Unstructured data dynamic access control method and system
Through the collaborative design of the data parsing module, policy engine, and auditing module, the problem of lagging permission adaptation in unstructured data access control is solved, realizing dynamic adjustment and efficient access control, and improving the accuracy and security of permission management.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-19
- Publication Date
- 2026-04-14
AI Technical Summary
Existing unstructured data access control models rely on preset permissions or roles, which cannot adjust permissions in real time according to the dynamic changes in data status and access environment. This results in delayed permission adaptation or over-authorization, making it difficult to meet the needs of fine-grained dynamic management.
The system employs a data parsing module to extract multi-dimensional attributes, a policy engine to build a dynamic policy library based on the ABAC model, an access control enforcement module to verify attributes in real time and generate decisions, and an audit and feedback module to optimize policies, thereby achieving dynamic permission adjustment.
It achieves fine-grained and adaptive access control, ensuring that authorized users can access target data under compliant conditions, reducing the risk of data leakage, and improving the efficiency and accuracy of access control.
Smart Images
Figure CN121859338A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of computer data security and access control technology, specifically relating to a method and system for dynamic access control of unstructured data. Background Technology
[0002] The technological development in the field of unstructured data access control has evolved in multiple directions around core needs, mainly reflected in the following three aspects: Access control models have evolved from early discretionary access control (DAC) and mandatory access control (MAC) to role-based access control (RBAC), and further to hybrid models that combine roles and attributes. RBAC has become the mainstream choice for enterprise systems because it uses "roles" to assign permissions in batches. Hybrid models attempt to introduce attribute dimensions to improve adaptability, but they are still based on predefined logic and have limited dynamic adjustment capabilities.
[0003] Unstructured data parsing technology: For text data, a technology chain has been formed, from format parsing and basic metadata extraction to sensitive information identification. Natural language processing technology has further improved the depth of content understanding. For multimedia data such as images and videos, object detection algorithms can identify sensitive objects, but the ability to collaboratively parse multimodal data and extract business context attributes is still under development.
[0004] Dynamic strategies and risk assessment: Standard-based strategy engines have basic attribute rule matching capabilities and support a certain degree of strategy customization; risk assessment technologies mostly focus on single-dimensional indicator detection, such as access frequency and abnormal login environment, and attempt to assist decision-making through behavioral analysis, but the dynamic risk modeling and strategy linkage mechanism that integrates multiple attributes is not yet mature.
[0005] Despite the progress made by existing technologies in their respective fields, the following core limitations still exist when facing the dynamic and diverse characteristics of unstructured data and the needs of complex access scenarios: The static nature of access control models has limitations: existing models rely on preset permissions or roles, and cannot adjust permissions in real time according to dynamic changes in data status (such as changes in security level) and access environment (such as changes in network scenarios). In scenarios where unstructured data is frequently updated and access scenarios are varied, problems such as delayed permission adaptation or over-authorization may occur, making it difficult to meet the needs of fine-grained dynamic management.
[0006] Insufficient granularity and dimensionality in data parsing: The parsing accuracy of complex multimodal unstructured data needs to be improved, and sensitive information is easily missed; metadata extraction is mostly focused on basic attributes such as format and keywords, lacking in-depth mining of data business attributes (such as the project cycle and related business processes), resulting in an incomplete basis for policy matching and affecting the accuracy of access control.
[0007] Low integration of strategy and risk assessment: Most strategy engines only achieve static matching of "attribute-rule" and do not deeply embed real-time risk assessment into the decision-making process. Risk assessment is mostly an independent step with insufficient linkage with data attributes and access policies. It cannot dynamically adjust access permissions based on multi-dimensional risk indicators, making it difficult to effectively prevent potential security risks in complex scenarios.
[0008] Lack of technology stack synergy: Core technology modules such as data parsing, policy matching, and risk assessment are mostly developed independently, lacking end-to-end collaborative architecture design. Data flow between stages is not smooth, failing to form a closed-loop management from attribute extraction to policy optimization, resulting in "discontinuities" in the access control process and limiting overall management efficiency and adaptability. Summary of the Invention (a) Technical problems to be solved The technical problem this invention aims to solve is how to provide a method and system for dynamic access control of unstructured data, addressing the shortcomings of existing models that rely on preset permissions or roles and cannot adjust permissions in real time according to dynamic changes in data status and access environment. In scenarios where unstructured data is frequently updated and access scenarios are varied, problems such as delayed permission adaptation or over-authorization easily arise, making it difficult to meet the needs of fine-grained dynamic management.
[0009] (II) Technical Solution To address the aforementioned technical problems, this invention proposes a dynamic access control system for unstructured data, comprising: a data parsing module, a policy engine, an access control execution module, and an audit and feedback module. The data parsing module extracts unstructured data metadata and environmental attributes using text and image recognition technologies; The strategy engine is built on the ABAC model to create a dynamic strategy library that supports custom strategy rules. The access control enforcement module verifies subject attributes, object attributes, and environment attributes in real time and generates access decision results. The audit and feedback module records access logs, analyzes abnormal behavior using machine learning algorithms, and dynamically adjusts strategies.
[0010] This invention also provides a method for dynamic access control of unstructured data, the method comprising: S1. Users initiate unstructured data access requests through application programming interfaces or clients, carrying subject identifiers and target data identifiers; S2. The system parses the target data, extracts document format and keywords through a text parser, identifies sensitive content in images through image processing algorithms, and simultaneously collects environmental information, such as access time, device geographic location, and network security level. S3: The strategy engine retrieves the dynamic strategy library, matches the combination rules of "subject attribute + object attribute + environment attribute", and generates a candidate strategy set; combining historical access records and real-time behavior, it calculates the access risk value through the risk model and dynamically adjusts permissions. In high-risk scenarios, it restricts downloads to preview only; if access is allowed, a temporary token is generated; if access is denied, the reason is returned to the user.
[0011] (III) Beneficial Effects This invention proposes a dynamic access control method and system for unstructured data. It provides a method and system based on dynamic attribute matching and real-time risk assessment, achieving a fine-grained, adaptive access control mechanism. This method and system can dynamically adjust access permissions according to the real-time attributes and access environment of the data, ensuring that authorized users access target data under compliant conditions, effectively reducing the risk of data leakage and improving the efficiency and accuracy of access management. Attached Figure Description
[0012] Figure 1 This is a system architecture diagram of the present invention; Figure 2 This is a flowchart of the method of the present invention. Detailed Implementation
[0013] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.
[0014] This invention belongs to the field of computer data security and access control technology, and relates to dynamic permission management of unstructured data (such as documents, images, videos, logs, etc.). It addresses the limitations of traditional static access control strategies in scenarios involving the diversity and dynamism of unstructured data. In the process of digital transformation, the scale of data is growing exponentially, with the proportion of unstructured data significantly increasing. How to implement efficient access control for unstructured data and ensure data security and compliance has become one of the core challenges facing the current technology field. The technical solution proposed in this invention addresses this technical bottleneck, aiming to provide an innovative solution for unstructured data access control to meet the security needs and dynamic management requirements of complex business scenarios.
[0015] This invention provides a method and system for unstructured data access control based on dynamic attribute matching and real-time risk assessment, achieving a fine-grained, adaptive access control mechanism. This method and system can dynamically adjust access permissions according to the real-time attributes and access environment of the data, ensuring that authorized users access target data under compliant conditions, effectively reducing the risk of data leakage and improving the efficiency and accuracy of access management.
[0016] This invention provides an unstructured data access control system based on dynamic attribute matching and real-time risk assessment. The system adopts a layered architecture, including: a data parsing module, a policy engine, an access control execution module, and an audit and feedback module. The data parsing module is responsible for extracting multi-dimensional attributes; the policy engine generates dynamic policies based on the ABAC (Attribute-Based Access Control) model; the access control execution module implements real-time verification and decision output; and the audit and feedback module optimizes policies through log analysis, forming a closed-loop management system. Specifically, The data parsing module extracts unstructured data metadata (such as document type, sensitivity level, and creation time) and environmental attributes through text and image recognition technologies.
[0017] The strategy engine is built on the ABAC model to create a dynamic strategy library that supports custom strategy rules.
[0018] The access control enforcement module verifies subject attributes (user role, permission validity period), object attributes (data security level, update frequency) and environmental attributes in real time, and generates access decision results.
[0019] The audit and feedback module records access logs, analyzes abnormal behavior through machine learning algorithms, and dynamically adjusts strategies (such as triggering secondary authentication when downloading sensitive files frequently).
[0020] This layered architecture design ensures clear responsibilities for each module and efficient collaboration, enabling the efficient deployment and operation of dynamic access control for unstructured data.
[0021] This invention provides a method for unstructured data access control based on dynamic attribute matching and real-time risk assessment, comprising: By employing multi-dimensional attribute extraction, strategy matching, risk assessment, and dynamic decision-making, real-time control over unstructured data access is achieved, supporting dynamic adjustment of permissions based on data status and environmental changes. The specific process is as follows: S1. Users initiate unstructured data access requests through application programming interfaces (APIs) or clients, carrying subject identifiers (user ID, device fingerprint) and target data identifiers.
[0022] S2. The system parses the target data, extracting document format and keywords using a text parser (such as Apache Tika); and identifies sensitive content in images using image processing algorithms. Simultaneously, it collects environmental information, including access time, device geographic location, and network security level (e.g., corporate intranet / public network).
[0023] S3, the strategy engine, retrieves the dynamic strategy library, matches rules combining "subject attributes + object attributes + environment attributes," and generates a candidate strategy set. Combining historical access records (such as the number of recent failed access attempts by a user) with real-time behavior (such as multiple requests for the same data within a short period), it calculates the access risk value using a risk model and dynamically adjusts permissions (e.g., restricting downloads to preview only in high-risk scenarios). If access is allowed, a temporary token (including the permission's validity period) is generated; if access is denied, the reason is returned to the user.
[0024] This process design ensures both the rigor and flexibility of access control, enabling the output of reasonable decisions based on different access scenarios and risk conditions.
[0025] like Figure 1 As shown, the system of the present invention includes: Data parsing module: Responsible for parsing unstructured data, extracting key information and attributes, including components for parsing text, images, and videos.
[0026] Policy Engine: Includes a dynamic policy library and a rule parser, which generates access control policies based on the attribute information provided by the data parsing module.
[0027] Access control enforcement module: Based on the policy generated by the policy engine, it performs attribute validation on access requests, generates access tokens, and determines access permissions.
[0028] Audit module: Records access logs, analyzes logs to optimize policies, and provides data support for subsequent access control decisions.
[0029] like Figure 2 As shown, the process of the present invention includes: Access Request: The user initiates an unstructured data access request, the system receives the request and completes preliminary processing.
[0030] Attribute extraction: Extract object attributes, access request subject attributes, and environmental attributes from the target unstructured data to provide data support for subsequent strategy matching and risk assessment.
[0031] Policy matching: The policy engine retrieves the dynamic policy library, matches the extracted attribute information with preset dynamic policy rules, and generates an initial access decision.
[0032] Risk assessment: By combining historical access behavior with real-time risk models, the initial decision is risk-assessed, access risk values are calculated, and permissions are dynamically adjusted.
[0033] Decision execution: Based on the decision results after risk assessment, implement access control, output the result of allowing or denying access, and record the audit log.
[0034] Example 1: Building the hardware infrastructure to support the system's operation includes three parts: server cluster deployment, network environment configuration, and terminal device adaptation. 1. Server cluster node deployment: Deploy three types of functional server nodes.
[0035] Data parsing server: configured with CPU ≥ 8 cores, memory ≥ 64GB, and hard disk ≥ 2TB SSD, used to run text parsing and multimedia parsing services, and meet the needs of parallel processing of multiple types of unstructured data; Policy engine server: Configured with CPU ≥ 16 cores and memory ≥ 128GB, supports GPU acceleration to improve policy matching and risk calculation efficiency; Object storage server: Adopts a distributed architecture (≥3 nodes), with each node configured with ≥4 CPU cores, ≥32GB memory, and ≥4TB hard disk. It is based on MinIO to deploy unstructured data storage services to ensure high data availability.
[0036] 2. Network environment configuration: A VLAN-isolated network is set up, with the data parsing server and policy engine server deployed on the internal network segment. The object storage server communicates with the first two types of servers through a dedicated internal network line. The terminal device access end is configured with a VPN gateway to support encrypted access in the public network environment, with a network bandwidth of ≥100Mbps to ensure the data transmission of attributes and the response speed of access requests.
[0037] 3. Terminal device adaptation: It is compatible with terminal devices running Windows 10 and above, macOS 12 and above, and Linux CentOS 7 and above. It integrates a fingerprint recognition module or a face recognition module for enhanced authentication of the main body. The terminal hardware configuration must meet the requirements of CPU ≥ 4 cores and memory ≥ 8GB to ensure smooth operation of the client software.
[0038] The software functions are developed and configured in modules, specifically including a data parsing module, a policy engine module, an access control enforcement module, and an auditing and policy optimization module. 1. Data parsing module development: Text data processing: Integrate Apache Tika to parse document formats (such as PDF, DOCX), load pre-trained models to extract keywords, and use large models to identify sensitive paragraphs (such as text containing ID card numbers and mobile phone numbers). Multimedia data processing: A sensitive object detection dataset (including categories such as faces and official seals) is trained using a model to achieve image sensitive content recognition, parsing metadata such as image shooting time and device model, extracting video frames based on FFmpeg and calling the above model to detect sensitive frames; Environmental attribute collection: Based on the IP database, the geographical location corresponding to the device IP is resolved, and the network access type (internal network / public network) is determined by network interface status detection.
[0039] 2. Strategy Engine Module Configuration: Rule definition: AuthzForce is used as the core of the XACML policy engine, and policy rules are written in XML format; Policy Updates: Develop a web-based management console that allows administrators to add / modify policies via a form interface. After a policy change, it is synchronized to the dynamic policy library via a REST API with a synchronization frequency of ≤100ms.
[0040] 3. Development of the access control enforcement module: Attribute validation: A validation service developed based on Spring Boot receives the subject, object, and environment attribute sets output by the data parsing module and performs consistency verification with the matching results returned by the strategy engine (such as comparing the permission validity period with the current time). Token generation: A temporary access token in JWT format is generated using JJWT. The token payload includes the user ID, data ID, permission type (preview / download), and validity period (default 30 minutes). It is signed using the RSA 2048 algorithm, and the token is returned to the client via an HTTPS response.
[0041] 4. Development of the audit and strategy optimization module: Log storage: An Elasticsearch log storage cluster is built. Log data is written in JSON format, with fields including "requestId, userId, dataId, accessTime, riskScore, decisionResult". Log collection is implemented through Logstash, and a visualization dashboard is built using Kibana. Anomaly detection: The model is trained using "access frequency, risk score, and number of device changes" as features. When abnormal behavior is detected (the model outputs anomaly probability ≥ 0.8), an SMS / email alarm interface is triggered. Strategy optimization: By analyzing historical logs, the access pass rate and exception rate under different attribute combinations are statistically analyzed. When the exception rate of a certain combination is ≥5%, the strategy adjustment suggestion is automatically pushed to the administrator console.
[0042] System integration and testing Verify the overall system performance through inter-module interface integration testing and functional and performance testing. 1. Interface integration testing: Data parsing module and strategy engine: Attribute data transmission is achieved via the gRPC protocol, with a test attribute set serialization / deserialization success rate ≥99.9%; Policy engine and access control enforcement module: Uses RESTful API to interact with policy matching results, with a response time of ≤500ms; Access control enforcement module and auditing module: Audit logs are sent asynchronously via Kafka message queue, with a message loss rate of ≤0.1%.
[0043] 2. Functional testing: Basic functionality testing: Simulate different user roles (such as administrators and ordinary users) accessing data of different security levels in different environments (internal network / public network) to verify that the access decisions conform to the preset policies; Abnormal scenario testing: Simulate high-frequency access (50 requests within 1 minute), device change (same user switching to different IPs) and other scenarios to verify that the risk assessment module can dynamically adjust permissions (such as triggering two-factor authentication).
[0044] 3. Performance testing: Using JMeter to simulate 1000 concurrent user access requests, the average response time of the test system is ≤800ms, the throughput is ≥100 QPS, the CPU utilization is ≤70%, and the memory usage is ≤80%.
[0045] This invention provides a method and system for unstructured data access control based on dynamic attribute matching and real-time risk assessment, achieving a fine-grained, adaptive access control mechanism. This method and system can dynamically adjust access permissions according to the real-time attributes and access environment of the data, ensuring that authorized users access target data under compliant conditions, effectively reducing the risk of data leakage and improving the efficiency and accuracy of access management.
[0046] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.
Claims
1. A dynamic access control system for unstructured data, characterized in that, The system includes: a data parsing module, a policy engine, an access control enforcement module, and an auditing and feedback module; The data parsing module extracts unstructured data metadata and environmental attributes using text and image recognition technologies; The strategy engine is built on the ABAC model to create a dynamic strategy library that supports custom strategy rules. The access control enforcement module verifies subject attributes, object attributes, and environment attributes in real time and generates access decision results. The audit and feedback module records access logs, analyzes abnormal behavior using machine learning algorithms, and dynamically adjusts strategies.
2. The unstructured data dynamic access control system as described in claim 1, characterized in that, The system deploys three types of functional server nodes: Data parsing server: Used to run text parsing and multimedia parsing services to meet the needs of parallel processing of various types of unstructured data; Policy engine server: Supports GPU acceleration to improve the efficiency of policy matching and risk calculation; Object storage server: Adopts a distributed architecture and deploys unstructured data storage services based on MinIO to ensure high data availability.
3. The unstructured data dynamic access control system as described in claim 2, characterized in that, The system establishes a VLAN-isolated network, with the data parsing server and policy engine server deployed in the intranet segment, and the object storage server communicating with the first two types of servers through an intranet leased line; The terminal device access end is configured with a VPN gateway to support encrypted access in a public network environment.
4. The unstructured data dynamic access control system as described in claim 3, characterized in that, The terminal device integrates a fingerprint recognition module or a facial recognition module for enhanced authentication of the subject's identity.
5. The unstructured data dynamic access control system as described in claim 1, characterized in that, The data parsing module performs the following processing: Text data processing: Integrates Apache Tika to parse document formats, loads pre-trained models to extract keywords, and uses large models to identify sensitive paragraphs; Multimedia data processing: The sensitive object detection dataset is trained using a model to achieve image sensitive content recognition, parsing image shooting time and device model metadata, extracting video frames based on FFmpeg and calling the above model to detect sensitive frames; Environmental attribute collection: Based on the IP database, the geographical location corresponding to the device IP is resolved, and the network access type is determined by network interface status detection.
6. The unstructured data dynamic access control system as described in claim 1, characterized in that, The strategy engine performs the following processing: Rule definition: AuthzForce is used as the core of the XACML policy engine, and policy rules are written in XML format; Policy Updates: Develop a web-based management console that allows administrators to add / modify policies via a form interface. After a policy change, it is synchronized to the dynamic policy library via a REST API.
7. The unstructured data dynamic access control system as described in claim 1, characterized in that, The access control enforcement module performs the following processing: Attribute validation: A validation service developed based on Spring Boot receives the subject, object, and environment attribute sets output by the data parsing module and performs consistency verification with the matching results returned by the strategy engine; Token generation: A temporary access token in JWT format is generated using JJWT. The token payload includes the user ID, data ID, permission type, and validity period. It is signed using the RSA 2048 algorithm, and the token is returned to the client via an HTTPS response.
8. The unstructured data dynamic access control system as described in claim 1, characterized in that, The audit and strategy optimization module performs the following processing: Log storage: An Elasticsearch log storage cluster is built. Log data is written in JSON format, with fields including "requestId, userId, dataId, accessTime, riskScore, decisionResult". Log collection is implemented through Logstash, and a visualization dashboard is built using Kibana. Anomaly detection: The model is trained using "access frequency, risk score, and number of device changes" as features. When abnormal behavior is detected, an SMS / email alarm interface is triggered. Strategy optimization: By analyzing historical logs, the access pass rate and exception rate under different attribute combinations are statistically analyzed. When the exception rate of a certain combination is ≥5%, the strategy adjustment suggestion is automatically pushed to the administrator console.
9. A method for dynamic access control of unstructured data based on the system according to any one of claims 1-8, characterized in that, The method includes: S1. Users initiate unstructured data access requests through application programming interfaces or clients, carrying subject identifiers and target data identifiers; S2. The system parses the target data, extracts document format and keywords through a text parser, identifies sensitive content in images through image processing algorithms, and simultaneously collects environmental information, such as access time, device geographic location, and network security level. S3: The strategy engine retrieves the dynamic strategy library, matches the combination rules of "subject attribute + object attribute + environment attribute", and generates a candidate strategy set; combining historical access records and real-time behavior, it calculates the access risk value through the risk model, dynamically adjusts permissions, and restricts downloads to preview only in high-risk scenarios; if access is allowed, a temporary token is generated, and if access is denied, the reason is returned to the user.
10. The method for dynamic access control of unstructured data as described in claim 9, characterized in that, The method specifically includes: Access Request: The user initiates an unstructured data access request, the system receives the request and completes preliminary processing; Attribute extraction: Extract object attributes, access request subject attributes, and environmental attributes from the target unstructured data to provide data support for subsequent strategy matching and risk assessment; Policy matching: The policy engine retrieves the dynamic policy library, matches the extracted attribute information with preset dynamic policy rules, and generates an initial access decision; Risk assessment: By combining historical access behavior with real-time risk models, the initial decision is risk-assessed, access risk values are calculated, and permissions are dynamically adjusted. Decision execution: Based on the decision results after risk assessment, implement access control, output the result of allowing or denying access, and record the audit log.