Knowledge block-based access method and device, computer device, storage medium and program product

Abstract

This disclosure provides a knowledge block-based access method, apparatus, computer device, storage medium, and program product, relating to the field of computer technology, particularly to the fields of information processing, information management, and information security. The implementation scheme is as follows: based on the semantic boundaries of the text content, the text content is segmented into at least one semantically independent segment, wherein each segment corresponds to a knowledge block, and the knowledge block is represented by an entity and at least one attribute attached to the entity; entities are used as nodes to establish a knowledge graph based on the relationships between corresponding entities; access rules are determined, including at least a first rule based on access permissions, which is propagated to each attribute; in response to receiving an access request, nodes in the knowledge graph are traversed to determine the target entity and target attribute; in response to access rules satisfying the target attribute, access to the target attribute is allowed; in response to access rules not satisfying the target attribute, access to the target attribute is prohibited.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to the fields of information processing, information management and information security, and especially to a knowledge block-based access method, apparatus, computer equipment, computer-readable storage medium and computer program product. Background Technology

[0002] With the deepening of digital transformation, enterprises possess massive amounts of unstructured knowledge assets, such as documents, emails, and chat logs. Existing enterprise knowledge management systems typically transform static documents into queryable and interactive knowledge bases. However, current technical architectures employ coarse-grained file-level access control methods when processing enterprise-level unstructured data, which fail to meet the requirements in terms of data security, compliance, and context awareness. Therefore, there is an urgent need for a controlled knowledge management system that can achieve structured representation of knowledge while ensuring the security and traceability of enterprise knowledge assets. Summary of the Invention

[0003] This disclosure provides a knowledge block-based access method, apparatus, computer device, computer-readable storage medium, and computer program product.

[0004] According to one aspect of this disclosure, a knowledge block-based access method is provided, comprising: segmenting text content into at least one semantically independent segment based on the semantic boundaries of the text content, wherein each segment corresponds to a knowledge block, and the knowledge block is characterized by an entity and at least one attribute attached to the entity; establishing a knowledge graph based on the association relationship between the corresponding entities, using the entities as nodes; determining access rules associated with the entities, wherein the access rules adopt an attribute-based access control model, and the access rules include at least a first rule based on access object attributes, resource attributes, and environment attributes, the first rule being used to limit the access permissions of each of the at least one attribute attached to the entity, and the first rule being propagated to each attribute; in response to receiving an access request, traversing the nodes in the knowledge graph to determine the target entity associated with the access request, wherein during the traversal, the knowledge graph is dynamically filtered based on the first rule so that entities that do not meet the access rules are removed from the traversal path; determining the target attribute attached to the target entity and associated with the access request; determining whether the access request meets the access rules of the target attribute; allowing access to the target attribute in response to meeting the access rules of the target attribute; and prohibiting access to the target attribute in response to not meeting the access rules of the target attribute.

[0005] According to one aspect of this disclosure, a knowledge block-based access device is provided. The device employs a microservice architecture and includes: a semantic content segmentation module configured to segment text content into at least one semantically independent segment based on the semantic boundaries of the text content, wherein each segment corresponds to a knowledge block, and the knowledge block is represented by an entity and at least one attribute attached to the entity; a knowledge graph building module configured to use entities as nodes to build a knowledge graph based on the relationships between corresponding entities; and an access rule determination module configured to determine access rules associated with entities, wherein the access rules employ an attribute-based access control model, and the access rules include at least a first rule based on access object attributes, resource attributes, and environment attributes, the first rule being used to limit each attribute among the at least one attribute attached to the entity. Access permissions are defined as follows: a first rule is propagated to each attribute; a knowledge graph traversal module is configured to traverse nodes in the knowledge graph to determine the target entity associated with the access request in response to receiving an access request, wherein, during the traversal, the knowledge graph is dynamically filtered based on the first rule so that entities that do not meet the access rule are removed from the traversal path; a target attribute determination module is configured to determine the target attributes associated with the access request attached to the target entity; an access request judgment module is configured to determine whether the access request meets the access rule of the target attribute; a first result determination module is configured to allow access to the target attribute in response to meeting the access rule of the target attribute; and a second result determination module is configured to prohibit access to the target attribute in response to not meeting the access rule of the target attribute.

[0006] According to another aspect of this disclosure, a computer device is provided, comprising: at least one processor; and a memory having a computer program stored thereon, wherein the computer program, when executed by the at least one processor, causes the at least one processor to perform the methods provided above in this disclosure.

[0007] According to another aspect of this disclosure, a computer-readable storage medium is provided that stores a computer program and a specific data structure thereon. When the computer program is executed by a processor, it causes the processor to perform the method provided above in this disclosure. The data structure includes an entity data field for storing entity information and an attribute data field for storing attribute information associated with the entity, wherein the entity data field and the attribute data field are encrypted.

[0008] According to another aspect of this disclosure, a computer program product is provided, including a computer program that, when executed by a processor, causes the processor to perform the methods provided above in this disclosure.

[0009] According to one or more embodiments of this disclosure, by converting unstructured text content into knowledge blocks represented by entities and their attributes, constructing a knowledge graph, and configuring attribute-level access policies, fine-grained management of text is achieved, and the text content can be accessed in a compliant and controlled environment.

[0010] These and other aspects of this disclosure will be apparent from the embodiments described below, and will be elucidated with reference to the embodiments described below. Attached Figure Description

[0011] The accompanying drawings exemplify embodiments and form part of the specification, serving together with the textual description to explain exemplary implementations of the embodiments. The illustrated embodiments are for illustrative purposes only and do not limit the scope of this disclosure. Throughout the drawings, the same reference numerals refer to similar but not necessarily identical elements.

[0012] Figure 1 This is a flowchart illustrating a knowledge block-based access method according to an exemplary embodiment.

[0013] Figure 2 This is a schematic diagram illustrating the construction of a knowledge graph according to an exemplary embodiment.

[0014] Figure 3 This is a schematic diagram illustrating a knowledge block-based access process according to an exemplary embodiment.

[0015] Figure 4 This is a schematic block diagram illustrating a knowledge block-based access device according to an exemplary embodiment.

[0016] Figure 5 An example configuration of a computer device that can be used to implement the methods described herein is shown. Detailed Implementation

[0017] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0018] In this disclosure, unless otherwise stated, the use of terms such as "first," "second," etc., to describe various elements is not intended to limit the positional, temporal, or importance relationships of these elements; such terms are merely used to distinguish one element from another. In some examples, the first element and the second element may refer to the same instance of that element, while in other cases, based on the context, they may refer to different instances.

[0019] The terminology used in the description of the various examples described in this disclosure is for the purpose of describing particular examples only and is not intended to be limiting. Unless the context explicitly indicates otherwise, an element may be one or more unless the number of elements is specifically limited. As used herein, the term "multiple" means two or more, and the term "based on" should be interpreted as "at least partially based on". Furthermore, the terms "and / or" and "at least one of..." cover any one of the listed items and all possible combinations thereof.

[0020] In related technologies, existing knowledge management and retrieval systems typically only achieve coarse-grained access control at the file level. When processing unstructured data, these systems often lack the ability to identify internal semantic entities, making them prone to security risks such as the leakage of sensitive information during searches.

[0021] First, existing Retrieval Augmentation (RAG) systems or search solutions typically use mechanical segmentation methods (e.g., slicing into vector indexes by a fixed number of characters) when processing unstructured documents. Therefore, the data segmented in this way is usually stored and retrieved as flat text, without defining or identifying entities, attributes, and their relationships within the text, thus lacking semantic understanding of the data itself.

[0022] Secondly, existing search technologies primarily rely on file-level access control lists for access control. This means that as long as a user has read permission for a file, the system assumes they have the right to access all content fragments within that file. This coarse-grained control mechanism cannot recognize the differences between different paragraphs within a document (such as amounts in a contract or personal privacy information), leading to unauthorized access or sensitive data leakage issues when searching for information.

[0023] To address this, embodiments of this disclosure propose a more effective knowledge-block-based access scheme. By constructing a knowledge graph, unstructured content is deeply parsed into entity nodes containing specific attributes. Access policies are configured for entities and their attributes. Dynamic permission verification is performed on the traversal process of the knowledge graph based on user identity and context. This enables fine-grained access to text while effectively avoiding the risk of unauthorized access.

[0024] Therefore, the method of this disclosure can perform fine-grained control over access behavior by segmenting data semantics into knowledge blocks containing entities and their attributes, constructing knowledge graphs with entities as nodes, and configuring access rules for entities and their attributes, which significantly improves the controllability of access control in the text management process.

[0025] Exemplary embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0026] like Figure 1 As shown, the knowledge block-based access method includes steps S101 to S108.

[0027] In step S101, based on the semantic boundaries of the text content, the text content is divided into at least one semantically independent segment, wherein each segment corresponds to a knowledge block, and the knowledge block is characterized by an entity and at least one attribute attached to the entity.

[0028] In the example, text content can refer to unstructured information expressed in natural language, such as documents, emails, chat logs, etc., or it can be text converted from recordings. Semantic boundaries refer to locations in the text that reflect semantic integrity or semantic shifts, such as boundaries where the described object, fact, or relationship changes. In practical implementation, natural language processing techniques or visual language models (VLMs) can be used to parse the input text content, identify fragments with independent contextual meaning, and map them to a knowledge block. This semantic segmentation-based approach can solve the problems of semantic loss and contextual fragmentation caused by mechanical segmentation in existing technologies, thereby ensuring that each knowledge block is logically complete and avoiding comprehension biases caused by the truncation of key information.

[0029] In the example, knowledge blocks can be parsed in a structured manner to extract the corresponding entity and its associated attributes. For instance, a semantically independent fragment like "payment was 800 RMB" can be treated as a knowledge block. The entity corresponding to this knowledge block can be identified as "payment," and the amount "800" and currency "RMB" can be extracted as its associated attributes, thus completing the mapping from unstructured text to structured objects. By representing knowledge blocks as entities and their attributes, the meaning of the knowledge block can be truly understood, and each smaller knowledge block can exist as an independent, manageable object. This provides a data foundation for attribute-level control, avoiding the problem of traditional file-level processing models being unable to delve into content details.

[0030] In step S102, entities are used as nodes to build a knowledge graph based on the relationships between the corresponding entities.

[0031] In the example, after the structured parsing of the text content is completed, each entity obtained from the parsing can be processed as a node, and its corresponding attribute information can be retained for each entity node. Simultaneously, based on the semantic logic or data characteristics of each entity, the relationships between nodes can be automatically identified and established. These relationships can refer to attribution relationships representing physical ownership, such as entity "payment" belonging to entity "contract A," or semantic relationships representing business logic, such as entity "payment" involving entity "supplier A." Through these relationships, independent knowledge blocks can be woven into an interconnected network of knowledge graphs, thereby overcoming the problems of isolated data and lack of contextual association in traditional databases or document storage methods.

[0032] In step S103, access rules associated with the entity are determined, wherein the access rules adopt an attribute-based access control model, and the access rules include at least a first rule based on access object attributes, resource attributes, and environment attributes. The first rule is used to limit access permissions for each of at least one of the attributes attached to the entity, and the first rule is propagated to each attribute.

[0033] In the example, when constructing entity nodes in the knowledge graph, each entity has its own access rules because each entity has a different type. Access rules can include a first rule associated with access permissions. This rule doesn't apply broadly to the entire entity object but rather contains permission definitions for each attribute within that entity. For example, in the "Payment" entity, the attribute "Amount" can be specified as visible only to finance roles, while the attribute "Currency" is visible to all members. Subsequently, through a policy propagation mechanism, these predefined permission rules can be automatically distributed and bound to each specific attribute, ensuring that each attribute has its own dedicated access rules.

[0034] In the example, when determining access rules, an attribute-based access control model (ABAC) can be used. This means that when determining access rules associated with an entity, control is not only based on fixed objects or static permissions, but also comprehensively considers the subject attributes of the access object, the resource attributes corresponding to the entity, and the environmental attributes when the access occurs. By analyzing access permissions through these three dimensions, the first rule can be determined.

[0035] In the example, by propagating access rules to the attribute level, the shortcomings of overly coarse-grained access control in traditional technologies can be avoided. At the same time, it can ensure that even if a visitor is qualified to access an entity, they will be restricted by the access rules of each attribute under that entity. This makes access to each knowledge block strictly controlled and improves access security.

[0036] In step S104, in response to receiving an access request, the nodes in the knowledge graph are traversed to determine the target entity associated with the access request. During the traversal, the knowledge graph is dynamically filtered based on a first rule so that entities that do not meet the access rule are removed from the traversal path.

[0037] In step S105, the target attributes associated with the access request and attached to the target entity are determined.

[0038] In the example, when a visitor's access request is received, the nodes in the knowledge graph can be traversed. Based on semantic clues in the query, the search follows the logical relationships between nodes, and the type characteristics of entities are matched with the access target contained in the access request. This allows the identification of the target entity associated with the access request. For example, if the query request is "Query the contract payment amount for Project A," the entity "Project A" best matches the request context. Then, by traversing the logical relationships, the entity "Payment" within Project A is found to be the best match for the access request, which is the target entity. Further access to the entity's internal attributes reveals the target attribute related to the access request, namely the "Amount" attribute under this entity. This traversal method accurately locates the access target at the entity and its attribute level, improving the accuracy of the query results.

[0039] In the example, when traversing entity nodes in the knowledge graph, the access rules associated with each entity can be read synchronously, and the entity to be accessed can be validated according to these rules. If the entity does not meet the access rules, it is directly removed from the current traversal path during the traversal process, and no further processing is performed on it, thus achieving dynamic filtering of the knowledge graph. For example, if all "Contract" entities under "Project A" are being traversed, and the access rule is set to "Only legal personnel can access confidential contracts," then when the user initiating the request is a "regular employee," all contract entities marked as "confidential" can be directly removed from the traversal path when the traversal path is generated, thereby blocking information leakage at the source.

[0040] In step S106, it is determined whether the access request meets the access rules of the target attribute.

[0041] In step S107, in response to the access rules of the target attribute being satisfied, access to the target attribute is allowed.

[0042] In step S108, in response to the failure to meet the access rules for the target attribute, access to the target attribute is prohibited.

[0043] In the example, after determining the target attribute, the access rules corresponding to that target attribute can be obtained, and the access request can be judged based on these rules. Specifically, the information of the access object contained in the access request can be obtained, and this information can be matched with the access rules of the target attribute to determine whether the access request meets the access rule requirements of the target attribute. When the judgment result is satisfied, access to the target attribute can be allowed; when the judgment result is not satisfied, access to the target attribute is prohibited. For example, when the target attribute is "amount" and the permission rule is set to "visible only to the finance manager," if the access object initiating the access request is a "regular employee," it is determined that the rule is not satisfied. In this case, access will be prohibited, and the final generated response will not include any content about the amount, only returning other information that meets the access rule; conversely, if the access object is the finance manager, whose permissions match the set permission rules, access is allowed, and the attribute can be used to generate a response.

[0044] Therefore, by segmenting unstructured text content into knowledge blocks represented by entities and their attributes based on semantic boundaries, constructing a knowledge graph based on the relationships between entities, and propagating access rules to the attribute level, and upon receiving an access request, traversing the knowledge graph to locate the target entity and target attribute associated with the access request, and judging the access request based on the access rules corresponding to the target attribute, fine-grained access control of text content can be achieved, thereby reducing the risk of leakage of sensitive information.

[0045] Figure 2 This is a schematic diagram illustrating the construction of a knowledge graph according to an exemplary embodiment.

[0046] like Figure 2 As shown in the figure, there are 4 entities: "Payment 210", "Contract 220", "Project A 230", and "Finance Department 240". Entity "Payment 210" includes three attributes: object 211 "Party A to Party B", amount 212 "5000", and currency 213 "RMB". The amount 212 is bound to a first rule: only the project manager can view it. Entity "Payment 210" originates from entity "Contract 220", which includes three attributes: uploader 221 "Zhang San", confidentiality level 222 "Confidential", and time 223 "2025.1.1". Entity "Contract 220" belongs to entity "Project A 230", which includes two attributes: project status 231 "In Progress" and confidentiality level 232 "Confidential". Simultaneously, entity "Payment 210" is controlled by entity "Finance Department 240", which includes two attributes: department head 241 "Li Si" and confidentiality level 242 "Top Secret".

[0047] Understandable, Figure 2 The examples provided are limited to a small number of entities and attributes; however, the embodiments disclosed herein are not limited thereto, and the number of entities and their attributes in the knowledge graph is unlimited.

[0048] In some embodiments, based on the semantic boundaries of the text content, the text content is segmented into at least one semantically independent segment, wherein each segment corresponds to a knowledge block, and the knowledge block is characterized by an entity and at least one attribute attached to the entity, including: providing field-level hints for the knowledge block based on a preset ontology structure, automatically constructing the corresponding structured schema table; and filling the entity corresponding to the knowledge block and at least one attribute attached to the entity into the fields of the structured schema table.

[0049] In this example, the structured representation of knowledge blocks is achieved through an automated construction mechanism called Ontology to BaseConstruction (ATBC). First, a pre-defined business ontology structure is loaded, defining entity types, attribute categories, and the hierarchical and constraint relationships between attributes. Then, field-level hints are generated based on the ontology structure, guiding the model to output the corresponding entity and attribute data according to pre-defined field names and semantics. A structured schema table matching the ontology structure is automatically constructed based on the field-level hints. This structured schema table includes entity fields for storing entity identifiers and attribute fields for storing attribute names and values. Finally, the entity information corresponding to the knowledge block and at least one associated attribute value are populated into the corresponding fields of the structured schema table, thus representing the knowledge block with structured data.

[0050] Therefore, through this ontology-based construction mechanism, knowledge blocks can be transformed into entities and their associated attributes, providing a data foundation for the subsequent construction of knowledge graphs.

[0051] In some embodiments, determining access rules associated with an entity includes: determining semantic tag information, security level information, and source information of a knowledge block; and determining a first rule for accessing the entity used to represent the knowledge block based on the semantic tag information, security level information, and source information.

[0052] In the example, after semantic processing of the text content, for each resulting knowledge block, semantic tag information, security level information, and source information can be determined. Semantic tag information describes the semantic category reflected by the knowledge block, such as the knowledge block belonging to the salary data category. Security level information indicates the sensitivity of the knowledge block at the security management level, such as classifying the "amount" attribute in the knowledge block as top secret. Source information characterizes the origin or system to which the knowledge block belongs, such as the knowledge block originating from a contract. This information can be obtained through content analysis, preset rules, or existing annotation methods and stored as descriptive information associated with the knowledge block. Subsequently, this semantic tag information, security level information, and source information can be used to analyze the entity representing the knowledge block to determine the access rule, i.e., the first rule. For example, if a knowledge block is labeled "salary data," has a security level of "top secret," and originates from the "human resources system," then the first rule "Only human resources managers can access the amount attribute of this entity" can be generated and directly propagated and bound to the corresponding entity attribute.

[0053] Therefore, by generating a first rule applicable to the corresponding entity based on semantic tag information, security level information, and source information, access control policies can be matched with the actual attributes of knowledge content, thereby improving the effectiveness of access rules.

[0054] In some embodiments, the knowledge block-based access method further includes: during the traversal process, in response to triggering the verification requirement in the access rule, suspending the current execution flow and serializing and storing the current workflow state data to enter the human-machine collaboration mode; in response to receiving a manual recovery instruction and verification result via a user-facing interface, restoring the workflow memory based on the state data; and performing a correction operation on at least one of the semantic tag information, security level information, or access rule based on the verification result.

[0055] In the example, during the traversal of the knowledge structure, the system can monitor in real time whether preset verification requirements in the access rules are triggered. When a situation requiring manual confirmation or policy correction is detected, to prevent loss of execution state, the current execution flow can be immediately suspended, subsequent automatic processing steps can be stopped, and the current workflow state data can be serialized and stored. The state data can include the current traversal position, matched entity information, associated attribute information, and the current rule judgment context to ensure subsequent recoverability. Subsequently, the system enters a stateful human-machine collaboration (Stateful Human In The Loop) mode, providing relevant verification content and context information to the human through a user-facing interface. Upon receiving the human recovery instruction and the corresponding verification result, the workflow memory can be restored based on the stored state data, restoring the system to the execution state before suspension. Subsequent access requests can be adjusted according to the verification result, i.e., allowing or prohibiting access to the corresponding target attributes.

[0056] In the example, when a deviation is found in the results during the validation process, such as incorrectly marking a knowledge block containing "core data" as having all attributes publicly accessible, allowing unauthorized personnel to view it, an update process can be triggered. For the problematic knowledge block, its incorrect semantic label information or security level information can be corrected, or the access rules bound to that entity can be reconfigured.

[0057] Therefore, by suspending the execution flow and serializing and saving the workflow state when a verification requirement is triggered, the process can be paused and resumed. By introducing a user-oriented feedback interface and performing correction processing based on the verification results, access control-related information can be continuously corrected during actual use, thereby improving the overall adaptability of the access method.

[0058] In some embodiments, performing a correction operation on at least one of semantic tag information, security level information, or access rules includes: inputting the correction operation as a feedback signal to a preset policy optimization model, wherein the policy optimization model is used to automatically predict and adjust the access rules of subsequently generated entities.

[0059] In the example, when semantic label information, security level information, or access rules are corrected, the corresponding correction operation can be converted into data text and used as a feedback signal to input into a preset policy optimization model. The feedback signal can be the corrected entity identifier, the access rules before and after the correction, and associated label information. The policy optimization model can be a lightweight neural network model that can learn from historical correction data and automatically predict the access rules that should be matched to newly generated entities. This allows for the synchronous output of optimized access rules when new entities are generated, achieving adaptive adjustment of access rules and reducing repetitive manual configuration.

[0060] Therefore, by inputting the correction operation as a feedback signal into the preset strategy optimization model, access rules that are more in line with expectations can be automatically predicted and generated, avoiding repetitive manual corrections.

[0061] In some embodiments, the access rules further include a context-based second rule, wherein the second rule is used to verify whether the network environment of the access object initiating the access request meets the requirements and whether there are any non-compliant keywords in the access request. In response to the failure of the second rule verification, the access request is prohibited.

[0062] In the example, given the widespread adoption of mobile work, legitimate accounts may be stolen or hijacked in high-risk environments. Simply confirming access permissions is insufficient to guarantee data security. Therefore, in addition to the first rule based on access permissions, the access rules also include a second rule based on context. Upon receiving an access request, the system first collects real-time network environment parameters of the access recipient, such as access time, device type, location, and IP address. The second rule can be set to "Top Secret financial information can only be accessed within the company's intranet IP range." If it detects that a user is accessing the system via public Wi-Fi or an unencrypted external network, access will be denied even if the user has the necessary permissions. Simultaneously, semantic scanning of the access request text can be performed to detect the presence of keywords that violate the second rule. For example, if sensitive words related to data privacy and security regulations are involved, access will also be denied.

[0063] In the example, the access request is judged to meet the access rules of the target attribute, following the "denial first" principle. That is, in response to the failure of the second rule verification, regardless of whether the first rule allows access, the access denial operation is enforced and a security alert is triggered.

[0064] Therefore, by introducing a context-based second rule, in addition to controlling access permissions, constraints can be further imposed based on the actual environment in which the access request occurs and whether sensitive words are included. This can improve the security and reliability of access control in practical applications under complex and ever-changing usage scenarios.

[0065] In some embodiments, determining whether an access request meets the access rules for the target attribute includes: obtaining the role identity and network environment data of the access object that initiated the access request; determining whether the role identity has the access permission to access the target attribute based on the first rule; and determining whether the network environment data meets the requirements based on the second rule and whether there are any non-compliant keywords in the access request.

[0066] In the example, after determining the target attribute, the access request can be judged to determine whether it meets the access rules for that target attribute. First, the role and identity of the accessing party, as well as real-time access time, device type, location, IP address, and other network environment parameters, can be extracted. Then, a role permission comparison is performed based on the first rule to confirm whether the role has permission to view the target attribute. If the permissions match, a second rule is used for environment and content review, verifying whether the current IP address belongs to a trusted network and whether parameters such as device and time are correct, while also scanning the text of the access request for prohibited keywords. Only when the identity, permissions, network environment, and request content all meet the rule requirements can the access request be considered legitimate, i.e., it meets the access rules for the target attribute. For example, if the accessing party is a regular employee and the target attribute is salary, the first rule can determine that they do not have access rights; or, if the accessing party has permissions, but the second rule detects that the accessing party is in an insecure network environment or the request contains sensitive keywords, then the access request can be determined to not meet the access rules.

[0067] Therefore, by using a dual judgment method based on the first and second rules, access requests can be judged by combining role identity and context information. This ensures that only legitimate access objects can access attributes in a compliant environment and in the correct manner, thereby improving the security of access control.

[0068] In some embodiments, the knowledge block-based access method further includes: recording access event data and modification operation data for each entity; generating a cryptographic hash value based on the access event data and modification operation data; and linking the cryptographic hash value to an immutable audit chain to generate a traceable historical log.

[0069] In the example, during knowledge block-based access, every access and modification action targeting an entity can be recorded. Specifically, whenever a user attempts to access an entity's attribute information, or modifies the semantic tag information, security level information, or source information of a knowledge block, the complete data of the event can be automatically captured. This includes information such as the operator's identity, operation time, operation type, and a comparison of the data before and after the change. This data is then integrated and processed to generate corresponding encrypted hash values ​​to ensure the integrity and immutability of the data content. These encrypted hash values ​​are then linked chronologically to an immutable audit chain, creating a continuous chain structure between operations and generating a traceable historical log.

[0070] Therefore, recording access events and modification operations for each entity helps to achieve traceable management of access behavior in access control scenarios, facilitating subsequent auditing or troubleshooting, thereby improving the controllability of the system operation process.

[0071] In some embodiments, the knowledge block-based access method further includes: identifying dependencies between attributes in a knowledge graph, wherein the dependencies include a second attribute being semantically derived from a first attribute; and in response to an access rule for the second attribute being determined, backpropagating the access rule for the second attribute to the first attribute.

[0072] In the example, by analyzing the semantic description information of each attribute in the knowledge graph, it is possible to identify whether there are dependencies between attributes. For example, whether a second attribute can be semantically derived from the first attribute. These dependencies can be established through preset semantic mapping rules or semantic matching algorithms. When it is detected that the second attribute, which is the derivation result, is configured with strict access rules (e.g., prohibiting access for ordinary employees), in order to prevent the derivation of high-security information from low-security attributes, a backpropagation mechanism of the rules is automatically triggered, forcibly binding the access rule of the second attribute to the first attribute, which is the derivation source. For example, if wages can be derived from taxes, then "wages" is the second attribute and "taxes" is the first attribute. When the access rule for "wages" is set to "only viewable by finance leaders," its rule can be back-bound to the "taxes" attribute. Therefore, when the access request is "please deduce wages from taxes" and the access target is an ordinary employee, the "taxes" attribute cannot be accessed, thus ensuring that data is not leaked.

[0073] Therefore, by identifying the dependencies between attributes and propagating access rules in reverse, it is possible to avoid indirectly obtaining restricted information by accessing other attributes, thereby blocking the information leakage path at the source of inference and ensuring data security.

[0074] In some embodiments, the knowledge block-based access method further includes: performing semantic recognition processing on the access request to obtain a recognition result; and refusing to respond to the access request in response to the recognition result indicating that the access request includes content for circumventing access rules.

[0075] In the example, upon receiving an access request, semantic recognition processing can be performed first. By segmenting the request text, performing semantic parsing, and matching rules, key semantic features are extracted and recognition results are generated. Subsequently, the recognition results are compared with preset access rule constraints. When the recognition results indicate that the access request contains content used to circumvent access rules, such as attempting to bypass access restrictions on specific attributes by changing the expression, the access request is determined to be inconsistent with access control requirements, and the access request is refused.

[0076] Therefore, by performing semantic recognition processing on access requests, potential circumvention behaviors can be intercepted at the semantic level, thereby preventing the bypassing of established access rules to obtain protected sensitive data.

[0077] Figure 3 This is a schematic diagram illustrating a knowledge block-based access process according to an exemplary embodiment.

[0078] like Figure 3 As shown, firstly, text content 310 is extracted from different types of files. Then, semantic segmentation is performed on the text content 310 to generate knowledge blocks 311 represented by entities 312 and their attributes 313. Further, a knowledge graph 314 is constructed based on the relationships between entities 312. Using the acquired knowledge block information 316, namely semantic tag information, security level information, and source information, access rules 315 can be set for entities 312, and these access rules 315 can be bound to the corresponding attributes 313. When a user 317 accesses the interface, the AI ​​agent 318 can traverse and query the knowledge graph based on the access rules, and finally return the query results to the user interface. If some specific users find errors in the query results, the semantic tag information, security level information, or access rules can be updated in a timely manner, thereby achieving dynamic correction of relevant information.

[0079] Embodiments of this disclosure also provide a knowledge block-based access device.

[0080] Figure 4 This is a schematic block diagram illustrating a knowledge block-based access device 400 according to an exemplary embodiment.

[0081] In some embodiments, the access device 400 may include a semantic content segmentation module 401, a knowledge graph establishment module 402, an access rule determination module 403, a knowledge graph traversal module 404, a target attribute determination module 405, an access request judgment module 406, a first result determination module 407, and a second result determination module 408. The access device 400 adopts a microservice architecture and is deployment-independent.

[0082] The semantic content segmentation module 401 is configured to segment the text content into at least one semantically independent segment based on the semantic boundaries of the text content, wherein each segment corresponds to a knowledge block, and the knowledge block is characterized by an entity and at least one attribute attached to the entity.

[0083] The knowledge graph building module 402 is configured to use entities as nodes to build a knowledge graph based on the relationships between the corresponding entities.

[0084] The access rule determination module 403 is configured to determine access rules associated with an entity, wherein the access rules adopt an attribute-based access control model, and the access rules include at least a first rule based on access object attributes, resource attributes, and environment attributes. The first rule is used to limit access permissions for each of at least one of the attributes attached to the entity, and the first rule is propagated to each attribute.

[0085] The knowledge graph traversal module 404 is configured to traverse the nodes in the knowledge graph in response to receiving an access request to determine the target entity associated with the access request. During the traversal, the knowledge graph is dynamically filtered based on a first rule so that entities that do not meet the access rule are removed from the traversal path.

[0086] The target attribute determination module 405 is configured to determine the target attributes associated with the access request and attached to the target entity.

[0087] The access request judgment module 406 is configured to determine whether the access request meets the access rules of the target attribute.

[0088] The first result determination module 407 is configured to allow access to the target attribute in response to an access rule that satisfies the target attribute.

[0089] The second result determination module 408 is configured to prohibit access to the target attribute in response to access rules that do not meet the target attribute.

[0090] In some embodiments, the semantic content segmentation module 401 may include an ontology structure construction module 401a and a data filling module 401b.

[0091] The ontology structure construction module 401a can be configured to provide field-level hints for knowledge blocks based on a preset ontology structure and automatically construct the corresponding structured schema table.

[0092] The data population module 401b can be configured to populate the entity corresponding to the knowledge block and at least one attribute attached to the entity into the fields of the structured schema table.

[0093] In some embodiments, the access rule determination module 403 may include an information determination module 403a and a first rule determination module 403b.

[0094] The information determination module 403a can be configured to determine the semantic tag information, security level information, and source information of a knowledge block.

[0095] The first rule determination module 403b can be configured to determine the first rule for accessing entities used to represent knowledge blocks based on semantic tag information, security level information, and source information.

[0096] In some embodiments, the access device 400 may further include a status data storage module 409, a workflow restoration module 410, and an information update module 411.

[0097] The state data storage module 409 can be configured to suspend the current execution flow and serialize and store the state data of the current workflow in response to the verification requirements in the access rules during the traversal process, so as to enter the human-machine collaboration mode.

[0098] The workflow restoration module 410 can be configured to restore the workflow memory based on the status data in response to receiving a manual restoration command and verification result via a user-facing interface.

[0099] The information update module 411 can be configured to perform a correction operation on at least one of the semantic tag information, security level information, or access rules based on the verification result.

[0100] In some embodiments, the information update module 411 further includes a rule optimization module 411a, which can be configured to input the correction operation as a feedback signal to a preset strategy optimization model, wherein the strategy optimization model is used to automatically predict and adjust the access rules of subsequently newly generated entities.

[0101] In some embodiments, the access request determination module 406 may include a data acquisition module 406a, a first rule determination module 406b, and a second rule determination module 406c.

[0102] The data acquisition module 406a can be configured to acquire the role identity and network environment data of the access object that initiates the access request.

[0103] The first rule judgment module 406b can be configured to determine whether a role has the right to access the target attribute based on the first rule.

[0104] The second rule judgment module 406c can be configured to judge whether the network environment data meets the requirements based on the second rule and to judge whether there are any non-compliant keywords in the access request.

[0105] In some embodiments, the access device 400 may further include a data recording module 412, a data encryption module 413, and a history log generation module 414.

[0106] The data logging module 412 can be configured to record access event data and modification operation data for each entity.

[0107] The data encryption module 413 can be configured to generate encrypted hash values ​​based on access event data and modification operation data.

[0108] The historical log generation module 414 can be configured to link cryptographic hash values ​​to an immutable audit chain to generate traceable historical logs.

[0109] In some embodiments, the access device 400 may further include an attribute relationship identification module 415 and a rule propagation module 416.

[0110] The attribute relationship identification module 415 can be configured to identify the dependency relationships between attributes in a knowledge graph, wherein the dependency relationship includes a second attribute derived semantically from a first attribute.

[0111] The rule propagation module 416 can be configured to propagate the access rules of the second attribute back to the first attribute in response to the determination of the access rules of the second attribute.

[0112] In some embodiments, the access device 400 may further include a semantic recognition module 417 and a request rejection module 418.

[0113] The semantic recognition module 417 can be configured to perform semantic recognition processing on access requests to obtain recognition results.

[0114] The request denial module 418 can be configured to refuse to respond to an access request in response to an identification result indicating that the access request includes content used to circumvent access rules.

[0115] While specific functions have been discussed above with reference to specific modules, it should be noted that the functions of the modules discussed herein can be divided into multiple modules, and / or at least some functions of multiple modules can be combined into a single module. The specific actions performed by the modules discussed herein include the specific module itself performing the action, or alternatively, the specific module calling or otherwise accessing another component or module that performs the action (or performs the action in conjunction with the specific module). Therefore, a specific module performing an action can include the specific module performing the action itself and / or another module that performs the action, called or otherwise accessed by the specific module.

[0116] It should also be understood that the above regarding Figure 4 The described modules can be implemented in hardware or in hardware in combination with software and / or firmware. For example, these modules can be implemented as computer program code / instructions configured to execute in one or more processors and stored in a computer-readable storage medium. Alternatively, these modules can be implemented as hardware logic / circuit. For example, these modules can be implemented together in a System on Chip (SoC). An SoC may include an integrated circuit chip (which includes one or more components in a processor (e.g., a Central Processing Unit (CPU), microcontroller, microprocessor, digital signal processor (DSP), etc.), memory, one or more communication interfaces, and / or other circuitry) and may optionally execute received program code and / or include embedded firmware to perform functions.

[0117] According to one aspect of this disclosure, a computer device is also provided, including a memory, a processor, and a computer program stored in the memory. The processor is configured to execute the computer program to implement the steps of any of the method embodiments described above.

[0118] According to one aspect of this disclosure, a non-transitory computer-readable storage medium is also provided, on which a computer program and a specific data structure are stored. When the computer program is executed by a processor, it implements the steps of any of the method embodiments described above. The data structure includes an entity data field for storing entity information and an attribute data field for storing attribute information associated with the entity. According to access rules, the entity data field and the attribute data field are encrypted so that the data in the entity data field and the attribute data field cannot be accessed without verification by the access rules.

[0119] According to one aspect of this disclosure, a computer program product is also provided, which includes a computer program that, when executed by a processor, implements the steps of any of the method embodiments described above.

[0120] In the following text, combined with Figure 5 Illustrative examples describing such computer devices, non-transitory computer-readable storage media, and computer program products.

[0121] Figure 5 An example configuration of a computer device 500 that can be used to implement the methods described herein is shown.

[0122] Computer device 500 can be a variety of different types of devices. Examples of computer device 500 include, but are not limited to: desktop computers, server computers, laptop or netbook computers, mobile devices (e.g., tablets, cellular or other wireless phones (e.g., smartphones), notebook computers, mobile stations), wearable devices (e.g., glasses, watches), entertainment devices (e.g., entertainment appliances, set-top boxes communicatively coupled to a display device, game consoles), televisions or other display devices, automotive computers, and so on.

[0123] Computer device 500 may include at least one processor 502, memory 504, communication interfaces(s) 506, display device 508, other I / O devices 510, and one or more mass storage devices 512 capable of communicating with each other, such as via system bus 514 or other suitable connections.

[0124] Processor 502 may be a single processing unit or multiple processing units, and all processing units may include single or multiple computing units or multiple cores. Processor 502 may be implemented as one or more microprocessors, microcomputers, microcontrollers, digital signal processors, central processing units, state machines, logic circuits, and / or any device that manipulates signals based on operating instructions. Among other capabilities, processor 502 may be configured to acquire and execute computer-readable instructions stored in memory 504, mass storage device 512, or other computer-readable media, such as program code of operating system 516, program code of application program 518, program code of other program 520, etc.

[0125] Memory 504 and mass storage device 512 are examples of computer-readable storage media for storing instructions that are executed by processor 502 to perform the various functions described above. For example, memory 504 may generally include both volatile and non-volatile memory (e.g., RAM, ROM, etc.). Furthermore, mass storage device 512 may generally include hard disk drives, solid-state drives, removable media, including external and removable drives, memory cards, flash memory, floppy disks, optical disks (e.g., CDs, DVDs), storage arrays, network-attached storage, storage area networks, etc. Both memory 504 and mass storage device 512 may be collectively referred to herein as memory or computer-readable storage media, and may be non-transitory media capable of storing computer-readable, processor-executable program instructions as computer program code, which may be executed by processor 502 as a specific machine configured to perform the operations and functions described in the examples herein.

[0126] Multiple programs may be stored on mass storage device 512. These programs include operating system 516, one or more application programs 518, other programs 520, and program data 522, and they may be loaded into memory 504 for execution. Examples of such application programs or program modules may include computer program logic (e.g., computer program code or instructions) of the methods described herein and / or other embodiments described herein.

[0127] Although Figure 5 The data is illustrated as being stored in memory 504 of computer device 500, but the operating system 516, application program 518, other programs 520, and program data 522, or portions thereof, may be implemented using any form of computer-readable medium accessible by computer device 500. As used herein, "computer-readable medium" includes at least two types of computer-readable media: computer-readable storage media and communication media.

[0128] Computer-readable storage media include volatile and non-volatile, removable and non-removable media implemented by any method or technology for storing information such as computer-readable instructions, data structures, program modules, or other data. Computer-readable storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, DVD, or other optical storage devices, magnetic cassettes, magnetic tapes, disk storage devices or other magnetic storage devices, or any other non-transmission medium that can be used to store information for access by computer devices. In contrast, communication media can embody computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms. Computer-readable storage media as defined herein do not include communication media.

[0129] One or more communication interfaces 506 are used for exchanging data with other devices, such as via a network, direct connection, etc. Such communication interfaces can be one or more of the following: any type of network interface (e.g., a network interface card (NIC)), wired or wireless (such as IEEE 802.11 Wireless LAN (WLAN)) wireless interface, Wi-MAX interface, Ethernet interface, Universal Serial Bus (USB) interface, cellular network interface, Bluetooth. TM Interfaces include near-field communication (NFC) interfaces. Communication interface 506 can facilitate communication across various network and protocol types, including wired networks (e.g., LAN, cable, etc.) and wireless networks (e.g., WLAN, cellular, satellite, etc.), the Internet, etc. Communication interface 506 can also provide communication with external storage devices (not shown) such as storage arrays, network-attached storage, storage area networks, etc.

[0130] In some examples, a display device 508, such as a monitor, may be included for displaying information and images to the user. Other I / O devices 510 may be devices that receive various inputs from the user and provide various outputs to the user, and may include touch input devices, gesture input devices, cameras, keyboards, remote controls, mice, printers, audio input / output devices, and so on.

[0131] The technologies described herein can be supported by these various configurations of computer device 500, and are not limited to specific examples of the technologies described herein. For example, the functionality can also be implemented wholly or partially on a “cloud” using a distributed system. A cloud includes and / or represents a platform for resources. The platform abstracts the underlying functionality of the cloud’s hardware (e.g., servers) and software resources. Resources may include applications and / or data that can be used when performing computational processing on servers remote from computer device 500. Resources may also include services provided via the Internet and / or via subscriber networks such as cellular or Wi-Fi networks. The platform can abstract resources and functionality to connect computer device 500 to other computer devices. Therefore, the implementation of the functionality described herein can be distributed throughout the cloud. For example, the functionality can be implemented partly on computer device 500 and partly through a platform that abstracts the functionality of the cloud.

Claims

1. A knowledge block-based access method, comprising: Based on the semantic boundaries of the text content, the text content is divided into at least one semantically independent segment, wherein each segment corresponds to a knowledge block, and the knowledge block is characterized by an entity and at least one attribute attached to the entity. The entities are used as nodes to build a knowledge graph based on the relationships between the corresponding entities; Determine access rules associated with the entity, wherein the access rules adopt an attribute-based access control model, and the access rules include at least a first rule based on access object attributes, resource attributes, and environment attributes, the first rule being used to limit access permissions for each of the at least one attribute attached to the entity, and the first rule being propagated to each attribute; In response to receiving an access request, the nodes in the knowledge graph are traversed to determine the target entity associated with the access request, wherein, during the traversal, the knowledge graph is dynamically filtered based on the first rule so that entities that do not meet the access rule are removed from the traversal path. Determine the target attributes associated with the access request attached to the target entity; Determine whether the access request meets the access rules of the target attribute; In response to an access rule satisfying the target attribute, access to the target attribute is permitted; and In response to the failure to meet the access rules for the target attribute, access to the target attribute is prohibited.

2. The method according to claim 1, wherein, The semantic boundary based on text content divides the text content into at least one semantically independent segment, wherein each segment corresponds to a knowledge block, and the knowledge block is characterized by an entity and at least one attribute attached to the entity, including: Based on a preset ontology structure, field-level hints are provided for the knowledge blocks, and corresponding structured schema tables are automatically constructed; and The entity corresponding to the knowledge block and at least one attribute attached to the entity are populated into the fields of the structured schema table.

3. The method according to claim 1, wherein, The determination of the access rules associated with the entity includes: Determine the semantic tag information, security level information, and source information of the knowledge block; and Based on the semantic tag information, the security level information, and the source information, the first rule for accessing the entity used to represent the knowledge block is determined.

4. The method according to claim 3, wherein, The method further includes: During the traversal, in response to the verification requirement in the access rule, the current execution flow is suspended and the current workflow status data is serialized and stored to enter the human-machine collaboration mode; In response to receiving a manual recovery command and verification result via a user-facing interface, the workflow memory is restored based on the status data; and Based on the verification result, a correction operation is performed on at least one of the semantic tag information, the security level information, or the access rule.

5. The method according to claim 4, wherein, The step of performing a correction operation on at least one of the semantic tag information, the security level information, or the access rule includes: The correction operation is input as a feedback signal to a preset strategy optimization model, wherein the strategy optimization model is used to automatically predict and adjust the access rules of subsequently newly generated entities.

6. The method according to claim 1, wherein, The access rules also include a second rule based on context, wherein the second rule is used to verify whether the network environment of the access object that initiates the access request meets the requirements and whether there are any non-compliant keywords in the access request. In response to the failure of the second rule verification, the access request is prohibited.

7. The method according to claim 6, wherein, The step of determining whether the access request satisfies the access rule of the target attribute includes: Obtain the role identity and network environment data of the access object that initiated the access request; Based on the first rule, determine whether the role has access permission to access the target attribute; and Based on the second rule, it is determined whether the network environment data meets the requirements and whether there are any non-compliant keywords in the access request.

8. The method according to any one of claims 1 to 7, wherein, The method further includes: Record access event data and modification operation data for each entity; Based on the access event data and the modification operation data, a cryptographic hash value is generated; and The cryptographic hash value is linked to an immutable audit chain to generate a traceable historical log.

9. The method according to any one of claims 1 to 7, wherein, The method further includes: Identify dependencies between attributes in the knowledge graph, wherein the dependencies include a second attribute being semantically derived from a first attribute; and In response to the determination of the access rules for the second attribute, the access rules for the second attribute are backpropagated to the first attribute.

10. The method according to any one of claims 1 to 7, wherein, The method further includes: The access request is semantically recognized to obtain a recognition result; and In response to the identification result indicating that the access request includes content for circumventing the access rules, the access request is refused.

11. A knowledge block-based access device, the device employing a microservice architecture, the device comprising: The semantic content segmentation module is configured to segment the text content into at least one semantically independent segment based on the semantic boundaries of the text content, wherein each segment corresponds to a knowledge block, and the knowledge block is characterized by an entity and at least one attribute attached to the entity. The knowledge graph building module is configured to use the entities as nodes to build a knowledge graph based on the corresponding relationships between the entities; An access rule determination module is configured to determine access rules associated with the entity, wherein the access rules adopt an attribute-based access control model, and the access rules include at least a first rule based on access object attributes, resource attributes, and environment attributes, the first rule being used to limit access permissions for each of the at least one attribute attached to the entity, and the first rule being propagated to each attribute. The knowledge graph traversal module is configured to traverse the nodes in the knowledge graph in response to receiving an access request to determine the target entity associated with the access request, wherein, during the traversal process, the knowledge graph is dynamically filtered based on the first rule so that entities that do not meet the access rule are removed from the traversal path. The target attribute determination module is configured to determine the target attributes associated with the access request and attached to the target entity; The access request determination module is configured to determine whether the access request meets the access rules of the target attribute; The first result determination module is configured to allow access to the target attribute in response to an access rule that satisfies the target attribute; and The second result determination module is configured to prohibit access to the target attribute in response to access rules that do not meet the target attribute.

12. A computer device, characterized in that, The computer device includes: At least one processor; A memory having a computer program stored thereon, wherein, when executed by the at least one processor, the computer program causes the at least one processor to perform the method of any one of claims 1-10.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program and a specific data structure. When the computer program is executed by a processor, it causes the processor to perform the method according to any one of claims 1-10. The data structure includes an entity data field for storing entity information and an attribute data field for storing attribute information associated with the entity, wherein the entity data field and the attribute data field are encrypted.

14. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, causes the processor to perform the method of any one of claims 1-10.

Images