A unified authentication and data authority management method and system for a big data component

Abstract

The application provides a unified authentication and data permission control method and system of a big data component, the method comprising: verifying the validity of an identity credential and generating a unified identity token; obtaining an identity token of a binding data access request through the unified identity token; making a permission decision through a preset strategy rule based on the identity token of the binding data access request to obtain a permission decision result; obtaining an adjusted permission decision result based on user attributes, a current operation environment and an access mode; embedding access trace representation into the adjusted permission decision result to obtain processed structured data; and obtaining an audit record and a compliance report based on a data access request of a user, the adjusted permission decision result and the processed structured data. The application dynamically adjusts the permission decision result by using a gradient boosting decision tree and an attention mechanism based on user attributes and a real-time operation environment, so as to realize unified management across components and solve the problem of rigid permission strategies.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data security management, in particular to a unified authentication and data permission control method and system for big data components. BACKGROUND

[0002] With the wide application of big data technology, the big data ecology has flourished. Data platforms generally integrate Hadoop, Kafka, Flink, Hive, StarRocks open source big data components, etc., each component has an independent authentication and permission management mechanism, and there is an urgent need for a unified authentication and permission control scheme for big data components to be compatible with multi-component authentication, combined with RBAC and ABAC models, to realize fine-grained access control, data security classification and corresponding strategies.

[0003] Currently, the mainstream big data permission management scheme still has many deficiencies, such as: only applicable to Hadoop ecology, difficult to extend to non-Kerberos components; only applicable to specific components, unable to uniformly manage the permissions of Spark, Flink and other computing engines; only solves the authentication problem, not deeply integrated with the underlying data permissions; mainly for cloud-native services, with limited support for localized big data components. SUMMARY

[0004] In view of the above situation, the main purpose of the present application is to provide a unified authentication and data permission control method and system for big data components to solve the above technical problems.

[0005] The present application provides a unified authentication and data permission control method for big data components, which comprises the following steps:

[0006] Step 1, receiving the authentication request of the user and the data access request of the user, verifying the identity certificate in the authentication request of the user through the authentication protocol adaptation layer; if the verification is valid, generating a unified identity token; if the verification is invalid, returning an authentication failure response;

[0007] Step 2, binding the user information in the unified identity token with the data access request of the user to obtain the identity token of the bound data access request;

[0008] Step 3, obtaining user attributes based on the identity token of the bound data access request, and making permission decisions and obtaining permission decision results based on the user attributes through the preset policy rules;

[0009] Step 4, based on the user attributes, combining the user's current operation environment and access mode, and performing risk level assessment on the permission decision results through a learning model to obtain a risk level assessment result, and dynamically adjusting the permission decision results based on the risk level assessment result to obtain an adjusted permission decision result;

[0010] Step 5, obtaining an access trace representation through the data access request of the user, K-anonymity processing the adjusted permission decision result based on the user attribute and embedding the access trace representation to obtain the processed structured data;

[0011] Step 6, obtaining an audit record and a compliance report based on the data access request of the user, the adjusted permission decision result and the processed structured data.

[0012] The application further provides a unified authentication and data permission management system of a big data component, which comprises:

[0013] An identity authentication module, configured to:

[0014] receive an authentication request of a user and a data access request of the user, perform validity verification on an identity credential in the authentication request of the user through an authentication protocol adaptation layer, generate a unified identity token if the verification is valid, and return an authentication failure response if the verification is invalid;

[0015] A permission decision module, configured to:

[0016] bind user information in the unified identity token with the data access request of the user to obtain an identity token of the bound data access request;

[0017] obtain user attributes based on the identity token of the bound data access request, and perform permission decision through a preset strategy rule based on the user attributes to obtain a permission decision result;

[0018] based on the user attributes, combine a current operation environment and an access mode of the user, perform risk level evaluation on the permission decision result through a learning model to obtain a risk level evaluation result, and perform dynamic adjustment on the permission decision result based on the risk level evaluation result to obtain an adjusted permission decision result

[0019] A data desensitization module, configured to:

[0020] obtain an access trace representation through the data access request of the user, perform K-anonymity processing on the adjusted permission decision result based on the user attribute and embed the access trace representation to obtain the processed structured data;

[0021] An audit tracking module, configured to:

[0022] obtain an audit record and a compliance report based on the data access request of the user, the adjusted permission decision result and the processed structured data.

[0023] Compared with the prior art, the application has the following beneficial effects:

[0024] 1、The application is based on user attributes and real-time operation environment, utilizes gradient boosting decision tree and attention mechanism to dynamically adjust permission decision results, so as to realize cross-component unified management and solve the problem of rigid permission policy;

[0025] 2、The application forms irreversible characteristic fingerprints by embedding access trace information into low-frequency components through welfare evil transformation and discrete cosine transformation, and ensures that the leaked data can be accurately traced back;

[0026] 3、The application generates audit records with elliptic curve signatures based on an event-driven architecture, generates a risk heat map in combination with Elasticsearch log clustering, and stores hash chain verification information through a blockchain, realizes tamper-proofing and tracing of the whole life cycle of an operation link, and meets the audit needs of a strong compliance scenario. BRIEF DESCRIPTION OF DRAWINGS

[0027] Figure 1 A flowchart of a unified authentication and data permission control method of a big data component is provided for the application;

[0028] Figure 2 A general framework schematic diagram of a unified authentication and data permission control system of a big data component is provided for the application. DETAILED DESCRIPTION

[0029] The embodiments of the application are described in detail below, and examples of the embodiments are shown in the drawings, wherein the same or similar reference signs represent the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the drawings are exemplary and are only used to explain the application, and cannot be understood as a limitation of the application.

[0030] These and other aspects of embodiments of the application will become clear from the following description and drawings. In these descriptions and drawings, some specific implementations of embodiments of the application are specifically disclosed to represent some ways of implementing the principles of embodiments of the application, but it should be understood that the scope of embodiments of the application is not limited thereto.

[0031] Please refer to Figure 1 The application embodiment provides a unified authentication and data permission control method of a big data component, which comprises the following steps:

[0032] Step 1, receiving a user's authentication request and a user's data access request, verifying the identity credentials in the user's authentication request through an authentication protocol adaptation layer; if the verification is valid, generating a unified identity token; if the verification is invalid, returning an authentication failure response;

[0033] Specifically, in step 1, the authentication protocol adaptation layer includes different authentication protocol modules, such as Kerberos, OAuth, etc.

[0034] Specifically, in step 1, in the process of judging the identity and authority legality of the user when accessing the target component through the authentication gateway, the following expression exists:

[0035] ;

[0036] Among them, indicates the authentication result, and the authentication result is True, indicating that the verification is passed, and the authentication result is False, indicating that the verification is invalid; indicates the token validity, indicates the user identity legality, indicates the permission matching result.

[0037] Step 2, bind the user information in the unified identity token with the data access request of the user to obtain the identity token of the bound data access request.

[0038] Step 3, based on the identity token of the bound data access request to obtain the user attribute, based on the user attribute, the permission decision is made through the preset strategy rule and the permission decision result is obtained;

[0039] Specifically, in step 3, the user attribute includes department, job level and data sensitivity level.

[0040] Further, in step 3, the preset strategy rule is constructed based on the access permission level, wherein the calculation formula of the access permission level is:

[0041] ;

[0042] Among them, indicates the access permission level; indicates the decision function of the dynamic strategy engine, such as the conditional matching decision function; indicates the user belonging decision set, indicates the user attribute set, indicates the data attribute set; indicates the access environment attribute, such as access time and terminal type.

[0043] Specifically, in step 3, the preset strategy rule integrates multi-dimensional factors of user attributes, data attributes and environment attributes, and the rule is constructed based on role-based access control and attribute-based access control, to ensure that fine-grained and dynamic access control is realized in a complex and variable big data environment;

[0044] The policy rule performs initial permission allocation according to user attributes, including department, job level and data sensitivity level. The rule engine maps the user job level with the data sensitivity, determines the data range and operation type that can be accessed according to the access permission level, and the data attributes include data security level and data type. The policy rule imposes corresponding access restrictions according to the data security level, and high security level data needs to meet more stringent access conditions.

[0045] The policy rule also introduces environmental attributes as dynamic decision variables, including terminal device state, real-time geographic location, access time and network transmission reliability. Through the device credibility level, transmission channel risk value and space-time access anomaly degree output by the terminal security baseline management module, the policy rule assesses the risk level of the access environment in real time. When the environmental risk indicators exceed the preset threshold, the rule triggers access restrictions or enhances the authentication process.

[0046] The permission decision result is input into the learning model for risk level assessment. The generated abnormal probability value and threat correlation score are fed back to the policy engine. The policy rule has a built-in risk-permission mapping mechanism that dynamically adjusts the permission decision result based on the comprehensive risk level, enabling dynamic up / downgrading of permissions. In high-risk scenarios, the rule can execute access blocking or data desensitization instructions.

[0047] The rule engine in the policy rule records the policy version, matching rules and decision results of each permission decision, generating structured logs. These logs are associated with access requests, user attributes and environmental context, providing basic data for building audit event graphs.

[0048] The implementation of the policy rule relies on the unified identity token issued by the authentication protocol adaptation layer. The token binds user information and access requests, and the policy engine parses the token to obtain user attributes and then performs rule matching. The rule matching process uses a conditional reasoning mechanism to evaluate whether user attributes, data attributes and environmental attributes meet the rule conditions layer by layer, and finally outputs the permission decision result.

[0049] Step 4: Based on user attributes, combined with the user's current operating environment and access mode, the learning model assesses the risk level of the permission decision result to obtain a risk level assessment result. Based on the risk level assessment result, the permission decision result is dynamically adjusted to obtain an adjusted permission decision result.

[0050] In step 4, based on user attributes, combined with the user's current operating environment and access mode, the learning model assesses the risk level of the permission decision result and obtains a risk level assessment result. Based on the risk level assessment result, the permission decision result is dynamically adjusted to obtain an adjusted permission decision result. The specific steps are as follows:

[0051] Obtaining the user terminal device state, real-time geographic location, access time and historical operation record through the current operation environment and access mode of the user;

[0052] Based on the user terminal device state, real-time geographic location, access time, historical operation record and permission decision result, the device security baseline, network transmission reliability and space-time compliance are analyzed and processed in three dimensions through terminal security baseline management to generate a structured environment vector;

[0053] Obtaining historical access logs and current data operation types from historical operation records, constructing a baseline model based on historical access logs, generating an abnormal probability value based on the current data operation type and target data level using the baseline model, and obtaining operation rule identification according to the current data operation type and user attributes based on the abnormal probability value;

[0054] Obtaining a real-time risk intelligence library from a network security information sharing platform, performing threat correlation analysis through the Talos threat intelligence center based on the real-time risk intelligence library and enterprise security event feature library to obtain threat correlation analysis results, and performing pattern matching based on the threat correlation analysis results combined with the request parameter features in the user's authentication request to output threat correlation degree scores;

[0055] Using gradient boosting decision trees, the structured environment vector, abnormal probability value, operation rule identification and threat correlation degree score are fused according to the weight distribution to obtain a weight fusion result; based on the weight fusion result, the comprehensive risk level is obtained by processing through an attention mechanism network;

[0056] Based on the weight decision result and the comprehensive risk level, a risk-permission mapping rule library is constructed, and the adjusted permission decision result is output using the risk-permission mapping rule library.

[0057] Specifically, in step 4, the device security baseline, network transmission reliability and space-time compliance are analyzed and processed in three dimensions through terminal security baseline management, and a structured environment vector is generated; wherein the structured environment vector includes device trust level, transmission channel risk value and space-time access anomaly degree.

[0058] Step 5, obtaining access trace representation through the user's data access request, K-anonymizing the adjusted permission decision result based on user attributes and embedding the access trace representation to obtain processed structured data;

[0059] In step 5, the access trace representation is obtained through the access request, the adjusted permission decision result is K-anonymized based on the user attributes and the access trace representation is embedded to obtain the processed structured data, and the specific steps are as follows:

[0060] The user attribute-based user job level permission parameter and data sensitivity level are cross-verified to obtain a cross-verification result. Based on the cross-verification result, a two-dimensional evaluation model is constructed through field semantic analysis technology, and a field mapping table is output through the two-dimensional evaluation model. The two-dimensional evaluation model evaluates and processes the input data from two dimensions of data correlation characteristics and business awareness range.

[0061] Based on the current operation environment of the user, the current access environment risk indicators are extracted, and the cross-field association risk of the field mapping table and the current access environment risk indicators is detected in real time through dynamic data desensitization to obtain a real-time detection result. Based on the real-time detection result, the desensitization strength is dynamically adjusted to generate a desensitization strategy instruction set.

[0062] Based on the identity token of the bound data access request, a data access result is obtained, and the data access result is processed through clustering and generalization based on the desensitization strategy instruction set to obtain an anonymized data set.

[0063] The user session feature vector and timestamp sequence are obtained through access trace representation, and the user session feature vector and timestamp sequence after Fourier frequency domain transformation are convoluted to generate irreversible feature fingerprint spectrum features. The anonymized data set is aligned in feature dimension to obtain an aligned anonymized data set, and the irreversible feature fingerprint spectrum features are embedded in the low-frequency components of the aligned anonymized data set through discrete cosine transformation to generate structured data.

[0064] The structured data is extracted to obtain a hash digest and a permission decision audit log, and the hash digest and the permission decision audit log are blind processed through homomorphic encryption technology to generate hash chain structure verification information. The hash chain structure verification information is layered injected into the adjusted permission decision result through a zero-knowledge proof mechanism to obtain processed structured data.

[0065] Specifically, in step 5, based on the cross-verification result, a two-dimensional evaluation model is constructed through field semantic analysis technology, wherein the field semantic analysis technology specifically includes the following sub-steps:

[0066] The field name and content in the cross-verification result are word vector modeled to construct a semantic feature space;

[0067] Based on the semantic feature space, a graph neural network is used to obtain context association features between fields to identify potential combinations forming a user portrait, wherein the context association features include co-occurrence patterns, transition probabilities, etc.

[0068] After the contextual association features are aligned with the neighborhood knowledge base, the semantic disambiguation processing of professional terms, the private association strength calculation and the risk transmission path verification processing are performed by using the knowledge graph embedding technology to obtain a double-dimension evaluation model, wherein the double-dimension evaluation model can be evaluated from the semantic dimension and the statistical dimension.

[0069] Specifically, in step 5, the data access result is processed by clustering and generalization based on the desensitization strategy instruction set to obtain an anonymized data set, and the specific steps of the clustering and generalization joint processing are as follows:

[0070] The attribute weight clustering is performed on the data access result based on the desensitization strategy instruction set to obtain an attribute weight clustering result; the attribute generalization threshold is dynamically adjusted based on the attribute weight clustering result and the current access environment risk indicator, and the attribute clustering rule is output to ensure that the core field meets the basic requirement of K-anonymity;

[0071] Based on the data access result, the data distribution characteristics are obtained, and the virtual nodes consistent with the data distribution characteristics are generated through the field semantic constraint rules embedded in the desensitization strategy instruction set;

[0072] Based on the attribute clustering rule and the virtual node, a grouping structure with cross-field association protection capability is constructed, which blocks the attribute reasoning chain while maintaining data usability, and forms a dynamic protection system adapted to the current access environment risk indicator.

[0073] Specifically, in step 5, the irreversible feature fingerprint spectrum feature is embedded into the low-frequency component of the aligned anonymized data set by discrete cosine transform to generate structured data, and the specific steps of the discrete cosine transform are as follows:

[0074] The aligned anonymized data set is processed by frequency band energy analysis, and then the aligned anonymized data set is dynamically segmented according to the high-frequency band and the low-frequency band to obtain a segmented sub-band;

[0075] Based on the energy distribution parameters in the user session feature vector, an adaptive quantization matrix is established, and based on the adaptive quantization matrix, the irreversible feature fingerprint spectrum feature is embedded into the low-frequency sub-band of the segmented sub-band to obtain a frequency domain watermark template;

[0076] The time stamp sequence hash digest and the access path marker in the frequency domain watermark template are processed by frequency domain interleaving using orthogonal coding technology to generate structured data.

[0077] Further, in step 5, the calculation formula of the desensitization strength is:

[0078] ;

[0079] Wherein, Desensitization strength, the greater the value, the more complete the desensitization; and Both represent weight coefficients, and the sum of the two is 1; Data security level, when the data security level is 1, the value is 1, when the data security level is 2, the value is 2, when the data security level is 3, the value is 3, and when the data security level is 4, the value is 4; Data sensitivity coefficient.

[0080] Specifically, in step 5, the core idea of homomorphic encryption is to perform a specific form of algebraic operation on the ciphertext, and the operation result after decryption is consistent with the result obtained by performing the same operation on the plaintext; In this step, the hash digest and the permission decision audit log are blinded by homomorphic encryption technology to generate hash chain structure verification information, so as to realize verifiability while ensuring data privacy.

[0081] Step 6, based on the user's data access request, the adjusted permission decision result and the processed structured data, to obtain audit records and compliance reports;

[0082] In step 6, based on the user's data access request, the adjusted permission decision result and the processed structured data, to obtain audit records and compliance reports, the specific steps are as follows:

[0083] Through the knowledge graph, the operation type in the user's data access request is associated with the policy change node in the adjusted permission decision result to construct a three-element relationship audit event graph;

[0084] Based on GDPR, obtain the compliance template, use Drools to convert the compliance template into executable logical assertions, based on the data sensitivity level in the user attribute, load the executable logical assertions into the three-element relationship audit event graph to generate an audit rule set;

[0085] Using event-driven architecture, logically bind the nodes in the audit event graph to the audit rule set to obtain a compliance verification logic chain; based on access traceability, verify the compliance of the compliance verification logic chain, and if the verification is passed, use elliptic curve digital signature method to obtain audit records;

[0086] Based on user attributes, use the permission change events in the audit records to generate a risk heat map through Elasticsearch log clustering; based on the risk heat map, obtain the complete operation link through the Neo4j graph query interface; based on the complete operation link, combined with the verification records in the audit records, use digital watermarking technology to generate a compliance report.

[0087] Specifically, in step 6, the operation type in the user's data access request is associated with the policy change node in the adjusted permission decision result through the knowledge graph to construct a three-element relationship audit event graph; wherein the three-element relationship audit event graph contains the three-element relationship of operation, policy and risk.

[0088] Further, in step 6, when constructing the "compliance verification logic chain", the nodes (user operation, permission change, policy change) in the audit event graph and the generated audit rule set are bound to the blockchain for storage. Due to the tamper-proof nature of the blockchain, it can ensure that the data traceability in the entire audit process is reliable and not affected by malicious attacks or human tampering;

[0089] Each operation node (user authentication request, adjusted permission decision result) is embedded in the logic chain through the event-driven architecture to form a complete event track, and the logic chain formed can automatically verify the legality of the operation;

[0090] When generating the audit record, the audit record is signed using the elliptic curve digital signature method, and the signed hash value is stored on the blockchain to ensure the authenticity of the content and the reliability of the source.

[0091] Further, in step 6, the event-driven architecture realizes asynchronous communication and loosely coupled system interaction through the capture, transmission and processing of events, specifically:

[0092] When an operation such as a user access request, permission adjustment or policy change occurs in the system, an event is generated, and then the event is published to the event stream;

[0093] Decouple the event publisher from the event consumer, the event publisher is responsible for generating and sending events, and the event consumer is responsible for processing these events. The event publisher and the event consumer interact through an event bus or a message queue, and the consumer module independently executes logical processing after receiving the event;

[0094] The consumer module triggers the corresponding logical operation according to the received event, such as updating the audit event graph, generating the audit rule set, binding the compliance verification logic chain, and through the stream processing technology, the event can be analyzed and processed in real time;

[0095] Among them, the event publisher specifically includes: when the user submits access, publish the user access event; when the permission decision result is updated, publish the permission decision update event; when the logical assertion is generated based on the GDPR template, publish the rule set update event;

[0096] The event consumer specifically includes: a dynamic association operation type, a policy change node, and an audit event graph of updating a three-element relationship; executable logic assertions are loaded to the audit event graph, and an audit rule set is generated; a user request trace information is verified; and an audit record is generated by using an elliptic curve digital signature.

[0097] Referring to Figure 2 The embodiment of the application further provides a unified authentication and data permission management and control system of a big data component, the system comprising:

[0098] An identity authentication module, configured to:

[0099] receive an authentication request of a user and a data access request of the user, and perform validity verification on identity credentials in the authentication request of the user by using an authentication protocol adaptation layer; if the verification is valid, generate a unified identity token; if the verification is invalid, return an authentication failure response;

[0100] A permission decision module, configured to:

[0101] bind user information in the unified identity token with the data access request of the user to obtain an identity token of the bound data access request;

[0102] obtain user attributes based on the identity token of the bound data access request, and perform permission decision based on the user attributes by using preset policy rules to obtain a permission decision result;

[0103] based on the user attributes, combine a current operation environment and an access mode of the user, and perform risk level evaluation on the permission decision result by using a learning model to obtain a risk level evaluation result, and dynamically adjust the permission decision result based on the risk level evaluation result to obtain an adjusted permission decision result

[0104] A data desensitization module, configured to:

[0105] obtain an access trace representation by using the data access request of the user, perform K-anonymity processing on the adjusted permission decision result based on the user attributes and embed the access trace representation to obtain processed structured data;

[0106] An audit tracking module, configured to:

[0107] obtain an audit record and a compliance report based on the data access request of the user, the adjusted permission decision result and the processed structured data.

[0108] It should be appreciated that parts of the present application can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, several steps or methods can be implemented in software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented in hardware, and as in another embodiment, any of the following technologies, or a combination thereof, can be used: discrete logic circuitry having logic gates for implementing logic functions upon an application of data signals, application specific integrated circuits having appropriate combinational logic gates, programmable gate arrays (PGA), field programmable gate arrays (FPGA), and the like.

[0109] In the description of the present specification, the description of the terms "one embodiment", "some embodiments", "an example", "a specific example", or "some examples" and the like means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In the present specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Also, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0110] The above-described embodiments only express several implementation manners of the present application, which are described in a more specific and detailed manner, but should not be understood as a limitation on the patent scope of the present application. It should be noted that, for those skilled in the art, several modifications and improvements can be made without departing from the concept of the present application, which are all within the protection scope of the present application. Therefore, the patent protection scope of the present application should be subject to the appended claims.

Claims

1.A method for unified authentication and data permission management of big data components, characterized in that, The method comprises the following steps: Step 1, receiving an authentication request of a user and a data access request of the user, verifying the identity credential in the authentication request of the user through an authentication protocol adaptation layer; If the verification is valid, a unified identity token is generated; If the verification is invalid, an authentication failure response is returned; Step 2, binding the user information in the unified identity token with the data access request of the user to obtain a binding data access request identity token; Step 3, obtaining user attributes based on the binding data access request identity token, and making a permission decision based on the user attributes through a preset strategy rule to obtain a permission decision result; Step 4, based on the user attributes, combining the current operation environment and access mode of the user, and performing risk level evaluation on the permission decision result through a learning model to obtain a risk level evaluation result, and dynamically adjusting the permission decision result based on the risk level evaluation result to obtain an adjusted permission decision result, the specific steps are as follows: Obtain the user terminal device state, real-time geographic location, access time and historical operation record through the current operation environment and access mode of the user; Based on the user terminal device state, real-time geographic location, access time, historical operation record and permission decision result, the device security baseline, network transmission reliability and space-time compliance are analyzed and processed in three dimensions through terminal security baseline management to generate a structured environment vector; Obtain historical access logs and current data operation types from the historical operation record, and construct a baseline model based on the historical access logs; based on the current data operation type and the target data level, an abnormal probability value is generated by using the baseline model; Based on the abnormal probability value, the operation rule identifier is obtained according to the current data operation type and the user attributes; Obtain the real-time risk intelligence library from the network security information sharing platform, and based on the real-time risk intelligence library and the enterprise security event feature library, perform threat correlation analysis through the Talos threat intelligence center to obtain a threat correlation analysis result; Based on the threat correlation analysis result, the request parameter features in the authentication request of the user are matched to output a threat correlation degree score; Using gradient boosting decision tree, according to weight allocation, the structured environment vector, abnormal probability value, operation rule identifier and threat correlation degree score are fused to obtain a weight fusion result; Based on the weight fusion result, the comprehensive risk level is obtained by processing through the attention mechanism network; Based on the weight decision result and the comprehensive risk level, a risk-permission mapping rule library is constructed, and the adjusted permission decision result is output by using the risk-permission mapping rule library; Step 5, obtaining an access trace representation through the data access request of the user, K-anonymizing the adjusted permission decision result based on the user attributes and embedding the access trace representation to obtain processed structured data; Step 6, based on the data access request of the user, the adjusted permission decision result and the processed structured data, an audit record and a compliance report are obtained. 2.The method of claim 1, wherein, The terminal security baseline management is used for three-dimensional correlation analysis and processing of the device security baseline, network transmission reliability and space-time compliance, and a structured environment vector is generated. 3.The method of claim 2, wherein, In the step 5, the access trace representation is obtained through the data access request of the user, the adjusted permission decision result is K-anonymized based on the user attribute, and the access trace representation is embedded to obtain the processed structured data. Based on the user attribute, the user job level permission parameter and the data sensitivity level are obtained, and the user job level permission parameter and the data sensitivity level are cross-verified to obtain a cross-verification result; based on the cross-verification result, a two-dimensional evaluation model is constructed through field semantic analysis technology, and a field mapping table is output through the two-dimensional evaluation model; wherein the two-dimensional evaluation model evaluates the input data from two dimensions of data correlation characteristics and business awareness range; Based on the user's current operation environment, the current access environment risk index is extracted, and the cross-field association risk of the field mapping table and the current access environment risk index is detected in real time through dynamic data desensitization to obtain a real-time detection result; based on the real-time detection result, the desensitization strength is dynamically adjusted to generate a desensitization strategy instruction set; Based on the identity token bound to the data access request, a data access result is obtained, and the data access result is processed through clustering and generalization based on the desensitization strategy instruction set to obtain an anonymized data set; Through the access trace representation, a user session feature vector and a timestamp sequence are obtained, and the user session feature vector and the timestamp sequence after Fourier frequency domain transformation are convolved to generate an irreversible feature fingerprint spectrum feature; the anonymized data set is aligned in feature dimension to obtain an aligned anonymized data set, and the irreversible feature fingerprint spectrum feature is embedded into the low-frequency component of the aligned anonymized data set through discrete cosine transformation to generate structured data; The structured data is extracted to obtain a hash digest and a permission decision audit log, and the hash digest and the permission decision audit log are blinded through homomorphic encryption technology to generate hash chain structure verification information; the hash chain structure verification information is layered injected into the adjusted permission decision result through a zero-knowledge proof mechanism to obtain processed structured data. 4.The method of claim 3, wherein, Based on the cross-verification result, a two-dimensional evaluation model is constructed through field semantic analysis technology, wherein the field semantic analysis technology specifically includes the following sub-steps: Word vector modeling is performed on the field name and content in the cross-verification result to construct a semantic feature space; Based on the semantic feature space, a graph neural network is used to obtain the context association feature between fields; After aligning the context association feature with the neighborhood knowledge base, the knowledge graph embedding technology is used for semantic disambiguation processing of professional terms, privacy association strength calculation and risk transmission path verification processing to obtain the two-dimensional evaluation model. 5.The method of claim 4, wherein, Based on the desensitization strategy instruction set, the data access result is processed through clustering and generalization joint processing to obtain an anonymized data set, and the specific steps of the clustering and generalization joint processing are as follows: The attribute weight clustering result is obtained by clustering attribute weights of the data access result based on the desensitization strategy instruction set; and the attribute clustering rule is outputted by dynamically adjusting the attribute generalization threshold based on the attribute weight clustering result and the current access environment risk index, so as to ensure that the core field meets the basic requirement of K-anonymity. The data distribution feature is obtained based on the data access result, and the virtual node conforming to the data distribution feature is generated by the field semantic constraint rule embedded in the desensitization strategy instruction set. Based on the attribute clustering rule and the virtual node, a grouping structure with cross-field association protection capability is constructed, which blocks the attribute reasoning chain while maintaining the data availability, and forms a dynamic protection system adapted to the current access environment risk index. 6.The method of claim 5, wherein, The irreversible characteristic fingerprint spectrum feature is embedded into the low-frequency component of the aligned anonymized data set by discrete cosine transform to generate structured data, wherein the specific steps of the discrete cosine transform are as follows: The aligned anonymized data set is subjected to frequency band energy analysis processing, and then dynamically segmented into high-frequency bands and low-frequency bands to obtain segmented sub-bands. Based on the energy distribution parameters in the user session feature vector, an adaptive quantization matrix is established, and the irreversible characteristic fingerprint spectrum feature is embedded into the low-frequency sub-band of the segmented sub-band based on the adaptive quantization matrix to obtain a frequency domain watermark template. The timestamp sequence hash digest and the access path marker in the frequency domain watermark template are subjected to frequency domain interleaving processing by using orthogonal coding technology to generate structured data. 7.The method of claim 6, wherein, In step 6, the audit record and the compliance report are obtained based on the user's data access request, the adjusted permission decision result and the processed structured data, and the specific steps are as follows: Through the knowledge graph, the operation type in the user's data access request is associated with the policy change node in the adjusted permission decision result to construct a three-element relationship audit event graph. Based on GDPR, a compliance template is obtained, and Drools is used to convert the compliance template into executable logical assertions. Based on the data sensitivity level in the user attribute, the executable logical assertions are loaded into the three-element relationship audit event graph to generate an audit rule set. The nodes in the audit event graph and the audit rule set are logically bound by using the event-driven architecture to obtain a compliance verification logic chain. The compliance of the compliance verification logic chain is verified based on the access trace representation, and the audit record is obtained by using the elliptic curve digital signature method after the verification is passed. Based on the user attribute, the risk heat map is generated by Elasticsearch log clustering based on the permission change event in the audit record. Based on the risk heat map, the complete operation link is obtained through the Neo4j graph query interface. Based on the complete operation link, the compliance report is generated by using the digital watermark technology in combination with the verification record in the audit record. 8.The method of claim 7, wherein, Through the knowledge graph, the operation type in the user's data access request is associated with the policy change node in the adjusted permission decision result to construct a three-element relationship audit event graph; wherein the three-element relationship audit event graph contains the three-element relationship of operation, policy and risk. 9.A system for unified authentication and data permission management of big data components, characterized in that, The system applies a unified authentication and data permission control method of a big data component according to any one of claims 1 to 8, and the system comprises: An identity authentication module, configured to: receive an authentication request of a user and a data access request of the user, perform validity verification on identity credentials in the authentication request of the user through an authentication protocol adaptation layer, generate a unified identity token if the verification is valid, and return an authentication failure response if the verification is invalid; An authority decision module, configured to: bind user information in the unified identity token with the data access request of the user to obtain an identity token of the bound data access request; obtain user attributes based on the identity token of the bound data access request, perform authority decision through preset strategy rules based on the user attributes, and obtain an authority decision result; perform risk level evaluation on the authority decision result through a learning model based on the user attributes, the current operation environment and the access mode of the user to obtain a risk level evaluation result, and dynamically adjust the authority decision result based on the risk level evaluation result to obtain an adjusted authority decision result A data desensitization module, configured to: obtain an access trace representation through the data access request of the user, perform K-anonymity processing on the adjusted authority decision result based on the user attributes and embed the access trace representation to obtain processed structured data; An audit tracking module, configured to: obtain an audit record and a compliance report based on the data access request of the user, the adjusted authority decision result and the processed structured data.

Images