Access connector use control method and system based on semantic derivation and behavior map

Abstract

The invention belongs to the technical field of secure circulation and access control of trusted data space, and particularly relates to an access connector use control method and system based on semantic derivation and behavior atlas, which is applied to a localized adaptive EDC architecture and comprises an EDC connector provided with a control surface and a data surface. The control method comprises the following steps: receiving a digital contract by a control plane, and generating a strategy instruction packet with version control based on a semantic analysis technology; and the digital contract received by the control plane is transmitted through a digital signal processing DSP protocol. Through mutual cooperation of a semantic derivation mechanism, an edge autonomous architecture, a behavior map technology and localization adaptation, the effects of intelligent cognition, flexible execution and dynamic defense are achieved, and on the premise of ensuring complete localization autonomous controllability, refined and intelligent management and control of the whole life cycle of data circulation are achieved.

Description

Technical Field

[0001] This invention belongs to the field of secure circulation and access control technology in trusted data space, and specifically relates to an access connector usage control method and system based on semantic inference and behavioral graph. Background Technology

[0002] As a core component for building an international data space, Eclipse Dataspace Connector (EDC) effectively solves the interoperability problem of cross-platform data transmission through the Dataspace Protocol (DSP), providing a standardized framework for global data circulation. However, when this technology is applied in practice (especially in the high-standard scenario of "trustworthy circulation and independent control" in China), its limitations and shortcomings gradually become apparent. Specifically, existing EDC policy mapping mechanisms exhibit significant rigidity—their policy engines are mostly based on simple static "field-value" rule mappings, capable of handling only explicit, single constraints, but struggling to understand the complex contextual constraints prevalent in digital contracts (such as unstructured or vague descriptions like "access sensitive patient data only in emergency medical situations" or "provide only the minimum necessary input fields in federated computing scenarios"). This mechanical semantic processing capability often leads to an imbalance where the policy execution scope is either too broad (over-authorization) or too narrow (unreasonable restrictions), failing to meet the needs of refined usage control. Furthermore, the strong coupling between the control plane and data plane in the native EDC architecture further exacerbates application risks. Furthermore, access control decisions on the data plane are highly dependent on the real-time response of the control plane (such as policy queries and dynamic authentication). Once the control plane becomes unreachable due to network jitter, server downtime, or DDoS attacks, the data plane will be in a state of "paralysis" (unable to execute new requests) or "default denial" (blocking all access), which will seriously affect the continuity of critical business (such as real-time sharing of medical data and collaborative control of industrial equipment) and make it difficult to meet the requirements of high availability. Furthermore, existing defense capabilities using control technologies are inadequate when facing new threats. They are mostly based on static thresholds such as frequency (e.g., "maximum 10 times per minute") and time period (e.g., "access is only allowed on weekdays from 9:00 to 18:00"). For advanced threats that are highly covert and have behavioral patterns similar to normal access, such as "low-frequency slow crawling" (e.g., 100 unauthorized accesses performed in a scattered manner within 24 hours) and "aggregate attacks disguised as normal reads" (e.g., multiple compliant reads followed by the splicing of sensitive data), static rules based on counters or time windows cannot be effectively identified through behavioral pattern analysis, leading to the failure of defense mechanisms. In particular, existing solutions have significant shortcomings in terms of deep adaptation to domestic technologies. Currently, the localization adaptation of EDC (Electronic Data Center) technology largely focuses on application-layer function migration (such as replacing interface languages ​​and ensuring compatibility with domestic databases). It has not achieved deep integration with domestic chip instruction sets (such as Loongson and Hygon), operating system kernel-level security mechanisms (such as the Kylin security enhancement module), and national cryptographic algorithms (SM series). For example, the lack of integration of SM2 signature or SM3 hash algorithm in the evidence storage process results in data credibility failing to meet the requirements of the Cryptography Law. The failure to adapt policy execution to the parallel computing instructions of domestic chips leads to significant performance losses. In summary, the deficiencies of existing EDC technology in semantic policy derivation, edge autonomy capabilities, dynamic threat identification, and deep localization adaptation make it difficult to meet the high standards of "trustworthy circulation and independent controllability" required in China. Summary of the Invention

[0003] (a) Technical problems to be solved This invention aims to overcome the limitations of existing technologies by introducing semantic parsing, edge autonomous architecture, and behavioral graph analysis technologies to construct an access connector usage control method and system based on semantic inference and behavioral graphs, which has the capabilities of "intelligent cognition, resilient execution, and dynamic defense." Under the premise of ensuring complete domestic production and independent control, it achieves refined and intelligent management and control of the entire life cycle of data circulation.

[0004] (II) Technical Solution This invention is achieved through the following technical solution: This invention proposes an access connector usage control method based on semantic inference and behavioral graphs, applied to the domestically adapted Eclipse Dataspace Connector (EDC) architecture, including an EDC connector, which has a control plane and a data plane, and the control method includes: S1: The control plane receives the digital contract and generates a policy instruction package with version control based on semantic parsing technology; the digital contract received by the control plane is transmitted through the Digital Signal Processing (DSP) protocol; the semantic parsing technology is implemented through a built-in domain-specific language (DSL) parser and an ontology knowledge base, specifically including: I) Perform semantic understanding and contextual analysis on unstructured constraints in digital contracts; II) Based on the principle of least privilege, automatically derive the optimal set of strategies that includes environmental awareness, operational boundaries, and data strength; III) Generate a policy instruction package with version control; The specific implementations of "semantic understanding and contextual analysis" in step (I) and "automatic derivation of the optimal strategy set" in step (II) include: Map the natural language descriptions or fuzzy constraints in digital contracts to entities and relations in the ontology model (e.g., map "limit user A's daily access count" to a triple of "user entity - operation behavior - time constraint"). Use inference engines to check for conflicts and redundancies between policies (e.g., identify contradictory rules such as "allow user A to access data X" and "prohibit user A from accessing data X" and eliminate invalid rules). The optimized logic is converted into policy-as-code executable by the EDC connector, ensuring consistent policy interpretation across EDC connector nodes (e.g., converting to machine-readable policies in JSON or YAML format). S2: The control plane distributes policy instruction packets to the data plane. The data plane parses and loads them into its local high-performance cache, forming a policy snapshot. Specifically, the control plane sends policy instruction packets to the data plane via an asynchronous event bus; the data plane parses the policy instruction packets and loads them into its local high-performance cache to form a policy snapshot; the data plane maintains its connection with the control plane through bidirectional heartbeat signaling (e.g., sending a heartbeat packet every 30 seconds); when the data plane detects a connection interruption or network jitter, it automatically switches to edge autonomous mode and continuously executes access control based on the policy snapshot, triggering a fail-safe protection mechanism. The edge autonomous mode is specifically manifested as follows: During periods when the control plane is unreachable, the data plane maintains control over existing data transmission channels and accepts new compliance requests based on policy snapshots (e.g., rejecting unauthorized access that does not conform to policy snapshots). The generated execution logs and state changes are cached in a local secure queue (using tamper-proof storage, such as a circular buffer + hash verification). Once the connection is restored, the cached data will be sent back to the control plane via an incremental synchronization mechanism to ensure eventual consistency (only the changed parts will be synchronized to avoid full data transmission). S3: During data transmission, i.e., when an external entity accesses data through the EDC connector, the EDC connector uses a policy snapshot and non-invasive probes to collect multi-dimensional behavioral feature data, constructing a dynamic behavioral graph based on a time-sliding window. Simultaneously, it utilizes a lightweight graph neural network or real-time graph traversal algorithm to assess data transmission risks in real time. If the risk value exceeds a threshold, transmission is blocked and a circuit breaker mechanism is triggered. Specifically, constructing the dynamic behavioral graph based on a time-sliding window involves: A real-time heterogeneous graph is constructed using access subjects (such as user ID, device ID), data assets (such as database tables, file paths), IP addresses, and operation types (read / write / delete) as nodes, and interactive behaviors (such as "user A reads data X from IP123") as edges. Extract edge attribute features, including time interval (time difference between two operations), data entropy value (complexity of data content), and request payload size (such as the number of bytes in the HTTP request body). By calculating the centrality of the main nodes in the graph (such as degree centrality and betweenness centrality), abnormal subgraph structure (such as a large number of edges pointing to the same data asset in a short period of time), or random walk probability (to assess the persistence of abnormal behavior), we can identify batch downloads, low-frequency slow crawling, or data aggregation attacks disguised as normal access. The feature is that the time sliding window length of the dynamic behavior graph is configurable (e.g., 5 minutes, 10 minutes), and the window sliding step size is dynamically matched with the data transmission frequency (e.g., the window step size is set to 30 seconds in high-frequency transmission scenarios and 2 minutes in low-frequency scenarios).

[0005] Furthermore, the multi-dimensional behavioral feature data collected by the non-invasive probe includes, but is not limited to: the identity of the accessing subject, the type of data operation (read / write / delete), the data flow direction (source IP / destination IP), the operation timestamp, the data volume and the protocol type (such as HTTP / HTTPS / MQTT).

[0006] Furthermore, the lightweight graph neural network is a simplified version of the graph convolutional network GCN or the graph attention network GAT, or an optimized variant of the graph traversal algorithm, namely depth-first search (DFS) or breadth-first search (BFS), with the introduction of pruning strategies. The simplified version's parameter size is compressed to less than 1 / 10 of the original model.

[0007] Furthermore, the method also includes step S4: structurally encapsulating the policy derivation record, autonomous execution state, abnormal snapshot of the behavior graph, and original access log; performing digest calculation and signing using a domestically developed cryptographic algorithm; asynchronously synchronizing the encrypted evidence storage data to the blockchain network for evidence storage; the domestically developed cryptographic algorithm includes the SM2 asymmetric encryption algorithm (for signing), the SM3 hash algorithm (for digest calculation), or the SM4 symmetric encryption algorithm (for log encryption).

[0008] On the other hand, in order to implement the control method described in any of the above claims, the present invention also provides an access connector usage control system based on semantic derivation and behavioral graphs, comprising: Control plane module: integrates DSL parser, Ontology knowledge base, policy generation engine and inference engine, used to receive digital contracts transmitted by DSP protocol, perform semantic parsing and policy optimization and generate policy instruction packets; Data plane module: includes high-performance cache, bidirectional heartbeat signaling module, edge autonomous engine and local security queue, used to load policy snapshots, enforce access control and cache exception logs; Behavior acquisition module: Composed of non-invasive probes, deployed in the data transmission link, used to collect multi-dimensional behavioral feature data; Risk assessment module: integrates lightweight graph neural networks or real-time graph traversal algorithms to construct dynamic heterogeneous graphs, calculate node / edge features, and assess risk values ​​in real time; Evidence storage and traceability module: Includes a domestically developed cryptographic algorithm engine and blockchain interface, used for structured encapsulation of data and synchronization to the blockchain for evidence storage.

[0009] On the other hand, the present invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements any of the above-described use control methods.

[0010] On the other hand, the present invention also provides an electronic device, which includes a processor and a memory, the memory storing a computer program, and the processor executing the computer program to implement any of the above-mentioned use control methods, or the electronic device integrates the above-mentioned use control system, and the control method is implemented collaboratively through a control plane module, a data plane module, a behavior acquisition module, a risk assessment module and an evidence storage and traceability module.

[0011] (III) Beneficial Effects Compared with the prior art, the present invention has the following advantages: This invention achieves intelligent cognition, resilient execution, and dynamic defense through the synergy of semantic inference mechanism, edge autonomous architecture, behavioral graph technology, and domestic adaptation. Specifically, the semantic inference mechanism is based on the deep integration of domain-specific language (DSL) and ontology. It transforms the fuzzy constraints and complex logic of natural language in digital contracts into a machine-understandable semantic model. Through the inference engine, it automatically detects and optimizes policy conflicts, eliminates blind spots and ambiguities in manually configured policies, ensures 100% accurate execution of complex contract terms, and significantly improves the accuracy of policy execution. The edge autonomous architecture, through the orthogonal decoupling design of the control plane and data plane, combined with asynchronous event-driven and local policy snapshot mechanisms, ensures that the data plane can continue to execute access control based on local snapshots when the control plane fails or the network is segmented, thus guaranteeing the continuous operation of core data services. The system availability is improved to 99.999%, demonstrating strong business resilience. Behavioral graph technology breaks through the limitations of traditional static threshold control. By constructing dynamic heterogeneous graphs in real time and combining them with lightweight graph algorithm analysis, it can accurately identify covert behaviors such as "low-frequency slow crawling" and "data aggregation attacks," effectively defending against advanced persistent threats (APTs) and data abuse by internal personnel. It fills the security gap of traditional EDCs, which only prevent "illegal transmission" but not "abnormal behavior," and achieves deep security awareness. Attached Figure Description

[0012] Other features, objects, and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings: Figure 1 This is a flowchart illustrating the control method of the present invention. Detailed Implementation

[0013] In this technical solution: To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0014] In existing EDC architectures, policy generation relies on static field mapping, which cannot handle complex context constraints; policy distribution and execution are strongly coupled, and control plane failures can easily lead to business interruptions; threat detection relies on static thresholds, which cannot identify covert attacks; and there is insufficient localization adaptation, making it difficult to meet the requirements of independent controllability. This embodiment solves the above problems through a full-process adaptive control method (the control method uses an adaptive architecture design of "control-data orthogonal decoupling," combined with semantic parsing, edge autonomy, and dynamic behavior graph technology, to achieve refined and intelligent management and control of the entire lifecycle of data circulation), referring to... Figure 1 As shown, specifically: This invention proposes an access connector usage control method based on semantic inference and behavioral graphs, applied to the domestically adapted Eclipse Dataspace Connector (EDC) architecture, including an EDC connector, which has a control plane and a data plane. The control method includes: S1: The control plane receives the digital contract and generates a policy instruction package with version control based on semantic parsing technology; the digital contract received by the control plane is transmitted through the Digital Signal Processing (DSP) protocol; the semantic parsing technology is implemented through a built-in domain-specific language (DSL) parser and an ontology knowledge base, specifically including: I) Perform semantic understanding and contextual analysis on unstructured constraints in digital contracts; II) Based on the principle of least privilege, automatically derive the optimal set of policies that include environmental awareness (such as operation time and network environment), operation boundaries (such as data access type and frequency), and data intensity (such as desensitization level and field restrictions), and generate a policy instruction package with version control (such as v1.0.2). III) Generate a policy instruction package with version control; The specific implementations of "semantic understanding and contextual analysis" in step (I) and "automatic derivation of the optimal strategy set" in step (II) include: Mapping natural language descriptions or fuzzy constraints in digital contracts to entities and relations in ontology models (e.g., mapping "limiting user A's daily access count" to a triple of "user entity - operation behavior - time constraint") establishes machine-understandable semantic associations. Use inference engines to check for conflicts and redundancies between policies (e.g., identify contradictory rules such as "allow user A to access data X" and "prohibit user A from accessing data X" and eliminate invalid rules). The optimized logic is converted into policy-as-code executable by the EDC connector, ensuring consistent policy interpretation across EDC connector nodes (e.g., converting to machine-readable policies in JSON or YAML format). S2: The control plane distributes policy instruction packets to the data plane. The data plane parses and loads them into a local high-performance cache, forming a policy snapshot. Specifically, the control plane sends policy instruction packets to the data plane via an asynchronous event bus (such as a high-efficiency communication channel based on gRPC / Protobuf); the data plane parses the policy instruction packets and loads them into a local high-performance cache (supporting high-concurrency reads with QPS>10,000) to form a policy snapshot (e.g., version v1.0.2); the data plane maintains its connection with the control plane through bidirectional heartbeat signaling (e.g., sending heartbeat packets every 30 seconds); when the data plane detects a connection interruption or network jitter in the control plane, it automatically switches to edge autonomous mode and continuously executes access control based on the policy snapshot, triggering a fail-safe protection mechanism (preventing "default denial" or "paralysis" states caused by control plane disconnection, ensuring core business continuity, and improving availability to 99.999%). The edge autonomous mode is specifically manifested as follows: During periods when the control plane is unreachable, the data plane maintains control over existing data transmission channels and accepts new compliance requests based on policy snapshots (e.g., rejecting unauthorized access that does not conform to policy snapshots). The generated execution logs and state changes are cached in a local secure queue (using tamper-proof storage, such as a circular buffer + hash verification). Once the connection is restored, the cached data will be sent back to the control plane via an incremental synchronization mechanism to ensure eventual consistency (only the changed parts will be synchronized to avoid full data transmission). S3: During data transmission, i.e., when an external entity accesses data through the EDC connector, the EDC connector, based on a policy snapshot, uses non-intrusive probes (deployed in the data transmission pipeline) to collect multi-dimensional behavioral characteristic data (including the identity of the accessing entity, data operation type, data flow direction, operation timestamp, data volume, and protocol type, etc.) to construct a dynamic behavioral graph based on a time-sliding window. Simultaneously, a lightweight graph neural network or real-time graph traversal algorithm is used to assess data transmission risks in real time. If the risk value exceeds a threshold (e.g., 0.8), transmission is blocked and a circuit breaker mechanism is triggered. Specifically, the construction of the dynamic behavioral graph based on a time-sliding window includes: A real-time heterogeneous graph is constructed using access subjects (such as user ID, device ID), data assets (such as database tables, file paths), IP addresses, and operation types (read / write / delete) as nodes, and interactive behaviors (such as "user A reads data X from IP123") as edges. Extract edge attribute features, including time interval (time difference between two operations), data entropy value (complexity of data content), and request payload size (such as the number of bytes in the HTTP request body). By calculating the centrality of the main nodes in the graph (such as degree centrality and betweenness centrality), abnormal subgraph structure (such as a large number of edges pointing to the same data asset in a short period of time), or random walk probability (to assess the persistence of abnormal behavior), we can identify batch downloads, low-frequency slow crawling, or data aggregation attacks disguised as normal access. The feature is that the time sliding window length of the dynamic behavior graph is configurable (e.g., 5 minutes, 10 minutes), and the window sliding step size is dynamically matched with the data transmission frequency (e.g., the window step size is set to 30 seconds in high-frequency transmission scenarios and 2 minutes in low-frequency scenarios). The multi-dimensional behavioral feature data collected by the non-invasive probe includes, but is not limited to: the identity of the accessing subject, the type of data operation (read / write / delete), the data flow (source IP / destination IP), the operation timestamp, the data volume and the protocol type (such as HTTP / HTTPS / MQTT). The multi-dimensional behavioral feature data collected by the non-invasive probe includes, but is not limited to: the identity of the accessing subject, the type of data operation (read / write / delete), the data flow (source IP / destination IP), the operation timestamp, the data volume and the protocol type (such as HTTP / HTTPS / MQTT). The lightweight graph neural network is a simplified version of the graph convolutional network GCN or the graph attention network GAT, or an optimized variant of the instantaneous graph traversal algorithm, such as depth-first search (DFS) or breadth-first search (BFS), with the introduction of pruning strategies, to ensure that the risk assessment response time reaches the millisecond level. The simplified version's parameter size is compressed to less than 1 / 10 of the original model; The method further includes step S4: structurally encapsulating the strategy derivation record, autonomous execution status, abnormal snapshot of the behavior graph, and original access log; performing digest calculation and signing using a domestically developed cryptographic algorithm; asynchronously synchronizing the encrypted evidence data to the blockchain network for evidence storage; the domestically developed cryptographic algorithm includes the SM2 asymmetric encryption algorithm (for signing), the SM3 hash algorithm (for digest calculation), or the SM4 symmetric encryption algorithm (for log encryption), ensuring the traceability and legal validity of the data throughout its entire lifecycle; Specifically, the control plane receives digital contracts via the DSP protocol, uses a DSL parser and ontology knowledge base to transform unstructured constraints into machine-understandable semantic models, optimizes policies through an inference engine, and generates declarative code. Policy instruction packages are distributed to the data plane via an asynchronous event bus, and the data plane loads them into a high-performance cache to form a snapshot. The control plane status is monitored through heartbeat signaling, and in case of anomalies, it switches to edge autonomous mode to ensure business continuity. During data transmission, non-intrusive probes collect behavioral data to construct a dynamic heterogeneous graph, and combine it with a lightweight graph algorithm to assess risks in real time. If the threshold is exceeded, the transmission is blocked. Finally, end-to-end evidence storage is achieved through national cryptographic algorithms and blockchain. This enables semantic parsing and strategy optimization of complex contracts, improving strategy execution accuracy to 99.9%; the edge autonomy mode ensures business availability of 99.999% in the event of control plane failure; the dynamic behavior graph can identify covert attacks that traditional rules cannot detect (such as low-frequency slow crawling), with a risk response time of ≤100ms; the domestic adaptation meets the requirements of the Cryptography Law, and the data storage has legal validity. In summary, this invention addresses the shortcomings of the existing Eclipse Dataspace Connector (EDC) architecture in data flow control. Through method refactoring and architecture reconstruction, it constructs a set of access connector usage control methods based on semantic inference and behavioral graphs, possessing intelligent cognition, resilient execution, and dynamic defense capabilities. Specifically, these methods include: To address the limitations of traditional policy engines, which can only handle static "field-value" mappings and cannot understand complex contextual constraints, this invention constructs a policy generation mechanism based on Domain Specific Language (DSL) and Ontology. This mechanism enables semantic parsing and dynamic optimization of digital contracts. Specifically, the system uses a DSL parser to convert natural language descriptions or fuzzy constraints in digital contracts into machine-understandable logical expressions. It then combines this with an ontology knowledge base (predefined entities and relationships such as subjects, objects, operations, and environments) for semantic mapping (e.g., converting "limit user A's daily access frequency" into a "user entity-operation behavior-time constraint" triple). Furthermore, it utilizes an inference engine to detect policy conflicts and redundancies (e.g., identifying contradictory rules such as "allow user A to access data X" and "prohibit user A from accessing data X"). Finally, based on the principle of least privilege, it derives an optimal policy set that includes environmental awareness, operational boundaries, and data strength, and converts it into consistent declarative code (Policy-as-Code) across nodes. This mechanism not only solves the machine-understandability problem of complex contract terms but also avoids over-authorization or unreasonable restrictions through policy optimization, significantly improving the accuracy of policy execution. Secondly, addressing the business interruption risk caused by the strong coupling between the control plane and data plane in the native EDC architecture, this invention reconstructs an adaptive architecture with orthogonal decoupling of "control-data". The control plane implements non-blocking policy distribution through an asynchronous event bus (such as a Kafka message queue) and uses an incremental synchronization mechanism to push only policy change difference data, reducing network overhead. The data plane introduces local policy cache snapshots (such as Caffeine cache, supporting high-concurrency reads with QPS>10,000) and a fail-safe state machine. It monitors the control plane status in real time through bidirectional heartbeat signaling (such as gRPC stream mode, with a heartbeat interval of 30 seconds). When the control plane loses connection due to network jitter or attacks, the data plane automatically switches to edge autonomous mode, continuously performing access control (accepting compliance requests and blocking unauthorized access) based on local snapshots, and caching the execution logs to a tamper-proof local security queue (such as a circular buffer + SM3 hash check). After the control plane recovers, it incrementally synchronizes and sends back cached data to ensure eventual consistency. This architecture effectively solves the business interruption problem caused by control plane failure, improving system availability to 99.999%. Thirdly, addressing the limitation of static threshold rules in identifying covert attacks, this invention introduces behavioral graph technology based on real-time stream analysis to achieve dynamic threat assessment. The system collects multi-dimensional behavioral features (such as user ID, data flow direction, operation timestamps, etc.) through non-intrusive probes (such as Spring Cloud Gateway filters deployed at the data transmission entry point), and constructs a dynamic heterogeneous graph in memory based on a time sliding window (configurable length, such as 5-10 minutes, step size matching the transmission frequency). The graph contains nodes representing users, assets, IPs, etc., and edges representing interactive behaviors. Furthermore, it extracts the attribute features of the edges (such as time interval, data entropy value, request load size), and combines lightweight graph algorithms (such as a simplified version of GCN and a variant of DFS pruning) to analyze the graph topology features (such as node centrality and abnormal subgraph structure) in real time. It quantifies the risk value and dynamically adjusts the interception threshold (such as triggering circuit breaking when the risk value is >0.8). This mechanism can accurately identify covert behaviors that traditional rules cannot detect, such as "low-frequency slow crawling" and "data aggregation attacks," reducing the risk response time to less than 100ms and increasing the attack identification rate from 60% to over 90%. This invention achieves a breakthrough in data flow control by transforming "rule matching" into "intelligent cognition" and "single-point defense" into "dynamic perception" through the collaborative design of semantic strategy derivation, orthogonal decoupling architecture, and dynamic behavior graph.

[0015] To overcome the shortcomings of existing EDC systems, such as high module coupling, lack of semantic reasoning, edge autonomy, and dynamic threat analysis capabilities, and inability to support domestic security requirements, this embodiment achieves functional synergy through modular design, thus solving the aforementioned problems. Specifically, it provides an access connector usage control system based on semantic inference and behavioral graphs, including: Control plane module: integrates DSL parser, Ontology knowledge base, policy generation engine and inference engine, used to receive digital contracts transmitted by DSP protocol, perform semantic parsing and policy optimization and generate policy instruction packets; Data plane module: includes high-performance cache, bidirectional heartbeat signaling module, edge autonomous engine and local security queue, used to load policy snapshots, enforce access control and cache exception logs; Behavior acquisition module: Composed of non-invasive probes, deployed in the data transmission link, used to collect multi-dimensional behavioral feature data; Risk assessment module: integrates lightweight graph neural networks or real-time graph traversal algorithms to construct dynamic heterogeneous graphs, calculate node / edge features, and assess risk values ​​in real time; Evidence storage and traceability module: Includes a domestically developed cryptographic algorithm engine and blockchain interface, used for structured encapsulation of data and synchronization to the blockchain for evidence storage.

[0016] In the aforementioned control system, the control plane module receives the digital contract, parses the contract text using a DSL parser, performs semantic mapping using the Ontology knowledge base, detects policy conflicts and optimizes them, and generates Policy-as-Code instruction packages. The data plane module loads policy snapshots into the Caffeine cache, monitors the control plane status via gRPC heartbeat, and in case of anomalies, the edge autonomous engine performs access control based on the snapshot, and caches logs in a local security queue (circular buffer + SM3 hash verification). The behavior collection module intercepts transmission requests through GlobalFilter, extracts multi-dimensional features, and pushes them to the risk assessment module. The risk assessment module constructs a dynamic heterogeneous graph, calculates risk values ​​using a simplified version of GCN or the DFS pruning algorithm, and notifies the data plane module after triggering a circuit breaker. The evidence storage and traceability module stores policy records, logs, and other data on the blockchain through the Chang'an connection interface after SM3 hashing and SM2 signing. In summary, the modular design reduces system coupling; the control plane module supports complex contract parsing (parsing time ≤ 500ms); the data plane module's Caffeine cache supports high-concurrency access of 100,000 QPS, and the heartbeat mechanism ensures real-time monitoring of the control plane status; the behavior collection module's non-intrusive probes do not affect the original business process (additional latency ≤ 10ms); the risk assessment module's lightweight algorithm reduces computation time from 500ms in the original model to 80ms; and the evidence storage and traceability module's national cryptographic algorithm is compatible with domestic blockchains, meeting the security requirements of national critical information infrastructure. The present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements any of the above-mentioned access control methods. This addresses the problem that in the prior art, the implementation of access control methods relies on dedicated hardware or customized software, lacking portability and reusability. This embodiment solves the problem of cross-platform deployment by storing program code through a computer-readable storage medium. The specific implementation involves the following steps: The processor (such as the Kunpeng 920 chip) reads the computer program from the storage medium and loads it into memory, then sequentially executes the semantic parsing, policy distribution, behavior graph construction, and evidence storage steps: The semantic parsing module calls the DSL parser and the Ontology knowledge base to process digital contracts; the policy distribution module sends instruction packets through the asynchronous event bus; the behavior graph module collects data and assesses risks through non-intrusive probes; and the evidence storage module calls the national cryptographic algorithm and blockchain interface to complete the evidence storage.

[0017] In summary, non-volatile storage media ensures the long-term reliability of program code (data retention time ≥ 10 years); the Java language and OSGi specification support cross-platform deployment (compatible with domestic systems such as Kylin V10 and UnionTech UOS); and the dependency injection mechanism of the Spring Boot framework improves code reusability (module replacement does not require refactoring the entire code).

[0018] This invention also provides an electronic device, which includes a processor and a memory. The memory stores a computer program, and when the processor executes the computer program, it implements any of the above-mentioned usage control methods. Alternatively, the electronic device integrates the above-mentioned usage control system, and implements the control method through the coordinated use of a control plane module, a data plane module, a behavior acquisition module, a risk assessment module, and an evidence storage and traceability module. This solves the problem that existing EDC devices are mostly general-purpose servers, lacking hardware optimization for semantic parsing, edge autonomy, and dynamic threat analysis, resulting in performance bottlenecks. This embodiment solves the above problems by integrating hardware and software into a dedicated electronic device.

[0019] Specifically, the implementation includes: after the electronic device is started, the processor loads the computer program in the memory, the main core runs the control plane module to process digital contracts, and the co-core runs the data plane module to execute access control; the DPU intercepts network traffic and extracts features through the behavior acquisition module, and pushes them to the NPU to accelerate risk assessment; the security chip performs hardware encryption on the evidence storage data and puts it on the blockchain through the blockchain interface; The above-mentioned multi-core architecture using the Phytium 2000+ chip (the model can be replaced according to the specific situation, and is not limited here) can achieve parallel processing of the control plane and data plane (throughput increased by 30%); DPU hardware acceleration of behavior acquisition (network latency reduced by 20%); NPU acceleration of graph algorithm calculation (risk assessment time reduced from 100ms on CPU to 30ms); and security chip to ensure that the encryption process is tamper-proof (compliant with "Information Security Technology Cryptographic Module Security Requirements" GB / T30272-2013).

[0020] Example: Cross-enterprise joint R&D scenario for sensitive data. This example uses a scenario of joint R&D of sensitive data between enterprise A and enterprise B as background to specifically illustrate the actual application process of the control method described in this invention, covering the entire lifecycle process of policy parsing, distribution, execution, exception handling, and evidence storage: Step 1: Contract semantic parsing: Scenario: Company A needs to grant Company B access to "R&D Dataset X". The digital contract explicitly states the following constraints: "Only during working days from 9:00 to 18:00, and only for AI model training purposes (plaintext export is prohibited)". This constraint includes a natural language description ("AI model training"), a time limit ("working days from 9:00 to 18:00"), and an operational restriction ("plaintext export is prohibited"), which needs to be semantically parsed into a machine-executable policy. implement: After receiving the aforementioned digital contract via the DSP protocol, the EDC control plane on Enterprise A's side calls the built-in DSL parser and Ontology knowledge base to perform semantic parsing: Semantic understanding and contextual association: The semantic engine identifies the implicit technical requirements of "AI model training" (such as the need to read data in batches for model input, but without the need for complete plaintext data), and maps them to the "operation behavior-data processing-de-sensitization constraint" triple in the ontology model; Strategy optimization and generation: The inference engine detects conflict-free rules (such as no contradiction between "allow export" and "prohibit export"), and derives the optimal set of strategies based on the principle of least privilege, including time restrictions (Workday 9:00-18:00), operation boundaries (prohibiting file stream downloads), and data strength (response bodies need to be de-identified); Declarative policy generation: Convert the optimized logic into declarative code (Policy-as-Code) in JSON format, generating a policy instruction package with version number v1.0.2: {"allow":{"time":"Workday9:00-18:00"},"deny":{"action":"Download"},"transform":{"masking":true}}; Step 2: Strategy Distribution and Autonomous Preparation Objective: To distribute the policy instruction packages generated by the control plane to the EDC data plane on the enterprise B side, ensuring that the data plane has independent execution capabilities; implement: Policy distribution: The control plane pushes the policy instruction package v1.0.2 to the access connector data plane on the enterprise B side through an asynchronous event bus (such as Kafka message queue), and only transmits the changed part (this time it is a full new policy) using an incremental synchronization mechanism. Policy loading and snapshot generation: After parsing the policy instruction package in the data plane, it is loaded into a local high-performance cache (such as Caffeine cache) to generate a policy snapshot with version number v1.0.2, which supports high-concurrency reads with QPS>10,000; Heartbeat signaling maintenance: The data plane and control plane establish bidirectional heartbeat signaling in gRPC stream mode (heartbeat interval 30 seconds) to synchronize connection status in real time and ensure that the control plane can monitor the health of the data plane; Step 3: Data Interaction and Graph Monitoring Scenario: Company B's AI training system starts requesting "R&D Dataset X". Its access behavior needs to be monitored in real time to identify abnormal operations. Behavioral Feature Collection: The data plane collects multi-dimensional behavioral features through a non-intrusive probe (a Spring Cloud Gateway filter deployed at the data transmission entry point), including: access subject (user DID of enterprise B: did:example:userB), operation type (read), data flow (enterprise A→enterprise B), operation timestamp (202X-XX-XX 10:30:00), request payload size (500KB), protocol type (HTTP / 2), etc. Dynamic behavior graph construction: Using user DID (did:example:userB), data asset (datasetX), source IP (192.168.1.101 / 192.168.1.102 / 192.168.1.103), and operation type (read) as nodes, and interactive behaviors such as "user B reads datasetX from IP 192.168.1.101" as edges, a dynamic heterogeneous graph with a time sliding window of 5 minutes is constructed. Threat Assessment and Response: Graph analysis revealed that within a short period of time (10 minutes), three different IPs (192.168.1.101-103) were reading the same user's DID, forming an abnormal subgraph structure of "distributed crawling" (the edges of the three IP nodes all point to the DID node of user B). Lightweight graph algorithms (such as the simplified version of GCN) calculate a risk value of 0.85 (with a threshold of 0.8), classifying it as high risk; The data plane immediately triggers the circuit breaker mechanism, blocking the current data transmission and sending an alarm to the control plane (including the abnormal subgraph snapshot and the risk value calculation process). Step 4: Fault Simulation and Recovery Scenario: Simulate a network attack that causes a disconnection between the control plane of company A and the data plane of company B, verifying edge autonomy capabilities. implement: Autonomous mode switching: When the data plane detects a control plane heartbeat timeout (no heartbeat packet received for more than 90 seconds), it automatically switches to edge autonomous mode and locks the policy snapshot v1.0.2; Business continuity assurance: If Enterprise B initiates a new compliance request (such as reading anonymized data at 11:00 on a working day), the data plane will authenticate and allow it based on the local snapshot v1.0.2; if it initiates an unauthorized request (such as accessing or attempting to download plaintext data on a non-working day), the data plane will block the request based on the snapshot. Log caching and recovery synchronization: Execution logs generated during the autonomous period (such as compliance request records and unauthorized interception records) are cached in a local security queue (using a ring buffer + SM3 hash check to prevent tampering); Connection restoration and evidence storage: After the control plane network is restored, the data plane sends the cached logs back to the control plane through an incremental synchronization mechanism to ensure the eventual consistency of the policy state; at the same time, the policy derivation record, autonomous execution state, abnormal subgraph snapshot and original log are asynchronously synchronized to the domestic blockchain (such as Chang'an Chain) for evidence storage after being signed by SM2 and digested by SM3, to ensure the traceability of the whole process; As can be seen from this embodiment, the control method of the present invention exhibits significant advantages in complex constraint parsing, efficient policy distribution, covert attack identification, and business continuity assurance in fault scenarios, effectively meeting the "trustworthy, controllable, and traceable" requirements for cross-enterprise sensitive data circulation.

[0021] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A control method for access connectors based on semantic inference and behavioral graphs, comprising an EDC connector, wherein the EDC connector has a control plane and a data plane, characterized in that: The control method includes: S1: The control plane receives digital contracts and generates policy instruction packages with version control based on semantic parsing technology; S2: The control plane distributes policy instruction packets to the data plane, which parses and loads them into a local high-performance cache to form a policy snapshot. S3: During data transmission, when an external entity accesses data through the EDC connector, the EDC connector uses a policy snapshot and non-invasive probes to collect multi-dimensional behavioral feature data to construct a dynamic behavioral map based on a time sliding window. At the same time, it uses a lightweight graph neural network or an instant graph traversal algorithm to assess the data transmission risk in real time. If the risk value exceeds the threshold, the transmission is blocked and the circuit breaker mechanism is triggered.

2. The access connector usage control method based on semantic inference and behavioral graph as described in claim 1, characterized in that: In step S1, the digital contract received by the control plane is transmitted via the Digital Signal Processing (DSP) protocol; the semantic parsing technology is implemented through a built-in domain-specific language (DSL) parser and an ontology knowledge base, specifically including: I) Perform semantic understanding and contextual analysis on unstructured constraints in digital contracts; Ⅱ) Based on the principle of least privilege, automatically derive the optimal set of strategies that includes environmental awareness, operational boundaries, and data strength; Ⅲ) Generate a policy instruction package with version control and proceed to step S2.

3. The access connector usage control method based on semantic inference and behavioral graph as described in claim 2, characterized in that: The specific implementations of "semantic understanding and contextual analysis" in step (I) and "automatic derivation of the optimal strategy set" in step (II) include: Mapping natural language descriptions or fuzzy constraints in digital contracts to entities and relationships in an ontology model; Use inference engines to check for conflicts and redundancy between strategies; The optimized logic is converted into policy-as-code executable by the EDC connector, ensuring consistent policy interpretation across EDC connector nodes.

4. The access connector usage control method based on semantic inference and behavioral graph as described in claim 1 or 2, characterized in that: In step S2, the control plane sends policy instruction packets to the data plane via an asynchronous event bus; the data plane parses the policy instruction packets and loads them into a local high-performance cache to form a policy snapshot; the data plane maintains the connection status with the control plane through bidirectional heartbeat signaling.

5. The access connector usage control method based on semantic inference and behavioral graph as described in claim 4, characterized in that: The S2 step also includes: when the data plane detects a control plane connection interruption or network jitter, it automatically switches to edge autonomous mode and continuously executes access control based on policy snapshots, triggering the Fail-Safe protection mechanism; The aforementioned edge autonomy mode is specifically manifested as follows: During periods when the control plane is unreachable, the data plane maintains control over existing data transmission channels and accepts new compliance requests based on policy snapshots. The generated execution logs and state changes are cached in a local security queue; Once the connection is restored, the cached data is sent back to the control plane via an incremental synchronization mechanism to ensure eventual consistency.

6. The access connector usage control method based on semantic inference and behavioral graph according to claim 1, characterized in that: In step S3, the construction of the dynamic behavior graph based on a time sliding window specifically includes: A real-time heterogeneous graph is constructed using access subjects, data assets, IP addresses, and operation types as nodes and interactive behaviors as edges. Extract the attribute features of the edges, including time interval, data entropy value, and request payload size; By calculating the centrality of the main nodes in the graph, the abnormal subgraph structure, or the probability of random walks, we can identify batch downloads, low-frequency slow crawling, or data aggregation attacks disguised as normal access. The length of the time sliding window is configurable, and the window sliding step size is dynamically matched with the data transmission frequency. The multidimensional behavioral feature data collected by the non-invasive probe includes, but is not limited to: the identity of the accessing subject, the type of data operation, the direction of data flow, the timestamp of the operation, the size of the data, and the protocol type.

7. The access connector usage control method based on semantic inference and behavioral graph as described in claim 1, characterized in that: The lightweight graph neural network is a simplified version of the graph convolutional network GCN or the graph attention network GAT, or an optimized variant of the instantaneous graph traversal algorithm, such as depth-first search (DFS) or breadth-first search (BFS). The simplified version's parameter size is compressed to less than 1 / 10 of the original model.

8. The access connector usage control method based on semantic inference and behavioral graph as described in claim 1, characterized in that: The method also includes step S4: structurally encapsulating the policy derivation record, autonomous execution status, abnormal snapshot of the behavior graph, and original access log; performing digest calculation and signing using a domestically developed cryptographic algorithm; and asynchronously synchronizing the encrypted evidence data to the blockchain network for evidence storage.

9. A access connector usage control system based on semantic inference and behavioral graphs, used to implement the access connector usage control method based on semantic inference and behavioral graphs as described in any one of claims 1-8, characterized in that: The control system includes: Control plane module: integrates DSL parser, Ontology knowledge base, policy generation engine and inference engine, used to receive digital contracts transmitted by DSP protocol, perform semantic parsing and policy optimization and generate policy instruction packages; Data plane module: includes high-performance cache, bidirectional heartbeat signaling module, edge autonomous engine and local security queue, used to load policy snapshots, enforce access control and cache exception logs; Behavior acquisition module: Composed of non-invasive probes, deployed in the data transmission link, used to collect multi-dimensional behavioral feature data; Risk assessment module: integrates lightweight graph neural networks or real-time graph traversal algorithms to construct dynamic heterogeneous graphs, calculate node / edge features, and assess risk values ​​in real time; Evidence storage and traceability module: Includes a domestically developed cryptographic algorithm engine and blockchain interface, used for structured encapsulation of data and synchronization to the blockchain for evidence storage.

Images