Network access control intelligent query and authorization method fused with large model

Abstract

The invention provides a line network access control intelligent query and authorization method fused with a large model, which constructs an independent service access large model on the basis of an existing line network access control system, adds natural language interaction capability, depends on a local semantic resource library, and combines semantic analysis capability of the large model to complete user intention analysis and entity extraction. Information retrieval and employee permission change are intelligently executed; meanwhile, a data desensitization mechanism is established, and the sensitive data leakage risk is reduced. Compared with the prior art, query and authorization driven by natural languages are realized, the interaction efficiency can be remarkably improved, the data security can be ensured, and the method is suitable for intelligent upgrading of the access control system of the urban rail transit network.

Description

TECHNICAL FIELD

[0001] The application relates to the field of access control technology, and in particular to an intelligent query and authorization method for line network access control integrated with a large model. BACKGROUND

[0002] As a key facility for ensuring the safety of subway operation, the core business of the line network access control system covers multiple dimensions such as multi-level employee permission management, massive access record tracing, and real-time monitoring of device status. With the expansion of the scale of rail transit network, the management objects are growing exponentially, and the data dimensions and functional coupling of the system are becoming increasingly complex. Currently, the line network access control system generally adopts a tree menu and structured form interactive mode. In the face of emergency disposal or complex operation and maintenance scenarios, this traditional interactive mode has significant technical limitations: 1. High complexity of cross-domain data retrieval: Composite business requirements (such as the correlation query of employee information, access permission, and mobile trajectory) involve joint retrieval of multiple data tables, which requires manual aggregation of scattered retrieval results by business personnel. The more the information dimensions, the higher the time cost; 2. Long business operation chain: Key businesses such as authorization require multiple operations such as object retrieval, page jump, permission selection, confirmation submission, and the response efficiency is low, which cannot meet the needs of fast response scenarios.

[0003] To alleviate the above problems, the industry attempts to use page aggregation and process orchestration to shorten the operation path, but such solutions are based on pre-set rules for static processing, have high invasiveness to existing systems, and cannot fundamentally solve the problem of unstructured instruction intent recognition.

[0004] In recent years, large language models have shown great potential in semantic analysis and intent reasoning, providing a new technical path for reconstructing the interactive mode of line network access control systems. However, directly applying large models to high-security level line network access control systems still faces many challenges: 1. General models lack the recognition of line network access control specific terminology and specific business rules, which can easily generate logically incorrect or illegal control instructions, posing a security risk; 2. The personnel information and access records involved in the system are sensitive data, and their leakage risk in data interaction cannot be ignored. SUMMARY

[0005] The purpose of the present application is to provide an intelligent query and authorization method integrated with a large model to address the low efficiency of data query and authorization in complex scenarios of existing line network access control systems. Combining the semantic analysis capability of large models, the system performs intent recognition and entity extraction on the user's natural language instructions, automatically matches and executes corresponding business processing, effectively improving query response efficiency and simplifying permission management processes.

[0006] Meanwhile, the application implements hierarchical desensitization on sensitive data in the intelligent query and authorization process, reduces the data leakage risk in the model interaction process by shielding and generalizing the key information, and finally realizes the consideration of system intelligent upgrading and data security guarantee. The method comprises the following steps: S1: receiving a natural language instruction input by a user; S2: establishing a session management mechanism, concatenating and truncating the context of the historical dialogue; completing text regularization, keyword standardization, operation intention recognition and entity information pre-labeling based on a semantic resource library; S3: constructing a prompt word project for line and network access control business, calling a large model to complete user intention confirmation, entity recognition consistency and information completion, and calculating the confidence of this analysis; S4: performing confidence test and path selection: when the analysis confidence meets the threshold condition of business execution, the large model analysis result is retained; when the condition is not met, the local deterministic analysis is entered, and the final confirmation and calibration of user intention and entity information are completed; S5: performing business processing, for query type requests, calling pre-constructed SQL statements to complete data query according to the analysis result, and the query can cover complex data such as employee basic information, permission data and mobile trajectory; for authorization type requests, external verification and permission conflict detection are completed before execution, and after the precondition is met, the employee permission is granted or revoked according to the permission configuration in the analysis result, and the authorization result is generated; S6: performing hierarchical desensitization strategy on the business result, including sensitive fields such as employee ID number, mobile phone number and email; S7: calling a large model to structure and encapsulate the desensitized data, and generating a display instruction; S8: realizing data visualization display by the front end.

[0007] As a preferred mode of the application, in step S2, the semantic resource library includes a line and network access control field dictionary and an entity dictionary, and can be extended to other languages as needed.

[0008] As a preferred mode of the application, the large model called in step S3 includes DeepSeek series, Tongyi Qianwen series and Doubao series models.

[0009] As a preferred mode of the application, in step S4, if the recalculated confidence is higher than the minimum executable threshold, the business processing is continued; if the confidence is lower than the minimum executable threshold, the analysis fails and the process is terminated.

[0010] As a preferred mode of the present application, the processing flow for the authorized operation in step S5 is as follows: Enter the authorization processing flow, perform external verification before changing the right, including verifying the employee state and the validity of the access card, and dynamically checking the right state of the employee and the access card on the target line during the authorization process; Then branch according to the external verification and conflict detection results: if the verification fails, return the authorization failure reason; if the verification passes, submit the right change application and get the execution result.

[0011] As a preferred mode of the present application, the processing flow of data desensitization in step S6 is as follows: C1: After the query or authorization result is generated, first perform sensitive item positioning on the output data, use the rule library and regular to identify structured fields and text fields one by one, and form a list of fields to be processed; C2: Based on the field type, authorization scenario and access role, determine the risk level and processing priority of each sensitive element, and form a strategy mapping; C3: Based on the risk level, generate a hierarchical desensitization strategy for each field, which is specifically divided into invisible, desensitized visible and completely visible; C4: Do not output for invisible fields, perform hierarchical desensitization on desensitized visible fields according to rules, and directly output completely visible fields; C5: Record basic audit information for each output record, which is used for traceability and compliance retention.

[0012] As a preferred mode of the present application, in step S8, the visual display includes multiple forms such as tables and graphs, as well as grouping and sorting display control items.

[0013] Compared with the prior art, the present application has the following beneficial effects: (1) The user only needs to input natural language to complete the complex data query of employee information, right data and mobile trajectory, and can automatically complete the employee right granting, revoking and batch processing, effectively improving the system operation efficiency.

[0014] (2) By constructing a desensitization mechanism for business data, the query and authorization type business data is desensitized, and the desensitization degree can be dynamically adjusted according to the user's right level, which not only avoids the risk of data leakage in the process of large model interaction, but also guarantees the normal data use demand of the user, realizes the two-way balance of intelligent upgrading and data security protection of the line and network access control system. BRIEF DESCRIPTION OF DRAWINGS

[0015] Figure 1 The method flowchart of the present application.

[0016] Figure 2A large model-based line network access control intelligent query flowchart of the application.

[0017] Figure 3 A large model-based line network access control intelligent authorization flowchart of the application.

[0018] Figure 4 A data desensitization flowchart of the application. DETAILED DESCRIPTION

[0019] The application supports the access of multiple large models on the basis of interfacing with the data model and business logic of the existing line network access control system, and adds intelligent query and authorization functions driven by natural language. Figure 1 The method flowchart is shown in the figure, and the specific process is as follows: S1: receiving a natural language instruction input by a user; S2: establishing a session management mechanism to splice and truncate the context of historical dialogues; completing text regularization, keyword standardization, operation intention recognition, and entity information pre-labeling based on a semantic resource library; S3: constructing a prompt word project for line network access control business, calling a large model to complete user intention confirmation, entity recognition consistency, and information completion, and calculating the confidence of this analysis; S4: performing confidence test and path selection: when the analysis confidence meets the threshold condition of business execution, the large model analysis result is retained; when the condition is not met, local deterministic analysis is entered to complete the final confirmation and calibration of user intention and entity information; S5: executing business processing, for query type requests, calling pre-constructed SQL statements to complete data query according to the analysis result, and the query can cover composite data such as employee basic information, permission data, and mobile trajectory; for authorization type requests, external verification and permission conflict detection are completed before execution, and after the precondition is met, the employee permission is granted or revoked according to the permission configuration in the analysis result, and an authorization result is generated; S6: performing a hierarchical desensitization strategy on the business result, including sensitive fields such as employee ID number, mobile phone number, and email; S7: calling a large model to structure and encapsulate the desensitized data, and generating a display instruction; S8: realizing data visualization display by the front end.

[0020] The semantic repository is composed of a line network access domain dictionary and an entity dictionary, and can be extended to other languages as needed. The domain dictionary is used to standardize action synonyms, abbreviations, professional terms, and time range keywords, and the entity dictionary is used to maintain the standard names, aliases, and hierarchical relationships of entities such as lines, stations, departments, and equipment. The repository is implemented based on the combination of rule templates, regular sets, domain keyword sets, and entity recognition templates, and is stored in the form of local configuration or database, supporting versioning and hot updating; in the preprocessing stage, the input text is cleaned of symbols, spaces, and useless text, synonyms of action, time range, and other keywords are merged, and entities such as names, numbers, stations, and equipment are pre-labeled, providing a stable semantic foundation for subsequent analysis and execution.

[0021] The prompt word engineering is a key technology for large models to understand natural language, and uses structured and constrained design to improve the accuracy and stability of large models in analyzing natural language. By predefining roles, providing a few sample examples, and providing unified JSON output rules (including employee name, employee number, department name, permission configuration, time range, and other key fields), and setting confidence evaluation for the analysis results.

[0022] The operation intent refers to the core demand corresponding to the user's input natural language, and the system divides the operation intent into query and authorization classes. The query class of operation includes but is not limited to department information query, employee basic information query, access permission query, permission hierarchy query, permission change history query, and mobile track query, supporting multi-element combination query by employee name, employee number, department name, and time range. The authorization class of operation includes employee permission granting, revoking, and batch authorization.

[0023] The confidence refers to the quantitative score of the reliability of the large model analysis result, with a value range of [0, 1], and is used to complete the process boundary of "automatic execution / local deterministic analysis / rejection processing". The score is obtained by fusing multiple signals, including the confidence given by the large model, keyword consistency and semantic matching degree, key information completeness (employee identification field, permission configuration, time range, etc.), and imposing penalties and weight reduction on missing or contradictory elements.

[0024] The local deterministic analysis refers to the structured analysis of natural language requests based on preprocessing output results, predefined analysis rules, regular templates, and intent keyword tables (a subset of the semantic repository) when the confidence threshold is passed, generating user intent and entity information. The processing flow includes input normalization, regularized entity extraction, intent determination, and structured object output.

[0025] In combination with the accompanying Figure 2 A line network access intelligent query process based on a large model is as follows: A1: Receive a natural language request to "query the personal information and permission data of an employee"; A2: Combine the conversation history context and semantic resource library to perform text regularization, keyword normalization, and operation intent recognition on the user input, and label the employee and permission-related entities; A3: Call the large model to perform semantic analysis and secondary confirmation, and perform consistency verification on the intent and entity; determine the intent as a combined query of personal information and access control, extract elements such as employee name or employee number, and output the analysis confidence of this time; A4: The system selects the execution path according to the confidence score: A41: When the confidence returned by the large model is higher than the execution threshold, the system uses the large model analysis result and performs subsequent business processing; A42: If the confidence is lower than the execution threshold, use local deterministic analysis and recalculate the confidence; A421: If the recalculated confidence is higher than the minimum executable threshold, continue to execute the business process; A422: If the confidence is lower than the minimum executable threshold, return the analysis failure and terminate the process; A5: According to the analysis result, call the pre-built SQL statement to perform multi-table association query of employee information, permission configuration, organizational relationship, etc. and statistical and summary of query results according to business dimensions such as employee, department, and time; A6: Perform hierarchical desensitization on sensitive fields such as ID number, mobile phone number, and email in the query results according to the policy; A7: Call the large model to structure and encapsulate the desensitized data, and generate display instructions according to the preset large model output constraints; A8: Visualize the query results by the front end.

[0026] In conjunction with the attached Figure 3 , a large model-based line and network access control intelligent authorization process is as follows: B1: Receive a natural language request from a user to "grant / revoke certain line / station / department access control to an employee"; B2: Combine the conversation history context and semantic resource library to perform text regularization, permission operation, and time range keyword normalization, and complete the identification and labeling of employee and permission-related entities; B3: Call the large model to perform semantic analysis and secondary confirmation, and perform consistency verification on the intent and entity; determine the final operation intent, extract the target subject, permission configuration, and time range, and calculate the analysis confidence of this time; B4: The system selects a path according to the confidence score, and the specific processing flow is consistent with A4. When the confidence score meets the execution threshold condition, the business processing is continued; B5: Enter the authorization processing flow, perform external verification before changing the authority, including verifying the employee state, the validity of the access card, and dynamically checking the authority state of the employee and the access card on the target line during the authorization process; B6: Branch according to the results of external verification and authority conflict checking: B61: The inspection fails, and the reason for the authorization failure is returned; B62: The inspection passes, the authority change application is submitted, and the execution result is obtained; B7: The sensitive fields such as ID number, mobile phone number, and email in the business data are classified and desensitized according to the policy; B8: Call the large model to structure and package the desensitized data, and generate display instructions; B9: The front end visualizes the authorization result.

[0027] In combination with the accompanying Figure 4 In the intelligent query and authorization process, the data classified desensitization processing is as follows: C1: After the query or authorization result is generated, the output data is first executed for sensitive item positioning. The rule library and regular are used to identify structured fields (ID number, mobile phone number, email, card number, etc.) and text fields one by one, forming a list of fields to be processed; C2: Based on the field type, authorization scenario, and access role, determine the risk level and processing priority of each sensitive element, and form a policy mapping; C3: Based on the risk level, generate a classified desensitization policy for each field, which is divided into invisible, desensitized visible, and completely visible. For desensitized visible fields, apply the preset mask template, which is configured to retain the first and last 4 digits of the ID number, retain the first 3 and last 4 digits of the mobile phone number, and retain the first character and domain name of the email, and replace and shield the remaining middle characters; C4: The invisible field is not output, the desensitized visible field is desensitized according to the rules, and the completely visible field is directly output; C5: Basic audit information (such as user, request content summary, business processing type, processing result) is recorded for each output record, which is used for traceability and compliance retention.

[0028] The above merely describes preferred embodiments of the present application and is not intended to limit the present application. Those skilled in the art can make functional extensions or combined applications to the system architecture, model type and access mode, execution threshold condition, data desensitization strategy, external verification rule, etc. without departing from the spirit and essence of the present application, which shall be considered to fall within the protection scope of the present application. The protection scope of the present application shall be subject to the appended claims.

Claims

1. A method for intelligent query and authorization of a line net access control system based on a large fusion model, characterized in that, Comprise the following steps: S1: receiving a user input natural language instruction; S2: establishing a session management mechanism, concatenating and truncating the historical dialogue in context; based on the semantic resource library, completing text regularization, keyword standardization, operation intent recognition and entity information pre-labeling; S3: constructing a prompt word engineering for line and network access control business, calling a large model to complete user intent confirmation, entity recognition consistency and information completion, and calculating the confidence of this analysis; S4: perform confidence test and path selection: when the analysis confidence meets the threshold condition of business execution, retain the large model analysis result; when the condition is not met, enter local deterministic analysis to complete the final confirmation and calibration of user intent and entity information; S5: execute business processing, for query type requests, call pre-built SQL statements to complete data query according to the analysis result; for authorization type requests, complete external verification and permission conflict detection before execution, execute employee permission change after the precondition is met, and generate authorization result; S6: execute the hierarchical desensitization strategy on the business result; S7: call the large model to structure and package the desensitized data, and generate display instructions; S8: realize data visualization display by the front end.

2. The method of claim 1, wherein: In step S2, the semantic resource library includes line and network access control domain dictionary and entity dictionary, supports Chinese and English by default, and can be extended to other languages as needed; the domain dictionary is used to standardize action synonyms and abbreviations, professional terms and time range keywords, and the entity dictionary is used to maintain the standard names, aliases and hierarchical relationships of line, station, department and equipment entities; The semantic resource library is realized based on the combination of rule templates, regular sets, domain keyword sets and entity recognition templates, and is stored in the form of local configuration or database, supporting versioning and hot updating; In the preprocessing stage, the input text is cleaned of symbols, spaces and useless text, action, time and range are merged, and names, numbers, station and equipment entities are pre-labeled to provide a stable semantic basis for subsequent analysis and execution.

3. The method of claim 1, wherein: In step S2, the operation intent refers to the core demand corresponding to the user input natural language, and the system divides the operation intent into query type and authorization type; wherein, the query type operation includes department information query, employee basic information query, access control permission query, permission hierarchical structure query, permission change history query and mobile track query, supporting multi-element combined query according to employee name, employee number, department name and time range; the authorization type operation includes employee permission granting, revoking and batch authorization.

4. The method of claim 1, wherein: In step S3, the confidence refers to the quantitative score of the reliability of the large model analysis result, with a value range of [0, 1], which is used to complete the process boundary of "automatic execution / local deterministic analysis / rejection processing"; the score is obtained by fusing multiple signals, including the confidence given by the large model, keyword consistency and semantic matching degree, and key information completeness, which imposes punishment and weight reduction on missing or contradictory elements.

5. The method of claim 1, wherein: In step S4, if the recalculated confidence is higher than the minimum executable threshold, the business processing is continued; if the confidence is lower than the minimum executable threshold, the parsing fails and the process is terminated.

6. The method of claim 1, wherein: In step S4, the local deterministic parsing refers to structuring the natural language request based on the pre-processing output result, the pre-defined parsing rules, the regular templates and the intent keyword table when the confidence gating determines to enter the local path, to generate the user intent and entity information; the processing flow includes input normalization, rule-based entity extraction, intent determination and structured object output.

7. The method according to claim 1 or 3, characterized by: The processing flow of the authorized operation in step S5 is as follows: Enter the authorization processing flow, perform external verification before the permission change, including verifying the employee state and the access card validity, and dynamically checking the permission state of the employee and the access card on the target line during the authorization process; Then branch according to the external verification and conflict checking results: if the checking fails, return the authorization failure reason; If the checking passes, submit the permission change application and get the execution result.

8. The method of claim 1, wherein: The processing flow of data desensitization in step S6 is as follows: C1: After the query or authorization result is generated, first perform sensitive item positioning on the output data, use the rule library and regular to identify the structured fields and text fields one by one, and form a list of fields to be processed; C2: Based on the field type, authorization scenario and access role, determine the risk level and processing priority of each sensitive element, and form a strategy mapping; C3: Based on the risk level, generate a hierarchical desensitization strategy for each field, which is specifically divided into invisible, desensitized visible and completely visible; C4: Do not output for invisible fields, perform hierarchical desensitization on desensitized visible fields according to rules, and directly output completely visible fields; C5: Record basic audit information for each output record for traceability and compliance retention.

9. The method of claim 1, wherein: In step S8, the visual display includes multiple forms such as tables and graphs, as well as grouping and sorting display control items.

Images