Data space-oriented multi-dimensional data access control method

Abstract

The invention discloses a data space-oriented multi-dimensional data access control method, which comprises the following steps of: in response to an access request for a target access node, generating request full-text data for the access request according to a preset formalized format; sending the request full-text data to an access decision end; and under the condition that an access decision instruction generated by the access decision end according to the request full-text data is obtained, executing the access decision instruction at the target access node. According to the method, a structured and formalized data interaction mechanism is established between the access execution end and the access decision-making end, and dynamic evaluation and efficient execution of the access control strategy are realized, so that the expansibility and the collaboration of the access control system are improved in a plurality of key links; and the expansibility and the collaboration of the access control system in a data space environment are improved.

Description

Technical Field

[0001] This application belongs to the field of network access control, specifically relating to a multi-dimensional data access control method, apparatus, device, storage medium, and computer program product for data space. Background Technology

[0002] In the context of rapid digitalization and intelligentization, data space, as an environment for the fusion and circulation of multi-source heterogeneous data, is widely used in smart cities, industrial internet, financial risk control, and healthcare. Data in data space typically originates from multiple different data nodes and is characterized by diverse formats, frequent circulation, and dynamic evolution. With the continuous integration and use of data, how to achieve flexible and precise access control while ensuring data security has become one of the core issues in data space management.

[0003] In existing technologies, access control mainly adopts either Role-Based Access Control (RBAC) or Attribute-Based Access Control (ABAC) models. RBAC achieves access control by assigning roles to users and defining role permissions, and has the advantages of simple structure and easy management; while ABAC formulates access policies through multi-dimensional information such as user attributes, resource attributes, and environment attributes, and has stronger expressive power and fine-grained control capabilities.

[0004] However, the RBAC scheme lacks flexibility in the face of complex and dynamic environments due to its high pre-setting requirements; while the ABAC scheme lacks an efficient collaboration mechanism between the execution end and the decision end during the strategy execution process. Both are difficult to meet the high requirements of data scalability and execution collaboration in the data space. Summary of the Invention

[0005] This application aims to provide a multi-dimensional data access control method, apparatus, device, storage medium, and computer program product for data space, which at least solves the problem that existing access control strategies are difficult to balance data scalability and execution coordination.

[0006] In a first aspect, embodiments of this application disclose a multi-dimensional data access control method for data space, applied to an access execution end, including: In response to an access request to a target access node, the full text data of the access request is generated according to a preset formal format. Send the full text of the request to the access decision-making terminal; Upon receiving an access decision instruction generated by the access decision-making terminal based on the full-text data of the request, the access decision instruction is executed at the target access node.

[0007] Secondly, embodiments of this application also disclose a multi-dimensional data access control method for data space, applied to the access decision-making end, including: The full text of the request sent from the access execution terminal is obtained, and the matching between the formal conditions corresponding to the preset formal format and the full text of the request is verified; the full text of the request is generated by the access execution terminal according to the formal format based on the access request to the target access node. If the matching condition satisfies the preset matching criteria, an access decision instruction corresponding to the requested full-text data is generated, and the access decision instruction is sent to the access execution terminal so that the access execution terminal executes the access decision instruction.

[0008] Thirdly, embodiments of this application disclose a multi-dimensional data access control device for data space, applied to an access execution end, including: The data integration module is used to generate the full-text data of the access request in accordance with a preset formal format in response to the access request to the target access node. The data sending module is used to send the full text of the request data to the access decision terminal; The command execution module is used to execute the access decision instruction at the target access node when the access decision terminal generates the access decision instruction based on the full-text data of the request.

[0009] Fourthly, embodiments of this application also disclose a multi-dimensional data access control device for data space, applied to an access decision-making end, including: The data acquisition module is used to acquire the full-text data of the request sent from the access execution terminal, and verify the matching of the formal conditions corresponding to the preset formal format with the full-text data of the request; the full-text data of the request is generated by the access execution terminal according to the formal format based on the access request to the target access node; The command sending module is used to generate an access decision instruction corresponding to the requested full-text data when the matching situation meets the preset matching conditions, and send the access decision instruction to the access execution terminal so that the access execution terminal executes the access decision instruction.

[0010] Fifthly, embodiments of this application also disclose an electronic device, including a processor and a memory, wherein the memory stores a program or instructions executable on the processor, and the program or instructions, when executed by the processor, implement the steps of the method described in the first or second aspect.

[0011] In a sixth aspect, embodiments of this application also disclose a readable storage medium storing a program or instructions that, when executed by a processor, implement the steps of the method described in the first or second aspect.

[0012] In a seventh aspect, embodiments of this application also disclose a computer program product, characterized in that the computer program product stores a computer program, and when the computer program is executed by a processor, it implements the steps of the method described in the first or second aspect.

[0013] In summary, in this embodiment, by generating full-text request data at the access execution end according to a preset formal format, the access request can express access context information in a structured and standardized manner. This not only improves the expressive power of the access request but also provides a unified data foundation for subsequent policy evaluation. Consequently, the full-text request data can be sent to the access decision-making end, establishing an efficient collaborative channel between the execution and decision-making ends. This allows the access decision-making end to obtain complete access context information in a timely manner, avoiding policy evaluation biases caused by incomplete or inefficient transmission of context information, thereby improving the accuracy and response speed of access control decisions. Then, based on the full-text request data, formal conditions are matched and policies are evaluated, and access decision instructions are generated. Based on the combination logic of multi-dimensional information, this flexibly adapts to the dynamically evolving data states and access needs in the data space, more accurately identifying whether access requests meet preset policy conditions. This effectively reduces the risk of misauthorization or denial, improving system security and compliance. Finally, after receiving the access decision instructions, the access execution end executes the corresponding operation at the target access node, realizing closed-loop execution of the access control policy. This ensures that the policy evaluation results can be applied to actual access behavior in a timely and accurate manner, avoiding the disconnect between policy and execution. Therefore, based on the method of this application embodiment, by establishing a structured and formal data interaction mechanism between the access execution end and the access decision end, dynamic evaluation and efficient execution of access control policies are achieved. This improves the scalability and coordination of the access control system in multiple key aspects. Through the closed-loop process, not only is the execution efficiency of access control improved, but the controllability and traceability of access behavior are also enhanced, effectively improving the scalability and coordination of the access control system in the data space environment. Meanwhile, this solution also enhances the flexibility, precision, and execution efficiency of access control, thereby reducing the risks of data leakage and permission abuse caused by insufficient policy expression capabilities or lagging execution mechanisms, and improving the overall security and stability of the system. Attached Figure Description

[0014] In the attached diagram: Figure 1 This is a flowchart illustrating the steps of a multi-dimensional data access control method for data space provided in an embodiment of this application. Figure 2 This is a flowchart illustrating the steps of another multi-dimensional data access control method for data space provided in this application embodiment; Figure 3 This is a diagram illustrating a mechanism for generating full-text request data, provided by an embodiment of this application. Figure 4 This is a block diagram of a multi-dimensional data access control device for data space provided in an embodiment of this application; Figure 5This is a block diagram of another multi-dimensional data access control device for data space provided in the embodiments of this application; Figure 6 This is a block diagram of an electronic device provided in one embodiment of this application. Detailed Implementation

[0015] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0016] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0017] like Figure 1 The image shows a multi-dimensional data access control method for data space provided in an embodiment of this application, which is applied to the access execution end.

[0018] The method may include the following steps: Step 101: In response to the access request to the target access node, generate the full text data of the access request according to the preset formal format.

[0019] In some embodiments of this application, to ensure that access requests can be accurately expressed and used for subsequent policy evaluation, the access execution terminal, upon receiving an access request for a target access node, generates the full-text data of the access request according to a preset formal format. Specifically, the access execution terminal can extract contextual information related to access control based on the content of the access request and organize it into a structured data format to form the full-text data of the request. The formal format is a predefined data expression specification used to uniformly describe multi-dimensional information in access requests, including user attributes, resource attributes, environmental conditions, time, space, etc. The use of this format enhances the expressive power of access requests, enabling the subsequent access decision-making terminal to perform policy matching and evaluation based on complete and standardized information. The process of generating the full-text data of the request is directly related to the access request formula proposed in the disclosure materials. Its initial purpose is to provide a unified contextual data structure during the policy evaluation process, utilizing the principle of mapping dimensional information into key-value pairs and performing logical combinations.

[0020] In a specific example, a user attempts to access sensitive data resources within a financial risk control system. This access requires advanced privileges and must occur during working hours. Upon receiving the access request, the access execution terminal extracts information such as the user's role (e.g., "analyst"), permission level (e.g., "level 3"), current access time (e.g., "10:30"), and access location (e.g., "company intranet"), and organizes this information into a full-text request data according to a pre-defined formal format. This full-text request data is then used in the subsequent policy evaluation process. Through this execution process, the system ensures that the contextual information of the access request is expressed completely and in a standardized manner, thereby providing accurate input for the access decision-making end and ultimately improving the evaluation efficiency and execution accuracy of access control policies.

[0021] Step 102: Send the full text of the request data to the access decision-making end.

[0022] In some embodiments of this application, to enable the access decision-making end to obtain the context information of the access request in a timely manner for policy matching and access decision-making, the access execution end sends the generated full-text request data to the access decision-making end. Specifically, the access execution end can transmit the structured full-text request data to the access decision-making end through a preset communication mechanism. This data transmission not only establishes a collaborative channel between the execution end and the decision-making end but also ensures that the access decision-making end can perform policy evaluation based on complete context information. The standardized structure of the full-text request data allows the decision-making end to directly perform formal condition matching upon receipt without additional data parsing or transformation, thereby improving the efficiency and accuracy of policy evaluation. This achieves an information synchronization mechanism in the access control process, effectively reducing policy evaluation bias caused by missing or delayed context information, and enhancing the responsiveness and coordination of the access control system.

[0023] In a specific example, researchers attempted to access a report containing sensitive patient information within a healthcare data platform. After generating the full-text request data, including user role (e.g., "doctor"), access purpose (e.g., "diagnosis"), current time (e.g., "14:00"), and device status (e.g., "encrypted terminal"), the access execution end sent this data to the access decision-making end via the platform's built-in secure communication protocol. Upon receiving the full-text request data, the access decision-making end immediately initiated a policy matching process. Through this execution process, the system ensured that the contextual information of the access request was completely and accurately transmitted to the decision-making end, thereby improving the efficiency of access control policy evaluation and reducing the risk of misjudgment due to information inconsistencies.

[0024] Step 103: Upon receiving the access decision instruction generated by the access decision-making end based on the full-text data of the request, execute the access decision instruction at the target access node.

[0025] In some embodiments of this application, to achieve closed-loop execution of the access control policy, after receiving the access decision instruction generated by the access decision-making end based on the full-text request data, the access execution end executes the instruction at the target access node: performing corresponding operations on the target access node according to the instruction content, such as allowing access, denying access, or performing additional obligation operations (such as logging, triggering a secondary authentication process, etc.). The access decision instruction is a structured control information generated by the access decision-making end, and its content typically includes the authorization result and necessary execution constraints. The execution of this instruction ensures that the policy evaluation result can be accurately applied to actual access behavior, thereby avoiding the disconnect between policy and execution. By executing the access decision instruction at the target access node, the system achieves closed-loop management of the access control process, effectively improving the controllability and traceability of access behavior, while enhancing the execution efficiency and consistency of the access control system.

[0026] In a specific example, a user attempts to access a highly sensitive customer credit report on a financial risk control platform. After completing a policy evaluation, the access decision-making end generates an access decision instruction "Allow Access," with the additional obligation of "Secondary Authentication Required." Upon receiving this instruction, the access execution end first triggers a secondary authentication process at the target access node. After successful authentication, the system allows access to the report and records the access log in the background. Through this execution process, the system not only completes authorization control over access requests but also ensures that access behavior complies with security policy requirements, thereby enhancing the protection capabilities of data resources and reducing security risks caused by inconsistent authorization execution.

[0027] In summary, in this embodiment, by generating full-text request data at the access execution end according to a preset formal format, the access request can express access context information in a structured and standardized manner. This not only improves the expressive power of the access request but also provides a unified data foundation for subsequent policy evaluation. Consequently, the full-text request data can be sent to the access decision-making end, establishing an efficient collaborative channel between the execution and decision-making ends. This allows the access decision-making end to obtain complete access context information in a timely manner, avoiding policy evaluation biases caused by incomplete or inefficient transmission of context information, thereby improving the accuracy and response speed of access control decisions. Then, based on the full-text request data, formal conditions are matched and policies are evaluated, and access decision instructions are generated. Based on the combination logic of multi-dimensional information, this flexibly adapts to the dynamically evolving data states and access needs in the data space, more accurately identifying whether access requests meet preset policy conditions. This effectively reduces the risk of misauthorization or denial, improving system security and compliance. Finally, after receiving the access decision instructions, the access execution end executes the corresponding operation at the target access node, realizing closed-loop execution of the access control policy. This ensures that the policy evaluation results can be applied to actual access behavior in a timely and accurate manner, avoiding the disconnect between policy and execution. Therefore, based on the method of this application embodiment, by establishing a structured and formal data interaction mechanism between the access execution end and the access decision end, dynamic evaluation and efficient execution of access control policies are achieved. This improves the scalability and coordination of the access control system in multiple key aspects. Through the closed-loop process, not only is the execution efficiency of access control improved, but the controllability and traceability of access behavior are also enhanced, effectively improving the scalability and coordination of the access control system in the data space environment. Meanwhile, this solution also enhances the flexibility, precision, and execution efficiency of access control, thereby reducing the risks of data leakage and permission abuse caused by insufficient policy expression capabilities or lagging execution mechanisms, and improving the overall security and stability of the system.

[0028] Figure 2This application provides another multi-dimensional data access control method for data space, wherein steps 201, 202, and 205 are applied to the access execution end, and steps 203 and 204 are applied to the access decision end.

[0029] The method may include the following steps: Step 201: In response to the access request to the target access node, generate the full text data of the access request according to a preset formal format.

[0030] The method shown in this step has been explained in step 101 and will not be repeated here.

[0031] Optionally, in order to generate the full-text data of the access request according to a preset formal format, step 201 includes the following sub-steps: Sub-step 2011: Obtain the access context data corresponding to the access request based on each first sub-data item recorded in the access request.

[0032] Each first sub-data item is one of the first execution object information, first execution condition information, and first execution permission information recorded in the access request; the access context includes at least one second sub-data item of the access request; each second sub-data item is one of the second execution object information, second execution condition information, and second execution permission information of the access request.

[0033] In some embodiments of this application, to ensure that the information expressed in the access request has complete contextual semantics, the access execution terminal obtains the access context data corresponding to each first sub-data item recorded in the access request. Specifically, the access execution terminal identifies the first execution object information, first execution condition information, and first execution permission information contained in the access request, and queries or extracts the associated second execution object information, second execution condition information, and second execution permission information accordingly to construct the access context. The access context refers to a set of environmental information supplemented to the access request to support policy evaluation, typically including the user's current state, resource attributes, operation intent, device state, etc. In this way, the system can associate the first sub-data items in the access request with the second sub-data items in the access context, thereby constructing a complete contextual data structure. This improves the semantic integrity of the access request, provides a more comprehensive input basis for subsequent policy matching and evaluation, and enhances the accuracy and adaptability of the access control system.

[0034] In a specific example, a user attempts to access a traffic monitoring video resource on a smart city platform. The access request records the first execution object information (e.g., "video resource ID"), the first execution condition information (e.g., "access time"), and the first execution permission information (e.g., "user role"). Based on this information, the access execution terminal further obtains access context data, including the second execution object information (e.g., "video region"), the second execution condition information (e.g., "current network status"), and the second execution permission information (e.g., "user's historical access frequency"). Ultimately, the system constructs an access context containing multi-dimensional information, providing complete data support for subsequent policy evaluation, thereby improving the accuracy and flexibility of access control.

[0035] Sub-step 2012 integrates the access request with the access context in a formalized format to obtain the full-text data of the access request.

[0036] In some embodiments of this application, to generate a complete access request data structure that can be used for policy evaluation, the access execution end integrates the access request and access context according to a preset formal format to obtain the full-text data of the access request. Specifically, the access execution end merges the access request information extracted in the previous steps with the access context data, and organizes all dimensional information into a unified data expression structure according to the field definitions, data type specifications, and structural constraints of the formal format. The formal format is a structural template for standardizing access request expressions, typically including dimension identifiers, value types, logical relationships, etc., ensuring that the generated full-text request data has consistency and parsability. The use of this format allows the subsequent access decision-making end to directly perform policy matching and logical evaluation on the request data without additional data transformation or supplementation. In this way, the system can structurally integrate all dimensional information of the access request and access context to generate full-text request data that meets the requirements of policy evaluation. This process improves the standardization and completeness of data expression, provides a unified and high-quality input foundation for the logical matching of access control policies, and enhances the system's evaluation efficiency and decision accuracy.

[0037] In a specific example, a user attempts to access the operational status data of a device within an industrial internet platform. The access request includes information such as device identifier, access time, and user permission level. The access context includes information such as the device's current operational status, the user's network environment, and the department to which the device belongs. The access execution end integrates this information according to a preset formalized format, generating full-text request data containing all relevant dimensions. This data structure includes text-type fields (such as "role" and "department") and numeric-type fields (such as "permission level" and "access time"), uniformly encapsulated according to dimension identifiers. Through this execution process, the system obtains full-text request data that can be directly used for policy evaluation, thereby improving the standardization and execution efficiency of the access control process.

[0038] Optionally, sub-step 2012 includes the following sub-steps: Sub-step 20121 generates a three-data set corresponding to each sub-data item in the access request.

[0039] Each three-data set stores the data type, comparison operator, and data value of each corresponding sub-data item in a preset storage order.

[0040] In some embodiments of this application, to achieve a structured representation of each sub-data item in the access request for subsequent unified logical processing and policy matching, the system generates a three-element data set corresponding to each sub-data item in the access request. Specifically, the system generates a three-element data set containing data type, comparison operator, and data value for each sub-data item in the access request, and stores them according to a preset storage order. The three-element data set is a structured semantic unit used to express each sub-data item in the access request, which can transform the original data item into a data structure with logical judgment capabilities. Through this structured representation, the system can construct and match logical expressions for the request data in subsequent steps, thereby improving the accuracy and execution efficiency of policy evaluation. In this way, the system can transform the access request into a structured logical expression input, providing basic data support for subsequent policy matching and evaluation.

[0041] In a specific example, a user initiates an access request on a smart healthcare platform, attempting to retrieve a patient's medical records. The system identifies multiple sub-data items in the request, such as "user role," "access time," and "data sensitivity level." The system generates three-element data groups for each of these sub-data items; for example, "user role" as "doctor" is represented as ("String", "==", "doctor"), and "access time" as "2025-08-03 17:50" is represented as ("Datetime", "<=", "2025-08-03 17:50"), and stores them in a preset order. Ultimately, the system obtains a structured representation of the request data, providing the basic data units for subsequent construction of logical expression structures and strategy matching calculations.

[0042] Sub-step 20122: Store all three data sets according to a preset logical expression structure to obtain the full-text data of the request.

[0043] In some embodiments of this application, to enable access requests to possess logical expressive capabilities for policy evaluation, the system stores all three-data sets according to a preset logical expression structure to obtain the full-text request data. Specifically, the system combines each three-data set generated in the previous steps according to the logical expression structure defined by the policy, and stores the combined expression as the full-text request data. The logical expression structure refers to an expressive framework used to describe the logical relationships between multiple conditions, typically including logical operators (such as AND, OR, and NOT) and nested bracket structures, used to construct Boolean expressions that can be recognized and evaluated by the policy engine. A three-data set is a basic conditional unit composed of data type, comparison operators, and data value. Through the organization of the logical expression structure, complex access control policy inputs can be formed. Thus, the system can organize multiple three-data sets into an evaluable logical expression, thereby constituting complete full-text request data. The effect of this step is to transform the original data items into an expression with a logical structure, providing standardized input for subsequent policy matching and access control decisions, and improving the system's expressive capabilities and evaluation efficiency.

[0044] In a specific example, a user attempts to access the operation log of a device on an industrial internet platform. The system has generated three-element data sets: ("String", "==", "Operations Engineer"), ("Integer", ">=", "3"), and ("Datetime", "<", "18:00"), corresponding to the user's role, permission level, and access time, respectively. Based on a preset logical expression structure, the system combines these three-element data sets into the expression: (("String", "==", "Operations Engineer") OR ("Integer", ">=", "3")) AND ("Datetime", "<", "18:00"), and stores this expression as the full-text request data. Ultimately, the system obtains a request data structure with logical judgment capabilities, providing complete and parsable input for subsequent policy evaluation, thereby improving the accuracy and response efficiency of access control.

[0045] Optional, such as Figure 3 The diagram illustrates the process of generating full-text request data based on five dimensions: user attributes, resource attributes, environmental conditions, time, and space. In this embodiment, the system extracts and constructs three-tuple data based on the five dimensions of information involved in the access request, and then combines these three-tuples into a complete full-text request data according to a preset logical expression structure. The combination of three-tuples specifically follows these rules: Each dimension involved has a corresponding triple: User attributes (such as role, identity, authentication method), resource attributes (such as resource type, sensitivity level), environmental conditions (such as device type, network status), time dimension (such as access time, weekday / holiday), and spatial dimension (such as access location, geographical region). Each dimension of information is transformed into one or more three-dimensional data sets, in the format of (attribute type, operator, attribute value); Based on the logical structure defined by the strategy (such as a Boolean expression), all triples are combined into a complete logical expression, which serves as the request for the full text data.

[0046] In this way, we can obtain a full-text request data similar to the following: The expression “(("String","==","Operations Engineer")AND("Integer","<=",2))AND(("String","==","Mobile Terminal")AND("Datetime",">=","08:00")AND("String","==","Factory A Area"))” represents the full text of the request data, indicating that the access request will only satisfy the policy conditions if the user is an operations engineer, the resource sensitivity level is not higher than 2, the user is using a mobile terminal, the time is after 08:00, and the user is located in Factory A Area.

[0047] The above data structure, which uses a combination of triples and logical expressions, has the following scalability advantages: 1. Scalable dimensions: The current structure supports five dimensions: user, resource, environment, time, and space. If new dimensions (such as behavior patterns, history, device status, etc.) need to be introduced in the future, only the corresponding triplet needs to be added, without modifying the overall structure. 2. Conditional scalability: Each dimension can contain multiple attribute items, and each attribute item can generate triples independently. It supports any number of triple combinations to adapt to complex policy requirements. 3. Scalable logical structure: Because it uses Boolean logic expressions (AND, OR, NOT) for combination, it supports nesting and priority control, so it can flexibly build arbitrarily complex strategy expressions and adapt to different strategy engines; 4. Data type extensibility: The data types in the triple (such as String, Integer, Datetime, Boolean) can be extended according to actual needs, and custom types (such as enumerations, structs) are supported to adapt to specific scenarios; 5. Strong system compatibility: The triple structure is compatible with standard formats such as Resource Description Framework (RDF), JavaScript Object Notation (JSON), and eXtensible Markup Language (XML), making it easy to transmit and parse in distributed systems. It can be directly used in modules such as policy evaluation engines, knowledge graphs, and semantic reasoning.

[0048] Specifically, the following is a formal definition of the full-text data of a specific request, provided in accordance with the above principles: For a set of dimensions Each dimension There is a data type It can be text ( Text) data or numerical values ​​( Number ) data, then with Representing dimensions The set of possible values, To indicate an access request, Includes a set of bindings: for each dimension (or at least the dimensions involved in the strategy), Provide a specific value (or null value) null ) ， (Used to indicate that the data is unknown).

[0049] At this point, the following atomic condition can be established: an atomic condition Define a triple as follows: , in : Indicates the dimension to be applied. The type of the operator depends on the type of the operator. : if : ,express When the data is text, It can be "is" or "contains (in)"; if : express When the data is numerical, It can be one of the following: equal to (eq), greater than (gt), less than (lt), greater than or equal to (get), less than or equal to (lte); For one constant values ​​in ( ).

[0050] The evaluation process for atomic conditions is as follows: given a request... , atomic conditions The evaluation results are :if middle value for null ,but (or defined according to security policy) (Simply follow the "default rejection" setting). Otherwise: if : : This indicates that the string needs to be matched exactly in this case; : Contains substrings .

[0051] like : : , : , : , : , : , This allows us to further develop the following composite policy: A strategy If a logical expression is recursively constructed from atomic conditions and logical operators, then it has the following forms of compound strategies: Basic form: any atomic condition It is a strategy ; Recursive form: (Non-): Strategy The negation, (with): Strategy and The "logic AND" (or): Strategy and "Logical OR" Parentheses can also be used. To clarify the priority of operations.

[0052] Evaluate( Given a request ,Strategy Evaluation results According to standard Boolean logic calculations: , , , A further requirement is that the policy satisfaction is met: An access request Satisfaction Strategy If and only if Access is only permitted if the request satisfies all applicable policies (or satisfies the final decision policy according to the conflict resolution rules).

[0053] Step 202: Send the full text of the request data to the access decision-making end; The method shown in this step has been explained in step 102 and will not be repeated here.

[0054] Step 203: Obtain the full text of the request sent from the access execution end, and verify the matching of the formal conditions corresponding to the preset formal format with the full text of the request.

[0055] In some embodiments of this application, to ensure that the structured expression of the access request conforms to the input requirements of policy evaluation, the access decision-making end performs format validation and condition matching checks on the full-text request data received from the access execution end. Specifically, the access decision-making end first obtains the full-text request data sent by the access execution end, then performs structural integrity validation on the data according to a preset formal format, and further checks whether it meets the formal conditions corresponding to the format. A formal format is a structural specification used to uniformly describe the context of an access request, while formal conditions refer to the rules required under this format, such as field completeness, data type consistency, and logical relationship constraints. This validation process ensures that the full-text request data conforms to the input standards of policy evaluation in both semantics and structure, thereby avoiding evaluation failure or misjudgment due to data format errors or missing fields.

[0056] In a specific example, a user attempts to access a device's operation log within an industrial internet platform. This log requires the user to have the role of an "Operations Engineer," and access must be performed when the device's operating status is "normal." Upon receiving the full-text request data, the access decision-making system first verifies whether the data contains necessary fields such as role, device status, and access time, and checks whether the field types conform to preset formats (e.g., role as text, device status as an enumeration). Subsequently, the system logically matches "whether the role is an Operations Engineer" and "whether the device status is normal" based on the atomic conditions defined in the policy. Ultimately, the system ensures that the structure and semantics of the requested data meet the policy evaluation requirements, thereby improving the accuracy of access control and reducing authorization risks caused by format errors or inconsistent conditions.

[0057] Optionally, when the full-text request data is stored in a structure of multiple sub-data items corresponding to the access request according to a preset logical expression, and each sub-data item is one of the execution object information, execution condition information, or execution permission information corresponding to the access request, in order to verify the matching between the formal conditions corresponding to the preset formal format and the full-text request data, step 203 includes the following sub-steps: Sub-step 2031: Compare each sub-data item with the verification information corresponding to the sub-data item to obtain the verification truth value corresponding to each group of sub-data items and verification information.

[0058] In some embodiments of this application, to determine whether the full-text request data meets the preset access control policy conditions, the access decision-making end compares each sub-data item with its corresponding verification information to obtain the verification truth value between each group of sub-data items and the verification information. Specifically, the access decision-making end extracts each sub-data item from the full-text request data. These sub-data items include execution object information, execution condition information, execution permission information, etc., and compares them item by item with the verification information defined in the policy, generating a Boolean type verification result according to preset operation rules. Verification information refers to the condition values ​​or ranges used in the policy to determine the legality of the access request, such as role requirements, time limits, permission level thresholds, etc. The verification truth value is a Boolean value (True or False) indicating whether each comparison result meets the policy conditions. It is used for the truth value merging operation of subsequent logical expressions. By performing logical judgment on a single dimension, the basic unit of policy evaluation is formed. The principle used is to form a triplet with each dimension, an operator, and a constant value for logical operation. In this way, the system can independently verify each sub-data item and generate the corresponding verification truth value, providing basic Boolean input for the subsequent evaluation of policy logic expressions, thereby improving the evaluation accuracy and interpretability of access control policies.

[0059] In a specific example, a user attempts to access a data resource with a sensitivity level of "3" on a data space platform, requesting the sub-data items "user identity level is 2," "access time is 10:30," and "user role is ordinary member." The access decision-making system, based on policy requirements, compares these sub-data items with the verification information "identity level must be higher than data level," "access time must be between 9:00 and 18:00," and "role must be administrator." The system generates a verification truth value for each comparison result: identity level does not meet the condition (False), access time meets the condition (True), and role does not meet the condition (False). In this way, the system obtains the verification truth values ​​between each set of sub-data items and the verification information, providing the foundational data for merging the truth values ​​of subsequent logical expressions, thereby improving the accuracy and logical clarity of policy evaluation.

[0060] Sub-step 2032 involves performing a truth merging operation on the multiple obtained verification truth values ​​according to the logical expression structure of each sub-data item stored in the formal format, in order to obtain the matching result of the requested full-text data.

[0061] In some embodiments of this application, to determine whether the request full-text data as a whole meets the logical requirements of the access control policy, the access decision-making end performs a truth value merging operation on multiple verification truth values ​​obtained in the previous steps according to the logical expression structure stored in the formal format, in order to obtain the matching result of the request full-text data. Specifically, the access decision-making end will take the verification truth value corresponding to each sub-data item as a Boolean input according to the logical expression structure defined by the policy (such as logical operators such as AND, OR, NOT, etc.), and perform combined calculations according to the order of operation and nesting relationship of the expression, finally generating a Boolean result representing the overall matching situation. The logical expression structure is a core component of the Policy Definition Language (PDL), used to describe the logical relationship between multiple atomic conditions, such as "role is administrator or (identity level is higher than data level and access time is within working hours)". The use of this structure enables the system to express complex access control policies and perform automated evaluation through Boolean logic. By combining atomic conditions to form policy expressions, the system can logically merge multiple verification truth values ​​to generate a single overall matching result. Ultimately, the scattered verification results are integrated into a unified policy evaluation output, thereby improving the logical consistency and decision-making efficiency of the access control system.

[0062] In a specific example, a user attempts to access sensitive data resources on a financial risk control platform. The access decision-making end has obtained three truth values: role verification is False, identity level verification is True, and access time verification is True. The policy logic expression is "role is administrator or (identity level is higher than data level and access time is within working hours)". Based on this expression structure, the system performs a truth value merging operation: first, it performs an AND operation between the identity level verification and the access time verification, resulting in True; then, it performs an OR operation between the role verification result and the aforementioned AND operation result, ultimately matching True. Through this process, the system determines that the entire requested data satisfies the policy requirements, thus providing a clear basis for subsequent access authorization.

[0063] Sub-step 2033: If the matching result is represented as a true value, the matching situation is determined to satisfy the matching condition.

[0064] In some embodiments of this application, to finalize the determination of whether an access request meets policy requirements, the access decision-making end determines that the matching condition is met if the matching result is true. Specifically, the access decision-making end determines whether the matching result generated by combining logical expression structures is a Boolean value True. If True, the request full-text data is considered to meet the preset policy conditions, and the matching is considered valid. The matching result is an overall Boolean judgment value composed of multiple verification true values ​​combined through logical operations, used to indicate whether the access request semantically conforms to the authorization rules defined by the policy. This judgment process is the endpoint of the policy evaluation process, determining whether to proceed to the access decision instruction generation stage. In this way, the system can make a final judgment on the request data based on the policy logical expression, thereby deciding whether to authorize access, transforming the logical result of the policy evaluation process into a clear matching judgment, providing a basis for subsequent access control decisions, and improving the system's decision clarity and execution reliability.

[0065] In a specific example, a user attempts to access a traffic data resource on a smart city platform. The access decision-making end has completed the verification, truth value generation, and logical merging operations, resulting in a True match. Based on this, the system determines that the access request meets the policy conditions, meaning the user role, access time, and permission level all comply with authorization requirements. Therefore, the system classifies the match as satisfied and proceeds to the subsequent access decision instruction generation process. In this way, the system completes the policy compliance determination of the access request, ensuring that subsequent authorization actions have a clear logical basis and improving the security and consistency of access control.

[0066] Step 204: If the matching situation meets the preset matching conditions, generate an access decision instruction corresponding to the requested full-text data and send the access decision instruction to the access execution terminal.

[0067] In some embodiments of this application, to achieve dynamic authorization and control of access requests, after the access decision-making end completes the format verification and condition matching of the full-text data of the request, if the matching meets the preset policy conditions, it will generate an access decision instruction corresponding to the request and send the instruction to the access execution end. Specifically, the access decision-making end will logically evaluate the verified full-text data of the request according to the access control policies defined in the policy library. If the evaluation result meets the policy conditions, it will generate an access decision instruction. This instruction is used to clarify the authorization result (such as allowing access or denying access) and may include execution constraints (such as requiring audit logs or secondary authentication). The access decision instruction is a structured control information used to guide the operation behavior of the access execution end on the target access node. This not only realizes the dynamic evaluation of access control policies and the generation of execution instructions, but also enhances the response efficiency and execution consistency of the access control system through the structured transmission mechanism of the instructions.

[0068] In a specific example, a user attempts to access a traffic monitoring data resource on a smart city platform. This resource requires the visitor to be a "traffic management personnel," and the access must be conducted during office hours on a weekday. After verifying the format and matching conditions of the full-text request data, the access decision-making system identifies the user role as a "traffic management personnel," the access time as "10:15," and the current date as a weekday. The system performs a logical evaluation based on the policy expression, determining that the request meets all policy conditions. Therefore, it generates an access decision instruction "Allow Access," with the additional obligation of "Record Access Log." Subsequently, this instruction is sent to the access execution end. Through this execution process, the system achieves real-time authorization of access requests and ensures that access behavior complies with preset policy requirements, thereby improving the accuracy and security of access control.

[0069] Step 205: If the access decision instruction generated by the access decision terminal based on the full-text data of the request is obtained, execute the access decision instruction at the target access node.

[0070] The method shown in this step has been explained in step 103 and will not be repeated here.

[0071] In summary, in this embodiment, by generating full-text request data at the access execution end according to a preset formal format, the access request can express access context information in a structured and standardized manner. This not only improves the expressive power of the access request but also provides a unified data foundation for subsequent policy evaluation. Consequently, the full-text request data can be sent to the access decision-making end, establishing an efficient collaborative channel between the execution and decision-making ends. This allows the access decision-making end to obtain complete access context information in a timely manner, avoiding policy evaluation biases caused by incomplete or inefficient transmission of context information, thereby improving the accuracy and response speed of access control decisions. Then, based on the full-text request data, formal conditions are matched and policies are evaluated, and access decision instructions are generated. Based on the combination logic of multi-dimensional information, this flexibly adapts to the dynamically evolving data states and access needs in the data space, more accurately identifying whether access requests meet preset policy conditions. This effectively reduces the risk of misauthorization or denial, improving system security and compliance. Finally, after receiving the access decision instructions, the access execution end executes the corresponding operation at the target access node, realizing closed-loop execution of the access control policy. This ensures that the policy evaluation results can be applied to actual access behavior in a timely and accurate manner, avoiding the disconnect between policy and execution. Therefore, based on the method of this application embodiment, by establishing a structured and formal data interaction mechanism between the access execution end and the access decision end, dynamic evaluation and efficient execution of access control policies are achieved. This improves the scalability and coordination of the access control system in multiple key aspects. Through the closed-loop process, not only is the execution efficiency of access control improved, but the controllability and traceability of access behavior are also enhanced, effectively improving the scalability and coordination of the access control system in the data space environment. Meanwhile, this solution also enhances the flexibility, precision, and execution efficiency of access control, thereby reducing the risks of data leakage and permission abuse caused by insufficient policy expression capabilities or lagging execution mechanisms, and improving the overall security and stability of the system.

[0072] refer to Figure 4 This application illustrates a multi-dimensional data access control device 30 for data space provided in an embodiment of this application, applied to an access execution end, including: The data integration module 301 is used to generate the full text data of the access request in accordance with a preset formal format in response to the access request to the target access node. Data sending module 302 is used to send the full text of the request data to the access decision terminal; Command execution module 303 is used to execute the access decision instruction at the target access node when it receives the access decision instruction generated by the access decision terminal based on the full-text data of the request.

[0073] Optionally, the data integration module 301 includes: The collection submodule is used to obtain access context data corresponding to the access request based on each first sub-data item recorded in the access request; each first sub-data item is one of the first execution object information, first execution condition information, and first execution permission information recorded in the access request; the access context includes at least one second sub-data item of the access request; each second sub-data item is one of the second execution object information, second execution condition information, and second execution permission information of the access request; The integration submodule is used to integrate the access request and the access context in a formalized format to obtain the full text data of the access request.

[0074] Optional, the integrated submodules include: Atomic data units are used to generate ternary data sets corresponding to each sub-data item in the access request; each ternary data set stores the data type, comparison operator, and data value of each sub-data item in a preset storage order. The composite data unit is used to store all three data sets according to a preset logical expression structure to obtain the requested full-text data.

[0075] refer to Figure 5 This illustrates another multi-dimensional data access control device 40 for data space provided in an embodiment of this application, applied to an access decision-making end, including: The data acquisition module 401 is used to acquire the full text data of the request sent from the access execution end, and verify the matching of the formal conditions corresponding to the preset formal format with the full text data of the request; the full text data of the request is generated by the access execution end according to the formal format based on the access request to the target access node; The command sending module 402 is used to generate an access decision instruction corresponding to the requested full-text data when the matching situation meets the preset matching conditions, and send the access decision instruction to the access execution terminal so that the access execution terminal executes the access decision instruction.

[0076] Optionally, the full-text request data is stored in a structure of multiple sub-data items corresponding to the access request, according to a preset logical expression. Each sub-data item is one of the following: execution object information, execution condition information, or execution permission information corresponding to the access request. The data acquisition module 401 includes: The truth verification submodule is used to compare each sub-data item with and the corresponding verification information of the sub-data item to obtain the verification truth value corresponding to each group of sub-data items and verification information. The truth merging submodule is used to merge multiple verification truth values ​​according to the logical expression structure of each sub-data item stored in the formal format, so as to obtain the matching result of the requested full text data. The condition confirmation submodule is used to determine whether the matching condition is met when the matching result is represented as true.

[0077] In summary, in this embodiment, by generating full-text request data at the access execution end according to a preset formal format, the access request can express access context information in a structured and standardized manner. This not only improves the expressive power of the access request but also provides a unified data foundation for subsequent policy evaluation. Consequently, the full-text request data can be sent to the access decision-making end, establishing an efficient collaborative channel between the execution and decision-making ends. This allows the access decision-making end to obtain complete access context information in a timely manner, avoiding policy evaluation biases caused by incomplete or inefficient transmission of context information, thereby improving the accuracy and response speed of access control decisions. Then, based on the full-text request data, formal conditions are matched and policies are evaluated, and access decision instructions are generated. Based on the combination logic of multi-dimensional information, this flexibly adapts to the dynamically evolving data states and access needs in the data space, more accurately identifying whether access requests meet preset policy conditions. This effectively reduces the risk of misauthorization or denial, improving system security and compliance. Finally, after receiving the access decision instructions, the access execution end executes the corresponding operation at the target access node, realizing closed-loop execution of the access control policy. This ensures that the policy evaluation results can be applied to actual access behavior in a timely and accurate manner, avoiding the disconnect between policy and execution. Therefore, based on the method of this application embodiment, by establishing a structured and formal data interaction mechanism between the access execution end and the access decision end, dynamic evaluation and efficient execution of access control policies are achieved. This improves the scalability and coordination of the access control system in multiple key aspects. Through the closed-loop process, not only is the execution efficiency of access control improved, but the controllability and traceability of access behavior are also enhanced, effectively improving the scalability and coordination of the access control system in the data space environment. Meanwhile, this solution also enhances the flexibility, precision, and execution efficiency of access control, thereby reducing the risks of data leakage and permission abuse caused by insufficient policy expression capabilities or lagging execution mechanisms, and improving the overall security and stability of the system.

[0078] Reference Figure 6 The electronic device 500 may include one or more of the following components: processing component 502, memory 504, power supply component 506, multimedia component 508, audio component 510, input / output (I / O) interface 512, sensor component 514, and communication component 516.

[0079] Processing component 502 typically controls the overall operation of electronic device 500, such as operations associated with display, telephone calls, data communication, camera operation, and recording. Processing component 502 may include one or more processors 520 to execute instructions to perform all or part of the steps of the methods described above. Furthermore, processing component 502 may include one or more modules to facilitate interaction between processing component 502 and other components. For example, processing component 502 may include a multimedia module to facilitate interaction between multimedia component 508 and processing component 502.

[0080] Memory 504 is used to store various types of data to support the operation of electronic device 500. Examples of this data include instructions for any application or method operating on electronic device 500, contact data, phonebook data, messages, pictures, multimedia, etc. Memory 504 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0081] Power supply component 506 provides power to various components of electronic device 500. Power supply component 506 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to electronic device 500.

[0082] Multimedia component 508 includes an interface that provides an output interface between electronic device 500 and user. In some embodiments, the interface may include a liquid crystal display (LCD) and a touch panel (TP). If the interface includes a touch panel, the interface may be implemented as a touchscreen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors may not only sense the boundaries of touch or swipe actions but also detect the duration and pressure associated with the touch or swipe operation. In some embodiments, multimedia component 508 includes a front-facing camera and / or a rear-facing camera. When electronic device 500 is in an operating mode, such as shooting mode or multimedia mode, the front-facing camera and / or rear-facing camera may receive external multimedia data. Each front-facing camera and rear-facing camera may be a fixed optical lens system or have focal length and optical zoom capabilities.

[0083] Audio component 510 is used to output and / or input audio signals. For example, audio component 510 includes a microphone (MIC) used to receive external audio signals when electronic device 500 is in an operating mode, such as call mode, recording mode, and voice recognition mode. The received audio signals may be further stored in memory 504 or transmitted via communication component 516. In some embodiments, audio component 510 also includes a speaker for outputting audio signals.

[0084] Input / output (I / O) interface 512 provides an interface between processing component 502 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include, but are not limited to, home buttons, volume buttons, power buttons, and lock buttons.

[0085] Sensor assembly 514 includes one or more sensors for providing state assessments of various aspects of electronic device 500. For example, sensor assembly 514 may detect the on / off state of electronic device 500, the relative positioning of components such as the display and keypad of electronic device 500, changes in position of electronic device 500 or a component of electronic device 500, the presence or absence of user contact with electronic device 500, orientation or acceleration / deceleration of electronic device 500, and temperature changes of electronic device 500. Sensor assembly 514 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. Sensor assembly 514 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, sensor assembly 514 may also include an accelerometer, gyroscope, magnetometer, pressure sensor, or temperature sensor.

[0086] Communication component 516 facilitates wired or wireless communication between electronic device 500 and other devices. Electronic device 500 can access wireless networks based on communication standards, such as WiFi, carrier networks (such as 2G, 3G, 4G, or 5G), or combinations thereof. In one exemplary embodiment, communication component 516 receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, communication component 516 also includes a near-field communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on radio frequency identification (RFID) technology, Infrared Data Association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

[0087] In an exemplary embodiment, the electronic device 500 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to implement the methods provided in the embodiments of this application.

[0088] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 504 including instructions, which can be executed by a processor 520 of an electronic device 500 to perform the above-described method. For example, the non-transitory storage medium may be a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc.

[0089] In an exemplary embodiment, the electronic device 500 may also be provided as a server, including a processing component 502, which further includes one or more processors, and memory resources represented by memory 504 for storing instructions, such as applications, that can be executed by the processing component 502. The applications stored in memory 504 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 502 is configured to execute instructions to perform the methods provided in the embodiments of this application.

[0090] Electronic device 500 may also include a power supply component 506 configured to perform power management of electronic device 500, a wired or wireless communication component 516 configured to connect electronic device 500 to a network, and an input / output (I / O) interface 512. Electronic device 500 may operate on an operating system stored in memory 504, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, or similar.

[0091] This application also provides a computer program product, including a computer program, which, when executed by a processor, implements a multi-dimensional data access control method oriented towards a data space.

[0092] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the application disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0093] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

[0094] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0095] It will be readily apparent to those skilled in the art that any combination of the above embodiments is feasible. Therefore, any combination of the above embodiments is an implementation scheme of this application. However, due to space limitations, this specification will not describe them in detail here.

[0096] The multi-dimensional data access control method for data space provided herein is not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used in conjunction with the teachings herein. Based on the above description, the required structure for constructing a system with the scheme of this application is obvious. Furthermore, this application is not directed to any particular programming language. It should be understood that the content of this application described herein can be implemented using various programming languages, and the above description of specific languages ​​is for the purpose of disclosing the best implementation of this application.

[0097] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of this application may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0098] Similarly, it should be understood that, for the purpose of simplification and aiding understanding of one or more aspects of the application, various features of the application are sometimes grouped together in a single embodiment, figure, or description thereof in the above description of exemplary embodiments of the application. However, this approach of disclosure should not be construed as reflecting an intention that the claimed application requires more features than expressly recited in each claim. Rather, as reflected in the claims, the application aspect comprises fewer features than all of the features of the single foregoing disclosed embodiment. Therefore, the claims following the detailed description are hereby expressly incorporated into that detailed description, wherein each claim itself is a separate embodiment of the application.

[0099] Those skilled in the art will understand that modules in the device of the embodiments can be adaptively changed and placed in one or more devices different from that embodiment. Modules, units, or components in the embodiments can be combined into a single module, unit, or component, and further, they can be divided into multiple sub-modules, sub-units, or sub-components. Except where at least some of such features and / or processes or units are mutually exclusive, any combination can be used to combine all features disclosed in this specification (including the accompanying claims, abstract, and drawings) and all processes or units of any method or device so disclosed. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstract, and drawings) may be replaced by an alternative feature that serves the same, equivalent, or similar purpose.

[0100] Furthermore, those skilled in the art will understand that although some embodiments described herein include certain features but not others included in other embodiments, combinations of features from different embodiments are intended to be within the scope of this application and form different embodiments. For example, in the claims, any one of the claimed embodiments can be used in any combination.

[0101] The various component embodiments of this application can be implemented in hardware, or as software modules running on one or more processors, or a combination thereof. Those skilled in the art will understand that microprocessors or digital signal processors (DSPs) can be used in practice to implement some or all of the functions of some or all of the components in the multi-dimensional data access control method for data space according to the embodiments of this application. This application can also be implemented as a device or apparatus program (e.g., a computer program and computer program product) for performing part or all of the methods described herein. Such an implementation of this application can be stored on a computer-readable medium, or can take the form of one or more signals. Such signals can be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

[0102] In another embodiment of the present invention, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute the multi-dimensional data access control method for data space oriented according to the embodiments of the present application.

[0103] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid state disk (SSD)).

[0104] It should be noted that the above embodiments are illustrative of this application and not restrictive, and that those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. This application can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names.

[0105] It should be noted that, for the sake of simplicity, the method embodiments of this application are all described as a series of actions. However, those skilled in the art should understand that the embodiments of this application are not limited to the described order of actions, because according to the embodiments of this application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily essential to the embodiments of this application.

[0106] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for embodiments of systems or devices, since they are basically similar to the method embodiments, the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0107] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of protection of the present invention.

Claims

1. A multi-dimensional data access control method for data space, characterized in that, Applied to the execution end, including: In response to an access request to a target access node, the full text data of the access request is generated according to a preset formal format. Send the full text of the request to the access decision-making terminal; Upon receiving an access decision instruction generated by the access decision-making terminal based on the full-text data of the request, the access decision instruction is executed at the target access node.

2. The multi-dimensional data access control method for data space as described in claim 1, characterized in that, The step of generating the full-text data of the access request according to a preset formal format includes: Based on each first sub-data item recorded in the access request, access context data corresponding to the access request is obtained; each first sub-data item is one of the first execution object information, first execution condition information, and first execution permission information recorded in the access request; the access context includes at least one second sub-data item of the access request; each second sub-data item is one of the second execution object information, second execution condition information, and second execution permission information of the access request; The access request and the access context are integrated according to the formal format to obtain the full text data of the access request.

3. The multi-dimensional data access control method for data space as described in claim 2, characterized in that, The step of integrating the access request with the access context according to the formalized format to obtain the full-text data of the access request includes: Generate a three-data set corresponding to each sub-data item of the access request; each three-data set stores the data type, comparison operator, and data value of each sub-data item in a preset storage order; All the three data sets are stored according to a preset logical expression structure to obtain the full text of the request data.

4. A multi-dimensional data access control method for data space, characterized in that, Applied to the access decision-making end, including: The full text of the request sent from the access execution terminal is obtained, and the matching between the formal conditions corresponding to the preset formal format and the full text of the request is verified; the full text of the request is generated by the access execution terminal according to the formal format based on the access request to the target access node. If the matching condition satisfies the preset matching criteria, an access decision instruction corresponding to the requested full-text data is generated, and the access decision instruction is sent to the access execution terminal so that the access execution terminal executes the access decision instruction.

5. The multi-dimensional data access control method for data space as described in claim 4, characterized in that, The full-text request data is stored in a structure of multiple sub-data items corresponding to the access request, according to a preset logical expression. Each sub-data item is one of the following: execution object information, execution condition information, or execution permission information corresponding to the access request. The verification of the matching between the formal conditions corresponding to the preset formal format and the full-text request data includes: Each sub-data item is compared with the verification information corresponding to the sub-data item to obtain the verification truth value corresponding to each group of sub-data items and verification information. According to the logical expression structure of each of the sub-data items stored in the formal format, a truth value merging operation is performed on the obtained multiple verification truth values ​​to obtain the matching result of the request full-text data; If the matching result is represented as a true value, the matching situation is determined to satisfy the matching condition.

6. A multi-dimensional data access control device for data space, characterized in that, Applied to the execution end, including: The data integration module is used to generate the full-text data of the access request in accordance with a preset formal format in response to the access request to the target access node. The data sending module is used to send the full text of the request data to the access decision terminal; The command execution module is used to execute the access decision instruction at the target access node when the access decision terminal generates the access decision instruction based on the full-text data of the request.

7. A multi-dimensional data access control device for data space, characterized in that, Applied to the access decision-making end, including: The data acquisition module is used to acquire the full-text data of the request sent from the access execution terminal, and verify the matching of the formal conditions corresponding to the preset formal format with the full-text data of the request; the full-text data of the request is generated by the access execution terminal according to the formal format based on the access request to the target access node; The command sending module is used to generate an access decision instruction corresponding to the requested full-text data when the matching situation meets the preset matching conditions, and send the access decision instruction to the access execution terminal so that the access execution terminal executes the access decision instruction.

8. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium, and when executed by a processor, the computer program implements the multi-dimensional data access control method for data space as described in any one of claims 1 to 5.

9. An electronic device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the multi-dimensional data access control method for data space as described in any one of claims 1 to 5.

10. A computer program product, characterized in that, The computer program product stores a computer program, which, when executed by a processor, implements the steps of the multi-dimensional data access control method for data space as described in any one of claims 1 to 5.

Images