check value is calculated using the fractal hashing method based on the ciphertext and the encrypted session key.

[0121] In some embodiments, a novel algebraic geometric cryptosystem can be used to generate a key pair, including a public key and a private key. The private key can be distributed to the user through a secure channel. Understandably, the unique mathematical properties of algebraic curves of a specific genus are used to generate a pair of related keys, one for encryption (public key) and one for decryption (private key). This key pair acts like a "key mold" for file encryption, laying a secure foundation for subsequent encryption operations. Then, a random initial session key is generated. This session key acts like a temporary "encryption lock," and its randomness ensures the uniqueness and security of each encryption. Next, according to the interleaved feedback mode, the original file is encrypted using the initial session key to obtain ciphertext. For example, the Interleaved Feedback (CFB) mode of the Advanced Encryption Standard (AES) can be used to encrypt the original file. By feeding back the result of the previous encryption block into the current encryption process, the security of the encryption and the confidentiality of the data are further enhanced. The original file is transformed into ciphertext, achieving initial encryption protection of the file content, much like putting an invisible "encryption protective coat" on the file.

[0122] Since the session key is a crucial intermediate step in file encryption and decryption, its leakage can compromise the ciphertext. To further ensure session key security, a multivariate public-key cryptosystem can be used to encrypt the initial session key using the public key, resulting in an encrypted session key. For example, the initial session key can be concatenated with a randomly padded string to increase complexity and confidentiality, and then encrypted using a multivariate public-key cryptosystem. The multivariate public-key cryptosystem is designed based on hyperelliptic curve multivariate equations, using complex nonlinear operations between multiple variables to make the encrypted session key extremely difficult to crack. Finally, based on the ciphertext and the encrypted session key, a fractal hashing method is used to calculate an integrity check value. For example, a fractal hashing method can be used to divide the ciphertext and the encrypted session key according to fractal rules and generate a unique integrity check value. This integrity check value acts like a "digital fingerprint" of the file's encryption state, used to verify whether the file has been tampered with during storage and transmission. More often, ciphertext, encrypted session keys, and integrity verification values ​​can be stored or transmitted together. This layered encryption and rigorous verification method ensures a high level of security for the file throughout the entire transfer process.

[0123] In some embodiments, step S105, decrypting the ciphertext based on the encryption session key and the integrity check value to obtain the original file, may include, but is not limited to, the following steps:

[0124] Use the private key to decrypt the encrypted session key to obtain the initial session key;

[0125] Based on the ciphertext and the encrypted session key, the fractal hash method is used to calculate the verification value to be compared;

[0126] If the checksum to be compared and the integrity checksum are equal, the ciphertext is decrypted using the initial session key to obtain the original file.

[0127] In some embodiments, when a user requests access to a file, the access control matrix can be used to verify the user's permissions first. The access control matrix acts like a permission "database," recording each user's access permissions for different file resources. If the user's permissions are verified, the system obtains the encrypted session key, integrity check value, and ciphertext. Then, the encrypted session key is decrypted using the private key to obtain the initial session key. For example, the encrypted session key can be decrypted using the user's multivariate private key, which corresponds to the multivariate public key used in the previous encryption. Through specific mathematical inverse operations, the initial session key is extracted. This step is like using the correct "key" to unlock the "lock" of the encrypted session key, preparing for subsequent file decryption. Then, based on the ciphertext and the encrypted session key, a fractal hash algorithm is used to calculate the check value to be compared. If the check value to be compared is equal to the integrity check value, the ciphertext is decrypted using the initial session key to obtain the original file. For example, a fractal hash algorithm can be used to calculate the check value to be compared by performing fractal hash calculation on the encrypted ciphertext and the encrypted session key. The fractal hash algorithm then calculates the check value to be compared again according to fractal rules. The recalculated checksum to be compared is precisely compared with the pre-stored integrity checksum, much like comparing two "digital fingerprints." If they match perfectly, it means the file has not been tampered with during storage and transmission. The ciphertext can be decrypted using the initial session key, and the original file can be restored to user access through the inverse operation of the AES algorithm.

[0128] In some embodiments, step S106 involves performing multi-layer watermark embedding processing on the original file to obtain a watermark-embedded file, which may include, but is not limited to, the following steps:

[0129] The user identifier watermark, access time watermark, file version watermark, and biometric watermark are embedded into the original file to obtain a watermarked file.

[0130] In some embodiments, when the user's permissions are read-only, the system can perform multi-layer watermark embedding after decrypting the original file. User identification watermarks, access time watermarks, file version watermarks, and biometric watermarks can be embedded into the original file to obtain a watermarked file. It is understood that embedding the user identification watermark in a covert and difficult-to-detect manner will not affect the normal use and content display of the file, but it can accurately extract user identification information when traceability is needed. Leveraging the high security and accuracy of quantum key distribution, the access time watermark is accurately recorded in the file. Quantum key distribution utilizes the properties of quantum states for key transmission, ensuring the security and accuracy of watermark embedding, much like adding an unalterable "timestamp" to the file's access time. The unique properties of fractal geometry allow the watermark to be evenly and stably distributed within the file, clearly identifying file version information and preventing file version confusion or tampering.

[0131] In some embodiments, this embodiment generates a dynamic weight function by comprehensively considering factors such as file structure complexity, user device aging, and file semantic complexity, and then calculates the user permission value. By combining multi-dimensional information such as biometric stability indicators and network connection jitter rate to determine access permissions, it achieves refined evaluation and management of user permissions, enabling more accurate matching of user and file resource access relationships, effectively preventing unauthorized access, and improving system security and the rationality of resource management.

[0132] The beneficial effects of implementing the embodiments of the present invention include: First, the embodiments of the present invention obtain several user historical access feature values. Then, based on these user historical access feature values, a dynamic weight function is constructed. Based on the dynamic weight function, user permissions are determined. Then, a hybrid encryption strategy is used to encrypt the original file to obtain ciphertext, an encryption session key, and an integrity verification value. If the user permission is read-write, the ciphertext, encryption session key, and integrity verification value are sent to the client, allowing the client to decrypt the ciphertext based on the encryption session key and integrity verification value to obtain the original file. If the user permission is read-only, after decrypting the original file, multi-layer watermark embedding is performed on the original file to obtain a watermarked file. This enables secure file access control based on different user permissions, thereby improving system security and user experience.

[0133] like Figure 2 As shown, this embodiment of the invention also provides a file security access control device, including:

[0134] The first module 801 is used to obtain several user historical access feature values;

[0135] The second module 802 is used to construct a dynamic weight function based on several user historical access feature values;

[0136] The third module 803 is used to determine user permissions based on a dynamic weighting function;

[0137] The fourth module 804 is used to encrypt the original file using a hybrid encryption strategy to obtain ciphertext, encryption session key, and integrity check value;

[0138] The fifth module 805 is used to send the ciphertext, encryption session key, and integrity check value to the client if the user's permissions are read and write. The client is used to decrypt the ciphertext according to the encryption session key and integrity check value to obtain the original file.

[0139] Module 6, 806, is used to send the ciphertext, encryption session key, and integrity check value to the client if the user's permission is read-only. The client is used to decrypt the ciphertext based on the encryption session key and integrity check value to obtain the original file, and then perform multi-layer watermark embedding on the original file to obtain a watermarked file.

[0140] The content of the above method embodiments is applicable to the device embodiments. The specific functions implemented by the device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0141] like Figure 3 As shown, embodiments of the present invention also provide a computer device, including:

[0142] At least one processor 901;

[0143] At least one memory 902 is used to store at least one program;

[0144] When at least one program is executed by at least one processor, such that at least one processor achieves Figure 1 The method shown.

[0145] The content of the above method embodiments is applicable to the device embodiments. The specific functions implemented by the device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0146] This invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements... Figure 1 The method shown.

[0147] The content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0148] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A method for secure access control of files, characterized in that, Includes the following steps: Obtain several user historical access feature values; Based on the aforementioned user historical access feature values, a dynamic weight function is constructed; User permissions are determined based on the dynamic weighting function. The original file is encrypted using a hybrid encryption strategy to obtain ciphertext, encryption session key, and integrity check value; If the user's permissions are read and write, the ciphertext, the encryption session key, and the integrity check value are sent to the client. The client is used to decrypt the ciphertext according to the encryption session key and the integrity check value to obtain the original file. If the user's permission is read-only, the ciphertext, the encryption session key, and the integrity check value are sent to the client. The client is used to decrypt the ciphertext according to the encryption session key and the integrity check value to obtain the original file, and to perform multi-layer watermark embedding on the original file to obtain a watermarked file. The step of constructing a dynamic weight function based on the plurality of user historical access feature values ​​includes: Calculate the feature value influence factor based on the aforementioned user historical access feature values ​​and user set; Calculate the file structure complexity influence factor based on the file structure complexity, the preset maximum file structure complexity, and the file structure complexity influence coefficient; The influence factor of user equipment hardware aging degree is calculated based on the user equipment hardware aging degree, the preset maximum value of user equipment hardware aging degree, and the influence coefficient of user equipment hardware aging degree. Calculate the semantic complexity impact factor of the file; The dynamic weight function is constructed based on the feature value influence factor, the file structure complexity influence factor, the user device hardware aging influence factor, the file semantic complexity influence factor, the difference between the current access time and the previous access time, and the total number of features. The step of determining user permissions based on the dynamic weight function includes: Calculate the user permission value based on the dynamic weight function and the several user historical access feature values; The biometric stability index is calculated based on the number of biometric data collections, biometric values, and mean biometric values. Calculate the network connection jitter rate based on the number of network connection jitter samples, the network connection jitter value, and the mean network connection jitter. The user permissions are determined based on the user permission value, the biometric stability index, and the network connection jitter rate.

2. The method according to claim 1, characterized in that, The factor affecting the semantic complexity of the calculated file includes: The semantic complexity of a file is calculated based on lexical richness, sentence complexity, semantic relation network complexity, semantic topic diversity, semantic inference chain length, and semantic and contextual dependence. The file semantic complexity influence factor is calculated based on the file semantic complexity, the preset maximum file semantic complexity, and the file semantic complexity influence coefficient.

3. The method according to claim 1, characterized in that, The step of determining the user permissions based on the user permission value, the biometric stability index, and the network connection jitter rate includes: If the user permission value, the biometric stability index, and the network connection jitter rate all meet the preset requirements, then the user permission is determined to be readable and writable. If one or both of the user permission value, the biometric stability index, and the network connection jitter rate meet the preset requirements, then the user permission is determined to be read-only. If the user permission value, the biometric stability index, and the network connection jitter rate all fail to meet the preset requirements, then the user permission is determined to be inaccessible.

4. The method according to claim 1, characterized in that, The method employs a hybrid encryption strategy to encrypt the original file, obtaining ciphertext, an encryption session key, and an integrity verification value, including: A key pair is generated using an algebraic geometric code cryptosystem, the key pair including a public key and a private key, the private key being distributed to the user through a secure channel; Generate a random initial session key; According to the interleaved feedback mode, the original file is encrypted using the initial session key to obtain the ciphertext; According to a multivariate public-key cryptosystem, the initial session key is encrypted using the public key to obtain the encrypted session key; The integrity check value is calculated using fractal hashing based on the ciphertext and the encrypted session key.

5. The method according to claim 4, characterized in that, The step of decrypting the ciphertext based on the encryption session key and the integrity check value to obtain the original file includes: The initial session key is obtained by decrypting the encrypted session key using the private key. Based on the ciphertext and the encrypted session key, the verification value to be compared is calculated using the fractal hashing method. If the verification value to be compared and the integrity verification value are equal, the ciphertext is decrypted using the initial session key to obtain the original file.

6. The method according to claim 1, characterized in that, The process of performing multi-layer watermark embedding on the original file to obtain a watermarked file includes: The user identifier watermark, access time watermark, file version watermark, and biometric watermark are embedded into the original file to obtain the watermarked file.

7. A file security access control device, characterized in that, include: The first module is used to obtain several user historical access feature values; The second module is used to construct a dynamic weighting function based on the aforementioned user historical access feature values; The third module is used to determine user permissions based on the dynamic weight function; The fourth module is used to encrypt the original file using a hybrid encryption strategy to obtain ciphertext, encryption session key, and integrity check value; The fifth module is used to send the ciphertext, the encryption session key, and the integrity check value to the client if the user's permission is read and write. The client is used to decrypt the ciphertext according to the encryption session key and the integrity check value to obtain the original file. The sixth module is used to send the ciphertext, the encryption session key, and the integrity verification value to the client if the user's permission is read-only. The client is used to decrypt the ciphertext according to the encryption session key and the integrity verification value to obtain the original file, and to perform multi-layer watermark embedding processing on the original file to obtain a watermarked file. The step of constructing a dynamic weight function based on the plurality of user historical access feature values ​​includes: Calculate the feature value influence factor based on the aforementioned user historical access feature values ​​and user set; Calculate the file structure complexity influence factor based on the file structure complexity, the preset maximum file structure complexity, and the file structure complexity influence coefficient; The influence factor of user equipment hardware aging degree is calculated based on the user equipment hardware aging degree, the preset maximum value of user equipment hardware aging degree, and the influence coefficient of user equipment hardware aging degree. Calculate the semantic complexity impact factor of the file; The dynamic weight function is constructed based on the feature value influence factor, the file structure complexity influence factor, the user device hardware aging influence factor, the file semantic complexity influence factor, the difference between the current access time and the previous access time, and the total number of features. The step of determining user permissions based on the dynamic weight function includes: Calculate the user permission value based on the dynamic weight function and the several user historical access feature values; The biometric stability index is calculated based on the number of biometric data collections, biometric values, and mean biometric values. Calculate the network connection jitter rate based on the number of network connection jitter samples, the network connection jitter value, and the mean network connection jitter. The user permissions are determined based on the user permission value, the biometric stability index, and the network connection jitter rate.

8. A computer device, characterized in that, include: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the method as described in any one of claims 1-6.

Images