Large language model access control method and system fusing semantic intention and permission

Abstract

The invention relates to the technical field of artificial intelligence, in particular to a large language model access control method and system fusing semantic intention and authority, and the method comprises the steps: obtaining query content input by a user, and carrying out semantic decomposition to obtain structured intention elements; performing matching verification on the intention elements and an authority strategy library; according to a verification result, performing dynamic treatment of releasing, rewriting or refusing on the query intention of the user: if the query intention exceeds the permission range and does not violate the permission strategy, rewriting the query intention, and performing matching verification again; and refusing the query request if the permission range is exceeded and the permission policy is violated. By applying the method, the semantic query intention of the user can be understood, access control of accurate permission judgment is performed based on the intention, the user experience can be improved, and the system security can be ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, and particularly relates to a large language model access control method and system fusing semantic intention and permission. BACKGROUND

[0002] With the rapid development of large language model (LLM) technology, its potential in enterprise-level applications is increasingly apparent, especially in data querying and analysis through natural language interaction, such as Text-to-SQL query requirements. However, directly connecting LLM to enterprise core databases poses unprecedented security challenges. Existing access control technologies, such as role-based access control (RBAC), usually act on the execution layer of data access. For example, read and write permissions of users to specific data tables and data columns are set at the database level. When users query through traditional BI tools or directly write SQL statements, this mechanism is effective.

[0003] However, under the new paradigm of LLM as an interactive interface, the above access query mechanism has significant shortcomings, as follows: traditional access control acts on structured data query requests (such as SQL statements), while user input in the LLM scenario is high-freedom natural language. The compliance of the user's true query intention with the permission boundary is determined at the natural language level, but the traditional mechanism cannot effectively intercept at this level. The semantic ambiguity of the query content can lead to unauthorized risks, for example, a user's ambiguous query "show me what big orders there are recently" may be over-interpreted or mis-translated by LLM. LLM may convert it into a SQL statement that queries all regions and all categories of order details with sales ranking in the top 10%. If the user's intended permission is limited to viewing orders under his / her responsibility, this constitutes a serious unauthorized data access, leading to leakage of sensitive business information.

[0004] When detecting unauthorized queries, existing technologies can only simply refuse execution, resulting in poor user experience. The system cannot intelligently limit the user's unauthorized request to the scope allowed by the permission, lacking flexibility. Therefore, how to establish an access control mechanism that can understand the semantic intention of user queries and make accurate permission judgments based on the intention in the scenario of LLM interacting with business data, to prevent unauthorized data access due to semantic understanding bias, is a technical problem that needs to be solved. SUMMARY

[0005] The application aims to provide a large language model access control method and system that fuses semantic intent and permission, to solve the problem that the access control mechanism in the prior art cannot understand and control user query intent at the semantic level, resulting in the risk of unauthorized data access in large language model applications, and to achieve intent-level precise permission control.

[0006] To achieve the above-mentioned purpose, the application provides the following technical solutions. According to one aspect of the application, a large language model access control method that fuses semantic intent and permission is provided, comprising the following steps: S1: obtaining user input query content, and obtaining structured intent elements by performing semantic decomposition on the query content; S2: matching and verifying the structured intent elements with a permission policy library; S3: based on the verification result, dynamically handling the user query intent by releasing, rewriting, or rejecting it: If the semantic intent does not exceed the user's permission range, release the query content for subsequent processing; If the semantic intent partially exceeds the permission range and does not violate the permission policy, rewrite the query intent and perform matching and verification again; If the semantic intent exceeds the permission range and violates the permission policy, reject the query request.

[0007] According to one embodiment of the application, in step S1, the structured intent elements include at least query action, target entity, and limitation condition, wherein: the query action includes query, statistics, and export operations; the target entity includes business objects such as orders, customers, and employees; and the limitation condition includes time, region, amount, and responsible person constraint dimensions.

[0008] According to one embodiment of the application, the permission policy library adopts a structured storage method of subject-operation-object-constraint, wherein: the subject is a user or a user role; the operation corresponds to the query action; the object corresponds to the target entity; and the constraint matches the permission boundary of the limitation condition.

[0009] According to one embodiment of the application, the matching and verification process in step S2 includes: comparing the query action, target entity, and limitation condition in the structured intent elements with the corresponding items in the permission policy library one by one; if the target entity is not authorized in the permission policy library, it is directly determined that the permission policy is violated; if the query action or the limitation condition is inconsistent with the permission policy, it is determined that the permission range is partially or completely exceeded.

[0010] According to an embodiment of the present invention, in step S3, the process of rewriting the query intent includes: identifying and supplementing missing permission constraints in the original intent element; correcting restrictions in the original intent element that conflict with the permission policy; retaining the content in the original intent element that conforms to the permission scope; and discarding the content of the original intent element that is irrelevant to the permission policy or exceeds the scope, thereby generating a new structured intent element.

[0011] According to one embodiment of the present invention, in step S3, when the query request is rejected, the method further includes returning an explainable reason for rejection to the user, which may include the specific circumstances of an unauthorized target entity, an operation exceeding permissions, or a restriction condition.

[0012] According to one embodiment of the present invention, the semantic decomposition in step S1 is achieved by natural language processing technology, including a large language model or a natural language understanding model.

[0013] According to one embodiment of the present invention, the permission policy library supports dynamic updates, including adding new user role permissions, modifying existing constraints, and deleting invalid permission policies.

[0014] According to one embodiment of the present invention, the results of the dynamic processing in step S3 and their corresponding matching verification criteria are recorded in real time to form a traceable access control log.

[0015] On the other hand, the present invention also provides a large language model access control system that integrates semantic intent and permissions, the system comprising: The query interception module is deployed between the user interface and the core processing unit of the large language model to capture the natural language query content input by the user. The semantic decomposition module is used to semantically decompose the query content using natural language processing technology and output structured intent elements; The permission policy library is used to store permission rules for different users or roles in a subject-operation-object-constraint structure. The permission verification engine is used to match and verify structured intent elements with the permission policy library and output the verification results. The dynamic processing module performs allow, rewrite, or reject operations based on the verification results. The rewrite operation generates a compliant query intent by correcting the intent element, while the reject operation returns an explainable reason.

[0016] The present invention provides a method and system for access control of a large language model that integrates semantic intent and permissions. Compared with the prior art, the beneficial effects are as follows: 1. Based on access control, semantic upgrades have been achieved, moving the access control verification process from the backend data execution layer to the frontend semantic intent layer. This enables precise control over the user's true intent and fundamentally makes up for the shortcomings of existing query access control strategies in LLM application scenarios.

[0017] 2. Intelligent access control has been implemented. Through an innovative dynamic query and rewrite mechanism, it has moved from a rigid, one-size-fits-all approach to access denial to an intelligent access control execution mode that adaptively adjusts boundaries. This greatly improves user experience and system availability while ensuring security and compliance.

[0018] 3. The principle of least privilege is precisely implemented, ensuring that every data access request generated by the LLM strictly follows the minimum privilege set configured for it. Through intent-level pre-verification, the risk of data abuse and information leakage is effectively curbed.

[0019] 4. The system's interpretability and auditability have been enhanced. Each dynamic decision-making process for access control (allow, rewrite, deny) and its basis (matching permission policies) can be clearly recorded, providing clear and traceable evidence for subsequent security audits. Attached Figure Description

[0020] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this invention, illustrate exemplary embodiments of the invention and are used to explain the invention, but do not constitute an undue limitation of the invention. In the drawings: Figure 1 This is a flowchart of a large language model access control method that integrates semantic intent and permissions according to an embodiment of the present invention; Figure 2 This is a schematic diagram of a large language model access control system that integrates semantic intent and permissions according to an embodiment of the present invention; Figure 3 This is a logical diagram illustrating the permission policy matching and verification in an embodiment of the present invention. Detailed Implementation

[0021] To facilitate a clear description of the technical solutions in the embodiments of the present invention, the terms "first" and "second" are used to distinguish identical or similar items with essentially the same function and effect. For example, the first threshold and the second threshold are merely used to distinguish different thresholds and do not limit their order. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order, and that the terms "first" and "second" are not necessarily different.

[0022] It should be noted that in this invention, the terms "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in this invention should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0023] In this invention, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one" or similar expressions refer to any combination of these items, including any combination of singular or plural items. For example, "at least one of a, b, or c" can represent: a, b, c, a combination of a and b, a combination of a and c, a combination of b and c, or a, b, and c, where a, b, and c can be single or multiple.

[0024] The technical solution of this invention introduces an intelligent access control layer before LLM converts natural language into structured data queries (such as SQL). This layer matches and verifies the semantic intent decomposed from the user's natural language query with a finely defined permission policy library, and dynamically handles the query request by allowing, rewriting, or rejecting it based on the verification results.

[0025] like Figure 1 As shown, a flowchart of a large language model access control method that integrates semantic intent and permissions is presented. The method includes the following steps: S1: Semantic decomposition of query intent; After the query interception module captures the user's natural language query, it transmits it to the semantic decomposition module. The semantic decomposition module uses a Large Language Model (LLM) to perform semantic parsing on the query, extracting structured intent elements. For example, if the user enters the query "Query customer orders exceeding 800,000 in North China in the first half of 2024", the decomposed intent elements would be: Action: "Query" Entity: Customer Orders Conditions: [{field: "Time", operator: "Belongs to", value: "First half of 2024"}, {field: "Region", operator: "Equal to", value: "North China"}, {field: "Amount", operator: "Greater than", value: "800,000"}] S2: Permission policy matching and verification; The permission verification engine retrieves the current user's permission policy from the permission policy library. Assuming the current user is "Regional Account Manager," their corresponding permission policy is: {Subject: "Regional Account Manager", Operation: "Query", Object: "Customer Order", Constraints: [{field:"Responsible Region", operator: "Equal to", value: "self.Responsible Region"}, {field: "Amount", operator: "Less than or equal to", value: "1 million"}, {field: "Time", operator: "Last Year"}]} The permission verification engine compares the structured intent elements with the matched permission policies one by one: Matching operations and objects (both "query" and "customer order"); The time condition "first half of 2024" falls within "within the past year," thus satisfying the constraint. The regional condition "North China" matches "self.Responsible Region" and satisfies the constraint, assuming the user is responsible for the North China region. The amount condition "exceeding 800,000" does not exceed the constraint of "less than or equal to 1,000,000", and is still within the scope of authority.

[0026] Therefore, the final verification result was to allow passage.

[0027] S3: Dynamic processing decision. The dynamic processing module receives the "allow" instruction, passes the original structured intent to the LLM execution unit, and the LLM converts it into the corresponding SQL statement and executes it, finally returning the query results to the user.

[0028] like Figure 2 The diagram shows a schematic of a large language model access control system that integrates semantic intent and permissions. This system is used to implement the above method and specifically includes the following modules: Query interception module: It adopts interface interception technology and is deployed in the front gateway of the LLM interaction interface. It supports the capture of query requests of HTTP / HTTPS protocol, and intercepts the user's natural language input without affecting the normal interaction response speed. Semantic decomposition module: Integrates open-source NLU models or calls LLM APIs (such as GPT-4, Wenxin Yiyan), optimizes semantic parsing accuracy through the Prompt project, ensures the completeness and accuracy of intent element extraction, and has a processing latency of ≤500ms; Permission policy library: Built on relational databases (such as MySQL) or graph databases (such as Neo4j), it supports a visual configuration interface. Administrators can add, modify, and delete permission rules through the interface, and rule updates take effect in real time. Permission verification engine: It adopts a rule engine framework (such as Drools), with a preset algorithm for comparing intent elements with permission rules, supports batch verification and incremental verification, and has a verification accuracy of ≥99.5%; Dynamic handling module: Built-in query rewrite template library, preset constraint correction logic according to different business scenarios, rejection feedback module supports custom prompts, log recording module stores logs in the format of "time-user-intent-verification result-handling action", and the log retention period is configurable.

[0029] The permission policy library supports manual updates: administrators can directly edit user roles, operation permissions, object scope, and constraints through the permission configuration interface in the system backend, and the policy will be synchronized to the policy library immediately after submission; it also supports automatic updates: when connected to the enterprise HR system and organizational structure system, the permission policy will be automatically updated when user roles change or the organizational structure is adjusted, ensuring that permissions match user identities.

[0030] like Figure 3 The diagram shown illustrates the logic of permission policy matching and verification. Refer to the following... Figure 3 The following detailed description is provided in conjunction with Examples 1 and 2.

[0031] Example 1: Query rewriting.

[0032] The user role is a regular salesperson, and the specific permission policy is as follows: {Subject: "Ordinary Salesperson", Operation: "Query", Object: "Order", Constraint: [{field: "Responsible Person ID", operator: "Equal to", value: "self.ID"}, {field: "Amount", operator: "Less than", value: "500,000"}]}).

[0033] The user entered the query: "Show me the large orders from the East China region last quarter".

[0034] S101: Semantic decomposition yields Intent I1: Action: "Query"; Entity: "Order"; Conditions: [{field: "Region", operator: "equal to", value: "East China Region"},{field: "Time", operator: "belongs to", value: "last quarter"}, {field: "Amount", operator:"belongs to", value: "large amount"}] ("large amount" is interpreted as >1 million by default).

[0035] S102: Permission verification, verification results show: The constraint "Responsible Person ID = self.ID" is missing; The amount condition ">1 million" conflicts with the strategy "<500,000"; The "East China Region" area has no access restrictions.

[0036] The verification result is "rewritten".

[0037] S103: The dynamic processing module rewrites the intent and generates a new intent. I2: Action: "Query"; Entity: "Order"; Conditions: [{field: "Responsible Person ID", operator: "equal to", value: "Current User ID"}, {field: "Time", operator: "belongs to", value: "last quarter"}, {field: "Amount", operator: "less than", value: "500,000"}].

[0038] At the same time, a prompt is returned to the user: "Based on your permissions, we have retrieved the orders that you were responsible for, occurred in the previous quarter, and have an amount of less than 500,000." Example 2: Query rejected.

[0039] The user's role is HR Specialist, and the permission policy does not authorize the "Orders" object. The input query is: "Please find out who the top salesperson was last quarter, and their order list."

[0040] S201: Semantic decomposition yields two sub-intents: I4-1: Action: "Query", Entity: "Sales Champion Information", Conditions: [{field: "Time", operator: "Belongs to", value: "Last Quarter"}] I4-2: Action: "Query", Entity: "Order", Conditions: [{field: "Associated Person", operator: "Equals", value: "Sales Champion ID"}] S202: Permission verification found that the "Order" object in I4-2 was not authorized, and the verification result was "Rejected".

[0041] S203: The dynamic processing module intercepts the request and returns the message: "Sorry, according to your permissions, we can query the sales champion information for you, but we cannot query the order details." This invention provides a large language model access control method and system that integrates semantic intent and permission policies. By introducing an intelligent, front-end access control layer into LLM applications, it achieves significant technological advancements: It realizes precise intent-level control: This invention elevates the granularity of access control from traditional structured query statements to the level of the user's original semantic intent. This "pre-emptive" control mechanism can accurately identify and intercept unauthorized access risks that may arise due to the ambiguity of natural language, ensuring the security of enterprise data from the source. It provides flexible and adaptive permission boundaries: Unlike the rigid "black and white" control mode of existing technologies, this invention's unique dynamic query rewriting mechanism can intelligently "trim" unauthorized user requests to within their permission boundaries without interrupting the user's task flow. This "flexible yet rigid" design greatly optimizes the user experience while strictly ensuring security and compliance. It strengthens the implementation of the principle of least privilege: Through the mandatory binding and verification of semantic intent and permission policies, this invention ensures that every data access request initiated by the LLM strictly conforms to the minimum permission set configured for the user. This is crucial for preventing data misuse and meeting data security compliance requirements (such as GDPR and data security laws). It enhances system transparency and auditability: the process and basis for every control decision (allow, rewrite, or reject) are clearly recorded, providing a clear and reliable chain of evidence for security audits and incident tracing, thus strengthening the overall system's security transparency and manageability.

[0042] Although the invention has been described herein in conjunction with various embodiments, those skilled in the art will understand and implement other variations of the disclosed embodiments by reviewing the accompanying drawings, disclosure, and other materials. In this specification, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple components. A single processor or other unit can implement several functions listed in the specification. While certain measures are described in different embodiments, this does not mean that these measures cannot be combined to produce good results.

[0043] Although the invention has been described in conjunction with specific features and embodiments, it is obvious that various modifications and combinations can be made therein without departing from the spirit and scope of the invention. Accordingly, this specification and drawings are merely illustrative of the invention and are considered to cover any and all modifications, variations, combinations, or equivalents within the scope of the invention. Clearly, those skilled in the art can make various alterations and modifications to the invention without departing from its spirit and scope. Thus, if such modifications and modifications fall within the scope of the invention and its equivalents, the invention is also intended to include such modifications and modifications.

Claims

1. A large language model access control method fusing semantic intent and permission, characterized in that, The method comprises the following steps: S1: obtaining the query content input by the user, and obtaining the structured intent elements by performing semantic decomposition on the query content; S2: matching and verifying the structured intent elements with the permission policy library; S3: according to the verification result, dynamically processing the user query intent, including releasing, rewriting or rejecting the query request: if the semantic intent does not exceed the user's permission range, release the query content for subsequent processing; if the semantic intent partially exceeds the permission range and does not violate the permission policy, rewrite the query intent and re-perform matching and verification; if the semantic intent exceeds the permission range and violates the permission policy, reject the query request.

2. The method of claim 1, wherein in step S1, the structured intent elements include at least query action, target entity and limit condition, wherein: the query action includes query, statistics and export operations; the target entity includes business objects such as orders, customers and employees; the limit condition includes time, region, amount and responsible person constraint dimensions.

3. The method of claim 2, wherein the permission policy library adopts a structured storage mode of subject-operation-object-constraint, wherein: the subject is a user or a user role; the operation corresponds to the query action; the object corresponds to the target entity; the constraint matches the permission boundary of the limit condition.

4. The method of claim 3, wherein the matching and verification process in step S2 includes: comparing the query action, target entity and limit condition in the structured intent elements with the corresponding items in the permission policy library one by one; if the target entity is not authorized in the permission policy library, it is directly determined that the permission policy is violated; if the query action or the limit condition is inconsistent with the permission policy, it is determined that the permission range is partially or completely exceeded.

5. The method of claim 1, wherein in step S3, the process of rewriting the query intent includes: identifying and supplementing the missing permission constraints in the original intent elements; correcting the limit conditions in the original intent elements that conflict with the permission policy; retaining the contents in the original intent elements that are within the permission range; discarding the contents in the original intent elements that are irrelevant to the permission policy or exceed the range, thereby generating new structured intent elements.

6. The method of claim 1, wherein in step S3, when the query request is rejected, an interpretable rejection reason is also returned to the user, including the specific circumstances of the unauthorized target entity, the super-permission operation or the limit condition.

7. The method of claim 1, wherein the semantic decomposition in step S1 is implemented through natural language processing technology, including large language models or natural language understanding models.

8. The method of claim 1, wherein the permission policy library supports dynamic updating, including adding new user role permissions, modifying existing constraint conditions, and deleting invalid permission policies.

9. The method of claim 1, wherein the results of the dynamic processing in step S3 and the corresponding matching verification basis are recorded in real time to form a traceable access control log. The system comprises: ​ ​ ​ ​ ​ ​ ​ 10. A large language model access control system fusing semantic intent and permissions, for implementing the method of any one of claims 1 to 9, characterized in that, ​ A query interception module is deployed between a user interaction interface and a large language model core processing unit, configured to capture natural language query content input by a user; A semantic decomposition module is configured to perform semantic decomposition on the query content by using natural language processing technology, and output structured intent elements; A permission policy library is configured to store permission rules of different users or roles in a subject-operation-object-constraint structure; A permission verification engine is configured to match and verify the structured intent elements with the permission policy library, and output a verification result; A dynamic processing module is configured to perform a release, rewrite or rejection operation according to the verification result, wherein the rewrite operation generates a compliant query intent by correcting the intent elements, and the rejection operation returns an explainable reason.

Images