Fine-grained data access control strategy intelligent generation method, equipment and medium

Abstract

The invention discloses an intelligent generation method and device for a fine-grained data access control strategy and a medium, and belongs to the technical field of data security and artificial intelligence. S2, data processing; s3, generating strategy parameters, acquiring an initial data set required by clustering by utilizing the stored user information and the access log, and acquiring required strategy parameters by combining a DAC (Digital-to-Analog Converter) algorithm; s4, storing strategy parameters; s5, constructing a strategy mechanism; and S6, strategy use: calling the strategy through the strategy decision point, obtaining related parameters in the knowledge graph, returning an access request result to the strategy implementation point, performing access control operation by the strategy implementation point according to the result, providing data if passing, recording an alarm log while providing data if giving an alarm, and refusing access if blocking. And generating an alarm log. According to the invention, intelligent generation of the data security access control strategy is realized.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of data security and artificial intelligence, and particularly relates to a fine-grained data access control policy intelligent generation method, device and medium. BACKGROUND

[0002] With the intensification of digital transformation and the rapid rise of data-driven economy, data has become an important asset that organizations and individuals cannot ignore as a production factor. However, in recent years, the rapid development of the data market has led to frequent data security incidents, such as data leakage, data misuse, and other problems, and data security issues need more attention.

[0003] Data security access control is a set of technical and policy mechanisms used to ensure that only authorized users, systems or devices can access, operate or transmit data under certain conditions. Its core goal is to limit illegal access to sensitive data through permission management and identity verification, preventing data leakage, tampering or misuse. Access control policies, based on organizational security needs, are designed through systematic rules and mechanisms to clearly define user, device or system access to resources to protect sensitive data and critical systems. The formulation of fine-grained data security access control policies now faces many difficulties: 1) Lack of dynamic environment adaptability, traditional data security access control policies cannot automatically adjust to personnel changes, project replacements, external environment changes and other problems, requiring a lot of time and effort to modify the policy.

[0004] 2) Difficulty in fine-grained management of data security access control policies, with a large number of users, multiple access objects and complex access rules, making it difficult to find and maintain rules.

[0005] 3) There are problems of permission abuse and audit difficulty, with an increase in errors and omissions under complex rules, an increase in the probability of permission abuse, and difficulty in implementing audits on a large number of access log data Based on the above analysis, there is a growing demand for an intelligent, automated and easy-to-manage fine-grained data security access control policy generation method to address the high cost of manual time, management difficulties, and the difficulty of balancing security and efficiency. SUMMARY

[0006] The purpose of the present application is to overcome the problems of the prior art and disclose a fine-grained data access control policy intelligent generation method, device and medium. The method is based on an unsupervised clustering algorithm and a knowledge graph generation method to achieve intelligent generation of data security access control policies.

[0007] In one aspect, the purpose of the present application is achieved by the following technical solutions: A fine-grained data access control strategy intelligent generation method, the fine-grained data access control strategy intelligent generation method comprises: S1: data acquisition, collecting log records of user access to corresponding access objects within a preset time, and acquiring a basic information table of the user; S2: data processing, completing data cleaning, data conversion, data standardization and weight allocation processing of the data collected in S1; S3: strategy parameter generation, using stored user information and access logs to obtain an initial data set required for clustering, and then combining a DAC algorithm to obtain required strategy parameters, including cluster center, maximum cluster radius, cluster alarm radius and required dimension; S4: strategy parameter storage, realizing parameter storage using a knowledge graph, and recording cluster center, maximum radius and alarm radius to form a knowledge graph; S5: strategy mechanism construction, constructing a "pass-alarm-block" three-level access control mechanism, "pass" means that the current request is reasonable and can directly access the data object; "alarm" means that the current request may be risky, and the data object can be accessed, but an alarm log is also generated, and the administrator can determine whether there is abnormal behavior through the alarm log; "block" means that the current request has a greater risk, and the access request is rejected, and an alarm log is generated, and if this access is a special case, access permission can be obtained by applying to the administrator; The strategy decision process comprises: realizing access control using an attribute-based access control method, according to the values of data attributes, environment attributes and subject attributes provided by the strategy information point, processing the corresponding attribute values according to the strategy by the strategy decision point; and using the processed data to calculate the distance from the current access request to each cluster center in turn, and comparing it with the corresponding maximum radius and alarm radius to obtain the "pass-alarm-block" access request result, and then returning the access request result; S6: strategy use, calling the strategy through the strategy decision point, obtaining related parameters in the knowledge graph, returning the access request result to the strategy implementation point, and then performing access control operation according to the result by the strategy implementation point, if "pass", providing data, if "alarm", providing data while recording alarm log, if "block", rejecting access and generating alarm log.

[0008] According to a preferred embodiment, in step S2, the data cleaning process comprises: filling in missing values in the basic information table, filling in null for character type, and filling in average value for numerical type; The data conversion process comprises: processing of character type data, if the data is unstructured data, extracting valid values through regular expressions, if it is structured data, using one-hot encoding for processing; Data standardization, using Z-Score standardization to scale the data to a standard normal distribution range, so that the mean is 0 and the standard deviation is 1; Weight assignment, assigning weights to the processed data according to the corresponding rules.

[0009] According to a preferred embodiment, in step S3, the cluster maximum radius and the cluster alarm radius are used to determine the pass zone, the alarm zone and the block zone of the corresponding cluster; The cluster center is used to determine the cluster center of each class. During the access process, the required dimensions are determined according to the obtained attributes, and according to the distance between the obtained attributes and the cluster center, whether it is located in the pass zone, the alarm zone or the block zone, the result of the access request is judged.

[0010] According to a preferred embodiment, in step S3, the DAC clusters the input data set after data processing to obtain the cluster center, the alarm radius, the maximum radius and the required dimension parameter; wherein the DAC algorithm includes two sub-protocols, which are attribute clustering protocol DAC_S1 and clustering optimization protocol DAC_S2.

[0011] According to a preferred embodiment, in step S3, the DAC algorithm implementation process includes: Attribute clustering protocol DAC_S1, based on K-means++ algorithm for data set processed by S2 Clustering processing is performed to obtain the cluster center of the data set , contour coefficient and clustering cluster .

[0012] According to a preferred embodiment, in step S3, the DAC algorithm implementation process further includes: Clustering optimization protocol DAC_S2, according to the contour coefficient in the clustering result, respectively, the number of clustering clusters and the dimension of clustering clusters are iteratively optimized until the value of the contour coefficient meets the requirements or reaches the maximum iteration number, to obtain the cluster center , the maximum cluster radius , the cluster alarm radius and the required dimension .

[0013] According to a preferred embodiment, step S4 includes: generating an access object node, storing the required attribute dimension of the access object in the node; generating a cluster center node, storing the cluster center corresponding to the cluster, the maximum cluster radius and the alarm cluster radius in the node; generating a node association, connecting the access object node with its corresponding cluster center node, so as to facilitate subsequent query.

[0014] According to a preferred embodiment, step S6 comprises: 1) policy calling, calling the corresponding access control policy through the policy decision point, and obtaining relevant parameter information from the knowledge graph; 2) obtaining information, calling the relevant attribute data information of the access user and the access environment according to the required attributes in the access object node in the knowledge graph; 3) data processing and calculation, using the S2 corresponding method to process the obtained attribute data information, and sequentially calculating the distance between the processed data and the cluster center stored in each cluster node; 4) generating an access request result, sequentially comparing the distance in each cluster with the alarm radius and the maximum cluster radius size stored in the cluster node, and determining the result of the access request as one of "pass-alarm-block" according to the size relationship; 5) executing the request result, returning the access request result to the policy enforcement point, and implementing control according to the result by the enforcement point.

[0015] On the other hand, the present application also discloses: An electronic device, comprising: at least one processor; and a memory connected in communication with the at least one processor; Wherein, the memory stores instructions executable by the at least one processor, and the at least one processor executes the foregoing method by executing the instructions stored in the memory.

[0016] On the other hand, the present application also discloses: A computer readable storage medium for storing instructions, when the instructions are executed, the foregoing method is realized.

[0017] The foregoing main scheme of the present application and each further selected scheme can be freely combined to form multiple schemes, all of which are the schemes that can be used and claimed by the present application. Those skilled in the art can understand that there are many combinations according to the prior art and common knowledge after understanding the schemes of the present application, all of which are the technical schemes claimed by the present application, and are not exhausted here.

[0018] The beneficial effects of the present application are: The present application realizes a cluster-based access control policy generation method, which can realize the automatic generation of the access control policy by dynamic attribute clustering using the access log data, improves the automation degree and generation efficiency of the policy generation, and reduces the labor cost, aiming at the problem that the traditional data security attribute-based access control policy needs to edit a large number of rules, consumes a lot of time and energy, and the accuracy is difficult to guarantee.

[0019] The application aims at the problems of general clustering methods in multi-attribute, high-dimensional data sets, such as difficulty in accurate clustering, non-obvious difference between clustering clusters, and too many clustering clusters, and proposes a dynamic attribute clustering algorithm, which uses high-dimensional data sets to realize effective clustering in high-dimensional data sets through dimension optimization iteration, and solves the problem of poor clustering effect in high-dimensional data. The application proposes to store strategy related parameters based on a graph database and a knowledge graph, use the node association and fast query capability of the knowledge graph, reduce access response time, and effectively improve user access experience, aiming at the problem that the response time is significantly improved with the increase of the policy amount in the traditional call access control strategy process.

[0020] The application designs a three-level access control mechanism of "pass-alarm-block" based on DAC to better meet the fine-grained access control of data, flexibly adjust the policy parameters, and improve the adaptability to different scenarios, aiming at the problem that the traditional access control strategy lacks sufficient fine-grained control and flexibility. BRIEF DESCRIPTION OF DRAWINGS

[0021] Figure 1 The application proposes to store strategy related parameters based on a graph database and a knowledge graph, use the node association and fast query capability of the knowledge graph, reduce access response time, and effectively improve user access experience, aiming at the problem that the response time is significantly improved with the increase of the policy amount in the traditional call access control strategy process. Figure 2 The application proposes to store strategy related parameters based on a graph database and a knowledge graph, use the node association and fast query capability of the knowledge graph, reduce access response time, and effectively improve user access experience, aiming at the problem that the response time is significantly improved with the increase of the policy amount in the traditional call access control strategy process. Figure 3 The application proposes to store strategy related parameters based on a graph database and a knowledge graph, use the node association and fast query capability of the knowledge graph, reduce access response time, and effectively improve user access experience, aiming at the problem that the response time is significantly improved with the increase of the policy amount in the traditional call access control strategy process. Figure 4 The application proposes to store strategy related parameters based on a graph database and a knowledge graph, use the node association and fast query capability of the knowledge graph, reduce access response time, and effectively improve user access experience, aiming at the problem that the response time is significantly improved with the increase of the policy amount in the traditional call access control strategy process. Figure 5 The application proposes to store strategy related parameters based on a graph database and a knowledge graph, use the node association and fast query capability of the knowledge graph, reduce access response time, and effectively improve user access experience, aiming at the problem that the response time is significantly improved with the increase of the policy amount in the traditional call access control strategy process. Figure 6 The application proposes to store strategy related parameters based on a graph database and a knowledge graph, use the node association and fast query capability of the knowledge graph, reduce access response time, and effectively improve user access experience, aiming at the problem that the response time is significantly improved with the increase of the policy amount in the traditional call access control strategy process. DETAILED DESCRIPTION

[0022] The application can be implemented or applied by different specific embodiments, and the details in the specification can be modified or changed based on different views and applications without departing from the spirit of the application. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0023] Embodiment 1 Reference Figures 1 to 5 A fine-grained data access control strategy intelligent generation method is shown in the figure, which includes the following steps.

[0024] Step S1: data acquisition, collect the log records of user accessing the corresponding access object within a preset time, and acquire the basic information table of the user.

[0025] Step S2: data processing, complete the data cleaning, data conversion, data standardization and weight allocation processing of the data collected in S1.

[0026] Preferably, in step S2, the data cleaning process includes: filling in the missing values in the basic information table, filling in the character type as null, and filling in the numerical type as the average value.

[0027] The data conversion process includes: processing of character type data, if the data is unstructured data, the valid value is extracted through regular expression, if it is structured data, it is processed using one-hot encoding; processing of special data such as IP address, timestamp, etc. The specific conversion rules can be set according to the actual demand and data characteristics.

[0028] Data standardization, using Z-Score standardization to scale the data to a standard normal distribution range, so that the mean is 0 and the standard deviation is 1.

[0029] Weight allocation, the processed data is allocated weights according to the corresponding rules.

[0030] Step S3: strategy parameter generation, using the stored user information and access log, obtaining the initial data set required for clustering, and combining with the DAC algorithm to obtain the required strategy parameters, including: class cluster center, class cluster maximum radius, class cluster alarm radius and required dimension.

[0031] Preferably, in step S3, the class cluster maximum radius and the class cluster alarm radius are used to determine the pass zone, the alarm zone and the block zone of the corresponding class cluster; the class cluster center is used to determine the class cluster center of each class, and in the access process, the attributes required are determined according to the required dimension, and the distance between the obtained attributes and each class cluster center is located in the pass zone, the alarm zone or the block zone, to determine the result of the access request.

[0032] Preferably, in step S3, DAC clusters the data set after data processing to obtain the class cluster center, the alarm radius, the maximum radius and the required dimension parameters; wherein the DAC algorithm includes two sub-protocols, which are attribute clustering protocol DAC_S1 and clustering optimization protocol DAC_S2.

[0033] Further, in step S3, the DAC algorithm implementation process includes: attribute clustering protocol DAC_S1, based on K-means++ algorithm, the data set after S2 data processing is clustered to obtain the class cluster center , the contour coefficient and clustering clusters . A clustering optimization protocol DAC_S2, according to the silhouette coefficient in the clustering result , respectively, iteratively optimizes the number of clustering clusters and the dimension of the clustering cluster, until the value of the silhouette coefficient meets the requirement or reaches the maximum number of iterations, to obtain the cluster center , the maximum cluster radius , the cluster alarm radius and the required dimension .

[0034] Specifically, the attribute clustering protocol DAC_S1 implementation process includes: Input: data set , number of clusters ; Output: cluster center , silhouette coefficient , clustering cluster ; 1. Data processing: According to step S2, the data set is processed to obtain .

[0035] 2. Initialize cluster center: ① Randomly select a row of data from as the first initial cluster center , and calculate the shortest distance of the remaining row data to the selected cluster center for each subsequent cluster center ; ② Select a new cluster center according to the probability distribution ; 3. Update cluster center: ① For each , assign it to the cluster corresponding to the nearest cluster center ; ② For each cluster , recalculate the cluster center

[0036] ③ Repeat the above steps until the centroid change tends to 0 4. Calculate the silhouette coefficient: Calculate , , which represents the average distance of the sample from other samples in the same cluster, is the average distance of the sample from other cluster samples, and then calculate the silhouette coefficient .

[0037] The clustering optimization protocol DAC_S2 implements the following procedure: Input: dataset , maximum iteration number , maximum cluster number ; Output: cluster center , cluster maximum radius , cluster alert radius , required dimension ; 1. Initialize cluster number .

[0038] 2. Clustering: Input and into attribute clustering protocol DAC_S1 to get cluster center , silhouette coefficient and all clustering clusters ; 3. Cluster number iteration ① If and , then , repeat steps 2 and 3; ② If and , end iteration, let the result be , and output ; ③ If , end iteration, let the result be , and output , , and .

[0039] 4. Dimension iteration ① Initialize iteration number

[0040] ② Let delete the dimension of the first column to get multiple datasets , respectively input , repeat steps 1-3, record all outputs generated by these datasets, and generate result set

[0041] If at least one value in is 1, compare all corresponding , take the value corresponding to the minimum and .​ , execute step 5; - if all values in are 0 and , take the corresponding to the maximum value, , repeat ②; - if all values in are 0 and

[0042] , it indicates that the clustering effect is not ideal, and the data space cannot generate an effective access control policy using clustering, and the algorithm ends. 5. Output results remove the dimensions deleted by the algorithm, and determine the dimensions required by the method . For a class , calculate the distance of each sample to the class cluster center , sort to get , the maximum radius , and the alarm radius , , and .

[0043] Step S4: policy parameter storage, realize parameter storage using a knowledge graph, record the cluster center, maximum radius, and alarm radius to form a knowledge graph.

[0044] Preferably, step S4 includes: generating an access object node, storing the attribute dimensions required by the access object in the node; generating a class cluster center node, storing the class cluster center corresponding to the class cluster, the maximum class cluster radius, and the alarm class cluster radius in the node; and generating a node association, connecting the access object node and the class cluster center node corresponding thereto, for subsequent query.

[0045] Step S5: policy mechanism construction, construct a "pass-alarm-block" three-level access control mechanism, "pass" means that this request is reasonable, and the data object can be directly accessed; "alarm" means that this request may be risky, and the data object can be accessed, but an alarm log is generated at the same time, and the administrator can judge whether there is abnormal behavior through the alarm log; "block" means that this request has a greater risk, and the access request is rejected, and an alarm log is generated, and if this access is a special case and access permission is needed, the administrator can be applied to obtain the permission and then access.

[0046] The policy decision process comprises: implementing access control by using an attribute-based access control method, according to the values of data attributes, environment attributes and subject attributes provided by the policy information point, performing data processing on the corresponding attribute values by the policy decision point according to the policy; and sequentially calculating the distance from the current access request to each cluster center, and comparing the processed data with the corresponding maximum radius and alarm radius to obtain the access request result of “pass-alarm-block”, and then returning the access request result.

[0047] Step S6: policy use, calling the policy by the policy decision point, obtaining relevant parameters in the knowledge graph, returning the access request result to the policy implementation point, and performing access control operation according to the result by the policy implementation point, if “pass”, providing data, if “alarm”, providing data while recording alarm logs, if “block”, rejecting access, and generating alarm logs.

[0048] Preferably, step S6 comprises: 1) policy calling, calling the corresponding access control policy by the policy decision point, and obtaining relevant parameter information from the knowledge graph; 2) obtaining information, calling relevant attribute data information of the access user and the access environment according to the required attributes in the access object node in the knowledge graph; 3) data processing and calculation, performing data processing on the obtained attribute data information by using the corresponding method in S2, and sequentially calculating the distance between the processed data and the cluster center stored in each clustering cluster node; 4) generating an access request result, comparing the distance in each cluster with the alarm radius and the maximum cluster radius stored in the cluster node in size, and determining the result of the access request as one of “pass-alarm-block” according to the size relationship; 5) executing the request result, returning the access request result to the policy implementation point, and performing control according to the result by the implementation point.

[0049] Application case The application will be further described in detail below in combination with a specific application case. It is assumed that there are access log data for a certain access object for nearly half a year, and relevant information of the user performing access has been obtained. Now it is needed to further analyze these log data and user information, obtain relevant parameters of the access control policy, store them by using the knowledge graph technology, and then use these parameters to construct a three-level access control mechanism of “pass-alarm-block” to realize the intelligent and automatic access control policy generation method of the application. The implementation steps are shown in the accompanying Figure 4

[0050] 1. The data processing method implementation process comprises: ​Data acquisition, read the access log data of the platform where the data object is located, combine user information and convert it into a DataFrame two-dimensional table format.

[0051] Data cleaning, de-duplication, and outlier removal operations are performed on the DataFrame. Then, null values and character data are filled with null, and numerical data is filled with the average value of the column.

[0052] Data conversion, processing of character data. If the data is unstructured, extract the valid value using regular expressions. If it is structured data, use label encoding or one-hot encoding based on whether there is a sequential relationship. For IP address fields, divide the IP address into four parts IP1, IP2, IP3, IP4 based on the "." character, and convert each part to a numerical type. Assign a weight to each part. For access time fields, add a new field based on whether the timestamp is during working hours.

[0053] Data standardization, process the converted data using the Z-Score standardization method to scale the data to a standard normal distribution range with a mean of 0 and a standard deviation of 1.

[0054] Weight assignment, divide the original field into n new fields and assign a weight of 1 / n to each new field. The IP address field weight needs to be adjusted separately.

[0055] 2. The implementation process of the dynamic attribute clustering algorithm includes: Initialization of cluster centers, randomly select a row of data as the first initial cluster center in the processed data, calculate the distance of the remaining rows of data to the initial cluster center, and then select a new cluster center based on the probability distribution.

[0056] Update cluster centers and calculate the silhouette coefficient. For each row of data, assign it to the nearest cluster center corresponding to the clustering cluster, then recalculate the cluster center and record the distance change between the new cluster center and the previous cluster center. Repeat the above operations until the distance change is less than or equal to 10-5, and calculate the silhouette coefficient.

[0057] Cluster number iteration, the cluster number starts from 2 and iterates sequentially, calculates the corresponding silhouette coefficient when the cluster number is different, until the silhouette coefficient is greater than 0.9 or the cluster number is greater than or equal to the maximum cluster number.

[0058] Dimension iteration optimization, when the cluster number iteration exceeds the maximum cluster number, delete the first dimension and repeat the cluster number iteration and calculate the silhouette coefficient. If the silhouette coefficient is still not greater than 0.9, restore the dimension, calculate the next dimension, until the silhouette coefficient is greater than 0.9 or the iteration reaches the maximum value.

[0059] Calculate the maximum radius and the alarm radius, and calculate the distance from the sample point in each cluster to the cluster center in turn. Sort the distances from small to large, and the maximum distance is the maximum radius of the cluster, and the last 90% distance is the alarm radius.

[0060] Output the results, remove the dimensions removed by the algorithm, and obtain the required dimensions of the access object. Output all cluster centers, maximum radius, alarm radius, and required dimensions as strategy parameters.

[0061] 3. The implementation process of the knowledge graph storage method includes: Strategy parameter acquisition, generate strategy parameters according to the DAC algorithm described above, and collect these parameters.

[0062] Construct the access object node, create the access object node in the neo4j graph database, and record the required dimensions of the access object in the node.

[0063] Construct the clustering cluster node, create the nodes of all clusters in the neo4j graph database in turn, and store the cluster center, maximum radius and alarm radius of the cluster in the node.

[0064] Construct the connection relationship between the access object node and the clustering cluster, and point from the access object node to all clustering cluster nodes in the graph database. The result is shown in Figure 5 .

[0065] 4. The implementation process of the three-level access control mechanism includes: Strategy call, obtain the required parameters of the strategy in the knowledge graph, determine the required access information according to the required dimensions of the access object, and obtain the corresponding attribute information in the data attribute, subject attribute and environment attribute.

[0066] Data processing and calculation, perform data processing on the obtained attribute data information according to step S2, and calculate the distance d_i between the processed data and the cluster center stored in each clustering cluster node.

[0067] Generate access request results, compare d_i with the alarm radius and the maximum cluster radius stored in the i-th clustering cluster node in turn, if d_i is less than the alarm radius, return the result "pass"; if d_i is greater than the alarm radius and less than the maximum cluster radius, return the result "alarm but pass"; if d_i is greater than the maximum cluster radius, return the result "alarm and block".

[0068] Result execution, perform access control according to the returned result by the strategy implementation point.

[0069] The application aims at the problems of traditional data security attribute-based access control strategy, which needs to edit a large number of rules, consumes a lot of time and effort, and the accuracy is difficult to guarantee, and realizes a clustering-based access control strategy generation method, which can realize the automatic generation of access control strategy through dynamic attribute clustering by using access log data, improves the automation degree and generation efficiency of the strategy generation, and reduces the labor cost.

[0070] The application aims at the problems of general clustering method in multi-attribute, high-dimensional data set, such as difficulty in accurate clustering, non-obvious difference between clustering clusters, and too many clustering clusters, and proposes a dynamic attribute clustering algorithm, which realizes effective clustering in high-dimensional data set through dimension optimization iteration, and solves the problem of poor clustering effect in high-dimensional data. The application aims at the problem that in the process of traditional calling access control strategy, with the increase of strategy amount, the response time is obviously improved, and proposes to store strategy related parameters based on graph database and knowledge graph, utilize the node association and fast query ability of knowledge graph, reduce access response time, and effectively improve the access experience of users.

[0071] The application aims at the problem that traditional access control strategy lacks sufficient fine-grained control and flexibility, designs a three-level access control mechanism of "pass-alarm-block" based on DAC, better meets the fine-grained access control of data, can flexibly adjust strategy parameters, and improves the adaptability to different scenes.

[0072] Embodiment 2 As Figure 6 In the embodiment 1, the embodiment also discloses an electronic device, which comprises at least one processor and a memory connected with the at least one processor in communication; the specific connection medium between the processor and the memory is not limited in the embodiment.

[0073] Figure 6 The connection between the processor and the memory is taken as an example of connection through a bus. The bus is used to connect various parts of the computer system and is used to transmit information between the parts. Figure 6 The connection between the processor and the memory is taken as an example of connection through a bus. The bus is used to connect various parts of the computer system and is used to transmit information between the parts. Figure 6 Only one thick line is used to represent the connection between the processor and the memory, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor can also be called a controller, and the name is not limited.

[0074] In the embodiment, the memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the instructions stored in the memory, so that the at least one processor executes the method of the embodiment 1. The processor can realize Figure 6The functions of the various modules in the apparatus are shown.

[0075] The processor is the control center of the apparatus, and can connect all parts of the apparatus through various interfaces and lines. The processor can monitor the apparatus as a whole by running or executing instructions stored in the memory and calling data stored in the memory, thereby processing data and performing various functions.

[0076] In an alternative design, the processor can include one or more processing units, and the processor can integrate an application processor and a modem processor. The application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communication. It can be understood that the modem processor can also not be integrated into the processor. In some embodiments, the processor and the memory can be implemented on the same chip, and in some embodiments, they can also be implemented on separate chips, respectively.

[0077] The processor can be a general-purpose processor, such as a CPU, a digital signal processor, an application-specific integrated circuit, a field programmable gate array, or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the fine-grained data access control strategy intelligent generation method disclosed in the embodiments of the present application can be directly embodied as hardware processor execution or executed by a combination of hardware and software modules in the processor.

[0078] The memory, as a non-volatile computer readable storage medium, can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory can include at least one type of storage medium, for example, can include flash memory, hard disk, multimedia card, card type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic memory, magnetic disk, optical disk, etc. The memory is any other medium capable of carrying or storing desired program code in the form of instructions or data structures and capable of being accessed by a computer, but is not limited thereto. The memory in the embodiments of the application can also be a circuit or any other device capable of realizing the storage function, used for storing program instructions and / or data.

[0079] By designing and programming the processor, the code corresponding to the knowledge-based electronic product digitalization debugging process design method introduced in the foregoing embodiments can be fixed in the chip, so that the chip can execute the steps of the method of the foregoing embodiments when running. How to design and program the processor is a technology known to those skilled in the art, which will not be described here.

[0080] Embodiment 3 On the basis of embodiment 1, the present embodiment further discloses a computer readable storage medium for storing instructions, when the instructions are executed, the method of embodiment 1 is realized.

[0081] In some optional embodiments, the present application also provides various aspects of the fine-grained data access control policy intelligent generation method can also be realized in the form of a program product, which includes program code, when the program product runs on the device, the program code is used to make the control device execute the steps of the fine-grained data access control policy intelligent generation method according to various exemplary embodiments of the present application described above in the specification.

[0082] It should be noted that, although several units or sub-units of the apparatus are mentioned in the above detailed description, such division is merely exemplary and not mandatory. Indeed, according to an embodiment of the application, the features and functionalities of two or more units described above can be embodied in one unit. Conversely, the features and functionalities of one unit described above can be further divided into units embodied by several units. Moreover, although the operations of the method of the application are described in a particular, sequential order, this is not necessarily the case. Indeed, certain of the steps can be performed in a different order than that described, or can be performed concurrently. Additionally or alternatively, certain steps can be omitted, combined, or further divided into multiple steps.

[0083] Those skilled in the art will appreciate that embodiments of the application can be devised for a method, a system, or a computer program product. Accordingly, the present application can be embodied in the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer readable program code.

[0084] The present application is described in reference to the flowchart illustrations and / or block diagrams of the methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processing system or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart illustrations and / or block diagrams block or blocks. Figure 1 The means can include various features to perform the functions of one or more other flowchart or block diagrams blocks. Figure 1 The means can include various features to perform the functions of one or more other flowchart or block diagrams blocks.

[0085] Program code to carry out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C++, or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device or entirely on the remote computing device or server.

[0086] In situations where the remote computing device is involved, the remote computing device can be connected to the user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0087] These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instructions which implement the Figure 1 function specified in the flow or flows and / or blocks Figure 1 of the block or blocks.

[0088] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions that are executed on the computer or other programmable apparatus provide steps for implementing the Figure 1 function specified in the flow or flows and / or blocks Figure 1 Figure 1 of the block or blocks.

[0089] The above description is merely illustrative of the application, and not restrictive. Since the application can be modified in arrangement and details known to those skilled in the art, it is intended that all such modifications come within the scope of the application as defined by the appended claims.

Claims

1. A method for intelligent generation of fine-grained data access control policy, characterized in that, The fine-grained data access control strategy intelligent generation method comprises: S1: data acquisition, collecting log records of user access to corresponding access objects within a preset time, and acquiring a basic information table of the user; S2: data processing, completing data cleaning, data conversion, data standardization and weight allocation processing of the data collected in S1; S3: strategy parameter generation, using the stored user information and access log to obtain an initial data set required for clustering, and then combining the DAC algorithm to obtain required strategy parameters, including cluster center, maximum cluster radius, cluster alarm radius and required dimension; S4: strategy parameter storage, storing the parameters using a knowledge graph, and recording the cluster center, maximum radius and alarm radius to form a knowledge graph; S5: strategy mechanism construction, constructing a "pass-alarm-block" three-level access control mechanism, "pass" means that this request is reasonable and can directly access the data object; "alarm" means that this request may be risky, and the data object can be accessed, but an alarm log is also generated, which can be used by the administrator to determine whether there is abnormal behavior; "block" means that this request has a high risk, and the access request is rejected, and an alarm log is generated, if this access is a special case and access permission is needed, the administrator can be applied to obtain the permission and then access; The strategy decision process comprises: using an attribute-based access control method to realize access control, according to the data attributes, environment attributes and subject attributes provided by the strategy information point, the corresponding attribute values are processed by the strategy decision point according to the strategy; and using the processed data to calculate the distance from the current access request to each cluster center in turn, and compare it with the corresponding maximum radius and alarm radius, to obtain the "pass-alarm-block" access request result, and then return the access request result to the strategy implementation point; S6: strategy use, the strategy is called by the strategy decision point, the related parameters are obtained from the knowledge graph, the access request result is returned to the strategy implementation point, and then the strategy implementation point performs access control operation according to the result, if "pass", the data is provided, if "alarm", the data is provided while recording the alarm log, if "block", the access is rejected and an alarm log is generated. 2.The fine-grained data access control policy intelligent generation method of claim 1, wherein, In step S2, the data cleaning process comprises: filling in the missing values in the basic information table, filling in the character class as null, and filling in the numerical class as the average value; The data conversion process comprises: processing of character type data, if the data is unstructured data, the effective value is extracted by regular expression, if it is structured data, it is processed by one-hot encoding; Data standardization, the data is scaled to a standard normal distribution range by using Z-Score standardization, so that the mean is 0 and the standard deviation is 1; Weight allocation, the processed data is allocated weights according to the corresponding rules. 3.The fine-grained data access control policy intelligent generation method of claim 1, wherein, In step S3, The maximum cluster radius and the cluster alarm radius are used to determine the pass zone, the alarm zone and the block zone of the corresponding cluster; The cluster center is used for determining the cluster center of each class. In the access process, the acquired attribute is determined according to the required dimension, and the distance between the acquired attribute and each cluster center is located in the passing zone, the alarm zone or the blocking zone, so as to determine the result of the access request.

4. The fine-grained data access control policy intelligent generation method of claim 1, wherein, In step S3, the DAC performs data processing on the input data set and obtains the cluster center, the alarm radius, the maximum radius and the required dimension parameter. The DAC algorithm includes two sub-protocols, namely, the attribute clustering protocol DAC_S1 and the clustering optimization protocol DAC_S2.

5. The fine-grained data access control policy intelligent generation method of claim 4, wherein, In step S3, the DAC algorithm implementation process includes: Attribute clustering protocol DAC_S1, based on K-means++ algorithm on the data set after S2 data processing Carrying out clustering processing to obtain the class cluster center of the data set , contour coefficient And clustering class cluster .

6. The fine-grained data access control policy intelligent generation method of claim 5, wherein, In step S3, the DAC algorithm implementation process further includes: The clustering optimization protocol DAC_S2 is based on the silhouette coefficients in the clustering results. The number of clusters and the dimension of clusters are iteratively optimized until the silhouette coefficient is obtained. If the value meets the requirements or reaches the maximum number of iterations, the cluster center is obtained. Maximum radius of cluster Cluster alarm radius and required dimensions .

7. The fine-grained data access control policy intelligent generation method of claim 6, wherein, Step S4 includes: generating an access object node, storing the required attribute dimension of the access object in the node; generating a cluster center node, storing the cluster center corresponding to the cluster center, the maximum cluster radius and the alarm cluster radius in the node; and generating a node association, connecting the access object node and the cluster center node corresponding thereto, so as to facilitate subsequent query.

8. The fine-grained data access control policy intelligent generation method of claim 7, wherein, Step S6 includes: 1) policy calling, calling the corresponding access control policy through the policy decision point, and obtaining the related parameter information from the knowledge graph; 2) obtaining information, calling the related attribute data information of the access user and the access environment according to the required attribute in the access object node in the knowledge graph; 3) data processing and calculation, using the S2 corresponding method to process the acquired attribute data information, and sequentially calculating the distance between the processed data and the cluster center stored in each clustering cluster node; 4) generating an access request result, comparing the distance in each cluster with the alarm radius and the maximum cluster radius stored in the cluster node in sequence, and determining the result of the access request as one of "passing-alarm-blocking" according to the size relationship; 5) executing the request result, returning the access request result to the policy implementation point, and implementing the control according to the result by the implementation point.

9. An electronic device, comprising: comprises: at least one processor; and a memory connected in communication with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the at least one processor, by executing the instructions stored in the memory, performs the method of any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium is used to store instructions, when the instructions are executed, the method of any one of claims 1 to 8 is realized.

Images