Knowledge base and knowledge graph dynamic access control method and system based on AI classification and grading

Abstract

The invention discloses a knowledge base and knowledge graph dynamic access control method and system based on AI classification and grading, and relates to the technical field of data security and access control. Automatically classifying and grading text segments or knowledge graph entities by using an AI model through a data preprocessing module, generating structured tags, and binding the structured tags with original data; after the data are associated and stored to the database through the structured storage module, the authority management module maintains the accessible classification and grade range of the user; and the query filtering module calls the user permission and dynamically filters the retrieval result when the user retrieves, and only returns the authorized content. According to the method, automatic and fine-grained dynamic access control based on data content semantics is realized, the problems of dependence on manual labeling, coarse access control granularity and insufficient flexibility in the prior art are solved, data security and retrieval efficiency are considered, and the method is adaptive to multiple coincidence rules and standards.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security and access control, and particularly relates to a knowledge base and knowledge graph dynamic access control method and system based on AI classification and grading. BACKGROUND

[0002] With the development of cloud computing and artificial intelligence technology, knowledge bases (such as vector database-based retrieval systems) and knowledge graphs have been widely used in sensitive fields such as finance, medicine, and government affairs. These data often contain a large amount of sensitive information, such as personal privacy, financial data, and business secrets, and their secure storage and controlled access have become key issues that need to be addressed. In particular, in the scenario of data outsourcing to cloud servers, how to prevent data leakage caused by untrusted cloud service providers while ensuring efficient retrieval for authorized users is a key focus of current research.

[0003] In the prior art, security protection schemes for knowledge graphs and data retrieval systems are mainly divided into three categories: searchable encryption-based encrypted data protection schemes, static access control and anomaly detection schemes based on knowledge graphs (related patents can refer to CN114444116B), and dynamic desensitization and permission verification-based schemes (related patents can refer to CN118260796A).

[0004] Among them, the searchable encryption scheme encrypts data and index through cryptographic technology, supports encrypted retrieval, but the access control granularity is coarse, cannot dynamically filter according to data content semantics and user identity, and has large encryption and decryption performance overhead; the static knowledge graph permission model uses knowledge graphs to predefine access control rules or data sensitivity labels, relies on manual predefinition, lacks automated and intelligent content semantic recognition capabilities, and is difficult to cope with massive dynamic data; the dynamic desensitization and permission verification scheme filters results according to pre-set permissions and labels when querying, but its filtering logic is still based on static labels, and cannot achieve dynamic and fine-grained access control based on content understanding.

[0005] In summary, the existing technology cannot achieve automated and fine-grained dynamic access control based on data content semantics, or focuses on storage encryption, or relies on static and manually intervened permission and label definition, making it difficult to flexibly and efficiently cope with the management needs of massive and variable unstructured information in modern enterprise knowledge bases while ensuring security. SUMMARY

[0006] The present application relates to the technical field of data security and access control, and particularly relates to a knowledge base and knowledge graph dynamic access control method and system based on AI classification and grading.

[0007] To achieve the above-mentioned purpose, the present application adopts the following technical solutions: An AI classification and grading-based knowledge base and knowledge graph dynamic access control system comprises: A data preprocessing module is configured to receive original text segments or knowledge graph entity data, perform content semantic analysis on the data by an AI classification and grading model, generate classification labels and grading labels, bind the labels with the original data to form labeled data units, and output the labeled data units to a structured storage module. The structured storage module is configured to receive the labeled data units, and store data contents, vector embeddings, and corresponding classification labels and grading labels in a database. The permission management module is configured to maintain user permission policies, store data classification lists and grading lists that each user is allowed to access, and provide a permission query API. The query filtering module is configured to receive a user query request, call the permission query API to obtain a user permission list, perform a search in the database to obtain a preliminary candidate result set, compare candidate result labels with user permissions, filter unauthorized data, and return a safe result.

[0008] As a further scheme of the present application, the AI classification and grading model in the data preprocessing module simultaneously performs data business / technical category judgment and information sensitivity judgment, and outputs structured label objects; and the label objects are bound with original data and transmitted to the structured storage module in a machine-readable format.

[0009] As a further scheme of the present application, the permission management module is an independent service that maintains a mapping relationship between users and permissions; and the query filtering module calls the permission management module through an API, and obtains a preliminary candidate result set through vector similarity search or graph query language.

[0010] As a further scheme of the present application, in the structured storage module, classification labels and grading labels are stored as attributes of knowledge graph entities, or are stored in independent metadata tables and associated with data subjects through foreign keys.

[0011] An AI classification and grading-based knowledge base and knowledge graph dynamic access control method is applicable to the AI classification and grading-based knowledge base and knowledge graph dynamic access control system, and comprises the following steps: S1 data preprocessing: obtaining original text segments or knowledge graph entity data, performing content semantic analysis on the data by an AI classification and grading model, automatically generating classification labels and grading labels, binding the labels with the original data to form labeled data units, and outputting the labeled data units to a structured storage module. S2: structured storage, storing data contents, vector embeddings, and corresponding classification labels and grading labels in the labeled data units in a database. S3: permission configuration, maintaining user permission policies, and storing data classification lists and grading lists that each user is allowed to access. S4: dynamically filtering the query, receiving a user query request, obtaining a permission list of the user, performing retrieval in the database to obtain a preliminary candidate result set, comparing the labels of the data in the candidate result set with the permission list of the user, and returning a safe result after filtering unauthorized data.

[0012] As a further scheme of the application: the AI classification and grading model is a pre-trained language model that is fine-tuned, including a BERT model or a GPT model; or is a rule engine or a keyword matching algorithm, which scans the text through a regular expression or a sensitive word library and assigns labels.

[0013] As a further scheme of the application: the database is a vector database, a graph database, a relational database or a NoSQL database; and the labeled data unit stores label information in a JSON format, including a numerically encoded classification label and a string or numerically encoded grading label.

[0014] As a further scheme of the application: the grading label is generated based on a multi-track grading standard, including a G series required by the state, an L series required by the enterprise, a P series required by personal information, or a single-track digital level 1-5, or an industry-specific standard.

[0015] As a further scheme of the application: the permission verification in the dynamic filtering query step is implemented in the retrieval stage, the pre-filtering stage before data storage or the batch filtering stage after retrieval; if implemented before retrieval, multiple index copies need to be pre-generated according to user permissions, and the corresponding index is directly accessed during query.

[0016] Compared with the prior art, the application has the advantages that: automatic semantic classification and grading are realized, the AI model or the special algorithm is used for intelligent identification of data content, manual label marking is not required, massive and variable unstructured data processing requirements are adapted, and data management efficiency is improved; in the retrieval stage, real-time filtering is performed based on data labels and user permissions, precise permission control at the level of text segmentation and knowledge graph entities is realized, and sensitive information leakage is avoided; a multi-track grading standard that can be customized is supported, the state, the enterprise, personal information or industry-specific compliance requirements can be flexibly matched, and the applicability of the system is improved; label and data are stored in association to ensure fast execution of permission verification, the dynamic filtering process does not affect the retrieval efficiency, and data security and access experience are balanced. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 is a system architecture diagram of the application; Figure 2 is a classification and grading flowchart of the data preprocessing module of the application; Figure 3 is a dynamic filtering flowchart of the query filtering module of the application. DETAILED DESCRIPTION

[0018] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0019] An AI classification and grading-based knowledge base and knowledge graph dynamic access control system, as shown in Figure 1 The overall architecture of the system of the present application is composed of four core modules, which cooperate with each other through data flow and API calls: (1) Data preprocessing module: responsible for classification and grading processing of input text segmentation or knowledge graph entities. This module is the input end of the system, which receives the original text segmentation or knowledge graph entity data. Its internal core is a fine-tuned classification and grading model (such as a BERT-based model). The module calls the model to analyze the input data, outputs structured classification and grading labels (such as JSON format: {“category”: 2, “level”: “G1”}), and binds these labels with the original data content to form labeled data units.

[0020] (2) Structured storage module: store data content and classification and grading labels in vector databases or graph databases. This module receives labeled data units from the data preprocessing module. It stores data content (content), corresponding vector embedding (embedding), and classification labels (category) and grading labels (level) in the database. The database is usually a vector database (such as Milvus, Pinecone) or a graph database (such as Neo4j) to support efficient similarity retrieval.

[0021] (3) Permission management module: maintain user permission policies and store user accessible classification and level ranges. This module is an independent service that maintains the mapping relationship between users and permissions. It stores the data classification list (allowed_categories) and grading list (allowed_levels) that each user ID is allowed to access. This module provides a query API for the query filtering module to call.

[0022] (4) Query filtering module: when the user queries, dynamically filter the search results based on the user's permissions. This module is the query end of the system, which handles the user's data retrieval request, and its workflow is as follows: first, receive the user's query request; second, call the API of the permission management module to get the user's permission list; third, perform vector similarity search in the structured storage module to get the preliminary candidate result set; finally, and the most critical step, compare the label of each data in the candidate result set with the user's permissions, only keep those data items whose data classification belongs to the user's allowed classification list and data classification belongs to the user's allowed classification list, and finally return the filtered safe result to the user.

[0023] These modules together constitute an automated pipeline, which realizes a complete closed loop from automatic sensitivity identification when data is injected to dynamic permission control when data is queried. When the system is working, the data preprocessing module first processes the original text or entity, and then stores it in the database. When the user queries, the query filtering module calls the permission management module to get the user's permissions and filters the search results. The whole process does not need manual intervention, and realizes automatic access control.

[0024] As shown in Figure 2 , the classification and grading process of the data preprocessing module is shown, and the classification and grading process in the data preprocessing module follows a clear sequence of steps: (1) Input text segmentation or knowledge graph entity, start the process, input the text segmentation or knowledge graph entity content to be processed into the classification and grading model.

[0025] (2) Use pre-trained language models (such as BERT, GPT) or special algorithms for inference, call the trained classification and grading model to understand and analyze the input data, which performs two tasks simultaneously: a, judge the business or technical category (classification) to which the data belongs; b, judge the sensitivity of the information contained in the data (grading).

[0026] (3) The model outputs classification labels (such as numerical codes, representing data types) and grading labels (such as string codes, representing sensitivity levels), and after the model inference is completed, a structured label object is output, which contains at least two fields: category (classification code, usually a number) and level (grading code, usually a string).

[0027] (4) Bind the label with the data content, prepare for storage, bind the classification label and grading label generated in step (3) with the original input data content to form a complete data unit with metadata labels, which is the output of the process and is sent to the structured storage module.

[0028] The process is fully automated, without manual review, ensuring consistency in processing efficiency.

[0029] As Figure 3 shown, the query filtering flowchart is shown, and the dynamic access control process of the query filtering module for each user query is as follows: (1) The user initiates a query request, receives the query request, and the process begins. The system receives the query command from the user client.

[0030] (2) The system obtains the user's permission configuration (allowed category list and level list) through the API, obtains the user's permission, and immediately initiates an API call to the permission management module. According to the current user's identity (such as user_id), the system queries the user's permission configuration, i.e., obtains the data category list (allowed_categories) and level list (allowed_levels) that the user is allowed to access.

[0031] (3) Perform vector retrieval, perform similarity retrieval in the database, and obtain preliminary results. The system converts the user query content into a vector and performs a similarity search in the structured storage module (vector database) to obtain a preliminary, unfiltered search result list.

[0032] (4) Traverse and permission check. This is a core loop step, and the system checks each item of data in the preliminary search result list: a) Read the category and level labels of the current data item.

[0033] b) Judgment logic: Is the category of the current data in the user's allowed_categories list, and is the level of the current data in the user's allowed_levels list?

[0034] c) If yes, add the data item to the "authorized result set".

[0035] d) If not, discard the data item and optionally record a no permission access log.

[0036] (5) Return the filtered results. When all preliminary results have been checked in step S304, the process ends. The system returns the final "authorized result set" to the user client, and the user will only see the content they are authorized to access, with sensitive information seamlessly filtered.

[0037] The query filtering process is completed in the retrieval stage, avoiding exposure of sensitive data. For example, if a user has permissions to access categories [1, 2] and levels ["L2", "L3"], only data matching these labels will be returned. The filtering operation is implemented at the database query layer or the application layer to ensure efficiency.

[0038] Taking the application of the present application in media newspaper knowledge graph dynamic access control as an example: The knowledge graph system of the media newspaper group takes entities and relationships as the core and realizes dynamic permission control through graph traversal and context calculation. The knowledge graph contains multiple entity types such as news articles, reporters, editors, news events, and institutions, as well as complex relationships between them. The system needs to ensure that sensitive content (such as unpublicized reports and classified events) is only accessible to authorized personnel, while supporting efficient graph queries and relationship reasoning.

[0039] The system application process is as follows: S1: Knowledge graph modeling and data preprocessing The knowledge graph adopts a multi-dimensional classification and hierarchical framework, and the entity nodes carry structured attributes. Entity types include: news articles, reporters, editors, news events, themes, institutions, etc.

[0040] Each entity has classification attributes (such as business classification, content type, and security classification) and hierarchical attributes (such as confidentiality level, sensitivity level, and maturity).

[0041] For example, the attributes of a news article entity include: Business classification: financial news, political news, social news, entertainment news, sports news; Content type: news report, in-depth analysis, personality interview, data report, advertising content; Security classification: public information, internal work, business secret, personal privacy, national security; Confidentiality level: L0 completely public, L1 internal public, L2 department internal, L3 project group internal, L4 core secret; Sensitivity level: S0 no sensitivity, S1 low sensitivity, S2 medium sensitivity, S3: high sensitivity, S4 extremely high sensitivity; Status: draft, under review, reviewed, published, archived; Relationship types include: involves, occurs in, is classified under, belongs to, is responsible for auditing, etc., forming a semantic network.

[0042] The data preprocessing module uses an AI classification and grading model to perform content semantic analysis on input entity data (such as news article content, event descriptions), automatically generating multi-dimensional classification labels and grading labels, and binding the labels as entity attributes. For example, the AI model identifies that the article content involves "listed company asset restructuring", automatically labeling the business classification = "financial news", the confidentiality level = "L2", and the sensitivity level = "S3".

[0043] S2: Structured Storage The labeled entities and relationships are stored in the Neo4j graph database. Entity attributes (including classification labels, grading labels), vector embeddings (for similarity retrieval), and relationship topology associations are stored. Classification and grading attributes are directly indexed as entity fields, supporting efficient graph traversal and conditional filtering.

[0044] S3: Permission Configuration and Policy Engine The permission management module maintains role-based user permission policies: Journalist role: allows access to entities with business classification = ["financial news", "social news"], confidentiality level ≤ "L2", sensitivity level ≤ "S3", and status = ["audited", "published"].

[0045] Editor role: allows access to all business classifications, confidentiality level ≤ "L3", sensitivity level ≤ "S4", and all statuses.

[0046] Public reader role: only allows access to entities with business classification = ["sports", "entertainment"], confidentiality level = "L1", and status = "published".

[0047] The policy engine defines graph pattern-based access control rules, such as: Rule 1: User can access entities when entity attributes match user permission ranges.

[0048] Rule 2: User can access associated entities through relationship paths when the starting entity has permission and the relationship type allows propagation (e.g., "journalist" can access "news articles" associated with "departments" through the "belongs to" relationship).

[0049] S4: Dynamic Filtering Query and Query Rewriting When a journalist queries "financial merger events", the system only returns event entities with business classification "financial news", confidentiality level ≤ "L2", and sensitivity level ≤ "S3". Even if there are higher-level "L3" events, the entire path is filtered due to insufficient node permissions on the relationship path.

[0050] When an editor queries "all pending articles", with wider permissions, they can access all classifications and high-level content, and traverse all pending articles through the "responsible for auditing" relationship.

[0051] The above description is only the preferred embodiment of the present application, but the protection scope of the present application is not limited to this. Any person skilled in the art can make equivalent substitutions or changes according to the technical solution and the inventive concept of the present application within the technical range disclosed by the present application, which should be covered in the protection scope of the present application.

Claims

1. A dynamic access control system for a knowledge base and knowledge graph based on AI classification and grading, characterized in that, include: Data preprocessing module: Used to receive raw text segments or knowledge graph entity data, perform content semantic analysis through AI classification and grading model, generate classification tags and grading tags, and bind the tags with the raw data to form tagged data units; Structured storage module: used to receive the labeled data units, and store the data content, vector embedding, and corresponding classification and hierarchical labels in the database; The access control module is used to maintain user access control policies, store the data categories and hierarchical lists that each user is allowed to access, and provide an access control query API. Query filtering module: It is used to receive user query requests, call the permission query API to obtain the user permission list, perform a search in the database to obtain a preliminary candidate result set, compare the candidate result tags with user permissions, filter unauthorized data and return a safe result.

2. The AI-based classification and grading knowledge base and knowledge graph dynamic access control system according to claim 1, characterized in that, The AI ​​classification and grading model in the data preprocessing module simultaneously performs data business / technology category judgment and information sensitivity judgment, and outputs structured label objects; After the tag object is bound to the original data, it is transmitted to the structured storage module in a machine-readable format.

3. The AI-based classification and grading knowledge base and knowledge graph dynamic access control system according to claim 2, characterized in that, The permission management module is an independent service that maintains the mapping relationship between users and permissions; The query filtering module calls the permission management module via API to obtain a preliminary candidate result set through vector similarity retrieval or graph query language.

4. The AI-based classification and grading knowledge base and knowledge graph dynamic access control system according to claim 3, characterized in that, In the structured storage module, classification tags and hierarchical tags are stored as attributes of knowledge graph entities, or stored in an independent metadata table and linked to the data subject through foreign keys.

5. A dynamic access control method for a knowledge base and knowledge graph based on AI classification and grading, applicable to the dynamic access control system for a knowledge base and knowledge graph based on AI classification and grading as described in any one of claims 1-4, characterized in that, S1: Data preprocessing: Obtain raw text segments or knowledge graph entity data, perform content semantic analysis on the data through an AI classification and grading model, automatically generate classification tags and grading tags, bind the tags to the raw data, and form tagged data units. S2: Structured storage, which stores the data content, vector embedding, and corresponding classification and hierarchical labels in the labeled data units into the database; S3: Permission configuration, maintains user permission policies, and stores the data category list and hierarchical list that each user is allowed to access; S4: Dynamic Query Filtering. Receives a user query request, obtains the user's permission list, performs a search in the database to obtain a preliminary candidate result set, compares the labels of the data in the candidate result set with the user's permission list, filters out unauthorized data, and returns a secure result.

6. The method for dynamic access control of knowledge bases and knowledge graphs based on AI classification and grading according to claim 5, characterized in that, The AI ​​classification and grading model is a finely tuned pre-trained language model, including the BERT model or the GPT model; or a rule engine or keyword matching algorithm that scans text and assigns labels using regular expressions or a sensitive word library.

7. The method for dynamic access control of knowledge bases and knowledge graphs based on AI classification and grading according to claim 6, characterized in that, The database is a vector database, graph database, relational database, or NoSQL database; the tagged data unit stores tag information in JSON format, and the tag information includes numerically encoded classification tags and string or numerically encoded hierarchical tags.

8. The method for dynamic access control of knowledge bases and knowledge graphs based on AI classification and grading according to claim 7, characterized in that, The grading labels are generated based on a multi-track grading standard, which includes the G series required by the state, the L series required by enterprises, the P series required by personal information, or a single-track numerical level of 1-5, or an industry-specific standard.

9. A dynamic access control method for knowledge bases and knowledge graphs based on AI classification and grading, as described in claim 8, is characterized in that... The permission verification in the dynamic filtering query step can be implemented in the retrieval stage, the pre-filtering stage before data is stored, or the batch filtering stage after retrieval. If it is implemented before retrieval, multiple index copies need to be pre-generated according to user permissions, and the corresponding index is accessed directly during the query.

Images