A dynamic data access control method, system, device and storage medium

Abstract

The application provides a dynamic data access control method, system, device and storage medium, wherein a semantic analysis center performs semantic analysis on data assets to obtain semantic features, and constructs a semantic knowledge base containing the correlation between data and dynamic sensitivity scores according to the semantic features; a dynamic strategy engine aggregates context information of access requests in real time, jointly reasons the context information and the information in the semantic knowledge base, and dynamically generates an access control strategy that adapts to the current access scenario; an intelligent execution gateway intercepts a database access request initiated by a user terminal, processes the access request according to the access control strategy, and returns the processed access request to the user terminal; a closed-loop feedback and optimization module collects access execution logs and analyzes them, optimizes the logic of the semantic knowledge base or the dynamic strategy engine according to the analysis results, and iteratively updates the basis for processing subsequent access requests. The above scheme improves the accuracy, adaptability and execution effect of data access control.

Description

Technical Field

[0001] This application relates to the field of data security technology, and more specifically, to a dynamic data access control method, system, device, and storage medium. Background Technology

[0002] As digital transformation deepens, the scale of core data assets in various industries continues to expand, and the value of data as a production factor becomes increasingly prominent. At the same time, security risks such as unauthorized access, illegal operations, and information leakage also increase. As a core technical means to ensure the security of data assets, data access control regulates data access behavior and prevents unauthorized access by verifying the permissions and controlling the behavior of data access requests. It has become an indispensable key link in the digital construction of various industries, which also puts forward higher requirements for the practicality and adaptability of data access control technology.

[0003] Currently, the most widely used data access control technology in the industry is role-based access control. This technology assigns fixed data access permissions based on the user's preset role in the organizational structure. The implementation logic involves pre-configuring the matching relationship between different roles and corresponding data resources and operation permissions. When a user initiates a data access request, the system only checks whether the user's role matches the preset permission configuration. If they match, access is allowed; otherwise, the request is blocked, thus completing the control over data access behavior.

[0004] Role-based access control (RBAC) technology has an inherent flaw of static permission configuration. The correspondence between roles and access permissions needs to be manually fixed in advance and cannot be adjusted in real time according to the dynamic changes in actual business scenarios. When a user's business responsibilities change, or when the data access scenarios and needs change, the configured access permissions cannot be adapted and adjusted synchronously. This can easily lead to unauthorized access security risks, such as users still holding the original access permissions beyond their scope after their responsibilities have changed, or new legitimate business access requests being restricted because permissions have not been updated in time. It is difficult to balance the effectiveness of data security protection with the convenience of business data use. Summary of the Invention

[0005] In view of this, the purpose of this application is to provide a dynamic data access control method, system, device and storage medium, which improves the accuracy, adaptability and execution effect of data access control.

[0006] In a first aspect, embodiments of this application provide a dynamic data access control method applied to a dynamic data access control system. The system includes a semantic analysis center, a dynamic policy engine, an intelligent execution gateway, and a closed-loop feedback and optimization module. The method includes: The semantic analysis center performs semantic analysis on the data assets to obtain the semantic features of the data assets, and constructs a semantic knowledge base containing the relationships between data and dynamic sensitivity scores based on the semantic features. The dynamic strategy engine aggregates the context information of the access request in real time, performs joint reasoning with the information in the semantic knowledge base, and dynamically generates an access control strategy that adapts to the current access scenario. The intelligent execution gateway intercepts database access requests initiated by user terminals, processes the access requests according to the access control policy, and then returns the results to the user terminals. The closed-loop feedback and optimization module collects and analyzes access execution logs, and optimizes the logic of the semantic knowledge base or the dynamic strategy engine based on the analysis results, so as to iteratively update the processing basis for subsequent access requests.

[0007] Optionally, the step of performing semantic analysis on the data assets to obtain the semantic features of the data assets includes: The metadata, data samples, and data lineage information of the data assets are parsed; Natural language processing techniques are used to identify sensitive entity information contained in data fields from the parsed results; The business theme of the data fields is inferred from the parsing results using topic modeling techniques; Based on the sensitive entity information and the business theme, a relationship graph between data tables and fields is constructed as the semantic feature.

[0008] Optionally, the step of constructing a semantic knowledge base containing inter-data relationships and dynamic sensitivity scores based on the semantic features includes: Based on the association graph in the semantic features, identify the association combinations between fields; Calculate the dynamic sensitivity score of a field or combination of fields based on its content sensitivity, position in the relationship graph, and business importance. The association and the dynamic sensitivity score are stored in a semantic knowledge base.

[0009] Optionally, the step of jointly reasoning with the context information and the information in the semantic knowledge base to dynamically generate an access control policy adapted to the current access scenario includes: The context information is formed by aggregating the subject attributes, resource attributes, environment attributes, operation attributes, and intent attributes of the access request. The context information is matched with the semantic tags and dynamic sensitivity scores in the semantic knowledge base; Based on the matching results, an access control policy is dynamically generated, which includes allow or deny operations, de-identification rules, and row limit.

[0010] Optionally, the step of processing the access request according to the access control policy and then returning it to the user terminal includes: Intercept the original database access request initiated by the user terminal; The original database access request is rewritten according to the access control policy to generate a rewritten access request; The rewritten access request is sent to the database for execution, and the result set returned by the database after execution is received. The result set is transformed according to the access control policy; The result set after deformation processing is returned to the user terminal.

[0011] Optionally, the logic for optimizing the semantic knowledge base or the dynamic strategy engine based on the analysis results includes: Collect access execution logs, wherein the access execution logs include policy execution results and subsequent user operations; Based on the policy execution results and the user's subsequent actions, the effectiveness of the policy is analyzed, including evaluating the policy's exemption rate or blocking rate. Adjust the dynamic sensitivity scoring rules in the semantic knowledge base based on the analysis results; Alternatively, the inference logic and strategy generation logic of the dynamic strategy engine can be adjusted based on the analysis results.

[0012] Optionally, the method further includes: The dynamic strategy engine constructs a user behavior baseline based on the access execution log. The user behavior baseline includes the user's common access times, common IP ranges, common query tables, and common operation types. When a current database access request is intercepted, the dynamic strategy engine compares the context information of the current access request with the user behavior baseline and calculates the behavior deviation. If the deviation of the behavior exceeds a preset threshold, the dynamic policy engine adds additional verification requirements or increases the desensitization strength in the generated access control policy.

[0013] Secondly, embodiments of this application provide a dynamic data access control system, the system including a semantic analysis center, a dynamic strategy engine, an intelligent execution gateway, and a closed-loop feedback and optimization module; The semantic analysis center is used to perform semantic analysis on data assets to obtain the semantic features of the data assets, and to construct a semantic knowledge base containing the relationships between data and dynamic sensitivity scores based on the semantic features. The dynamic strategy engine is used to aggregate the context information of access requests in real time, perform joint reasoning with the information in the semantic knowledge base, and dynamically generate access control strategies that are adapted to the current access scenario. The intelligent execution gateway is used to intercept database access requests initiated by user terminals, process the access requests according to the access control policy, and then return them to the user terminals. The closed-loop feedback and optimization module is used to collect and analyze access execution logs, and optimize the logic of the semantic knowledge base or the dynamic strategy engine based on the analysis results, so as to iteratively update the processing basis for subsequent access requests.

[0014] Optionally, the step of performing semantic analysis on the data assets to obtain the semantic features of the data assets includes: The metadata, data samples, and data lineage information of the data assets are parsed; Natural language processing techniques are used to identify sensitive entity information contained in data fields from the parsed results; The business theme of the data fields is inferred from the parsing results using topic modeling techniques; Based on the sensitive entity information and the business theme, a relationship graph between data tables and fields is constructed as the semantic feature.

[0015] Optionally, the step of constructing a semantic knowledge base containing inter-data relationships and dynamic sensitivity scores based on the semantic features includes: Based on the association graph in the semantic features, identify the association combinations between fields; Calculate the dynamic sensitivity score of a field or combination of fields based on its content sensitivity, position in the relationship graph, and business importance. The association and the dynamic sensitivity score are stored in a semantic knowledge base.

[0016] Optionally, the step of jointly reasoning with the context information and the information in the semantic knowledge base to dynamically generate an access control policy adapted to the current access scenario includes: The context information is formed by aggregating the subject attributes, resource attributes, environment attributes, operation attributes, and intent attributes of the access request. The context information is matched with the semantic tags and dynamic sensitivity scores in the semantic knowledge base; Based on the matching results, an access control policy is dynamically generated, which includes allow or deny operations, de-identification rules, and row limit.

[0017] Optionally, the step of processing the access request according to the access control policy and then returning it to the user terminal includes: Intercept the original database access request initiated by the user terminal; The original database access request is rewritten according to the access control policy to generate a rewritten access request; The rewritten access request is sent to the database for execution, and the result set returned by the database after execution is received. The result set is transformed according to the access control policy; The result set after deformation processing is returned to the user terminal.

[0018] Optionally, the logic for optimizing the semantic knowledge base or the dynamic strategy engine based on the analysis results includes: Collect access execution logs, wherein the access execution logs include policy execution results and subsequent user operations; Based on the policy execution results and the user's subsequent actions, the effectiveness of the policy is analyzed, including evaluating the policy's exemption rate or blocking rate. Adjust the dynamic sensitivity scoring rules in the semantic knowledge base based on the analysis results; Alternatively, the inference logic and strategy generation logic of the dynamic strategy engine can be adjusted based on the analysis results.

[0019] Optionally, the dynamic policy engine is further configured to construct a user behavior baseline based on the access execution log, the user behavior baseline including the user's common access times, common IP ranges, common query tables and common operation types; The dynamic strategy engine is also used to compare the context information of the current access request with the user behavior baseline when the current database access request is intercepted, and to calculate the behavior deviation. The dynamic policy engine is also used to add additional verification requirements or increase the desensitization strength in the generated access control policy if the deviation of the behavior exceeds a preset threshold.

[0020] Thirdly, embodiments of this application provide a computer device, including: a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the computer device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, the steps of the dynamic data access control method described in any of the optional embodiments of the first aspect are performed.

[0021] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the dynamic data access control method described in any of the optional embodiments of the first aspect.

[0022] The technical solution provided in this application includes, but is not limited to, the following beneficial effects: The semantic analysis center performs semantic analysis on data assets to obtain semantic features, and builds a semantic knowledge base that includes relationships between data and dynamic sensitivity scores. This step enables the system to form an accurate understanding of the data assets based on their inherent attributes. By mining the intrinsic attributes of the data through semantic features, and incorporating relationships between data and dynamic sensitivity scores into the semantic knowledge base, the knowledge base can comprehensively and objectively reflect the actual state of the data assets. This provides a basis for subsequent data access control that is aligned with the actual situation of the data assets, and ensures that the generation of subsequent access control strategies has reliable and accurate data support.

[0023] The dynamic policy engine aggregates the contextual information of access requests in real time and combines it with information from the semantic knowledge base for joint reasoning to dynamically generate access control policies that are adapted to the current access scenario. This step, by aggregating the contextual information of access requests in real time, ensures that the generation of access control policies is closely aligned with the current access scenario, rather than adopting fixed control standards. At the same time, by combining information from the semantic knowledge base for joint reasoning, the policy generation process has a scientific and reasonable basis. Ultimately, the dynamically generated access control policies are highly adapted to the current access request scenario, improving the scenario adaptability and targeting of data access control policies.

[0024] The intelligent execution gateway intercepts database access requests initiated by user terminals and processes them according to access control policies before returning the results to the user terminal. This step ensures that all database access behaviors are included in the control scope by effectively intercepting database access requests, preventing access requests from bypassing control. At the same time, it strictly processes requests according to the generated access control policies, ensuring that the relevant access control requirements are accurately implemented. The control rules in the policy are effectively applied to the processing of every access request, ensuring the execution effect of the data access control policy. After processing, the gateway returns the results to the user terminal, satisfying the user's legitimate access needs while achieving control.

[0025] The closed-loop feedback and optimization module collects and analyzes access execution logs. Based on the analysis results, it optimizes the logic of the semantic knowledge base or dynamic strategy engine, thereby iteratively updating the processing basis for subsequent access requests. This step, by collecting access execution logs, can accurately obtain the actual execution status of data access control. Based on the analysis of the logs, it can uncover the optimization direction of the system in practical applications, and optimize the logic of the semantic knowledge base or dynamic strategy engine in a targeted manner. This allows the core control logic of the system to be continuously adjusted and improved according to the actual execution status, making the basis for processing subsequent access requests more in line with the actual application scenario, and realizing the continuous iterative update of data access control logic.

[0026] The four steps described above are interconnected and work synergistically. From building a basic understanding of data assets to generating scenario-specific access control policies, implementing these policies, and iteratively optimizing the control logic, a complete dynamic data access control process is formed. The beneficial effects of each step support each other and progress layer by layer. This ensures that data access control has a precise foundation and scenario-specific policy support, guarantees the effective execution of policies, and enables continuous optimization of the control logic. Overall, this improves the accuracy, adaptability, and execution effectiveness of data access control, ensuring that the data access control system always aligns with actual application needs and guarantees the overall effectiveness of data access control.

[0027] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0028] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 This paper shows an overall architecture diagram of a dynamic data access control system provided in Embodiment 1 of this application; Figure 2 A flowchart of a dynamic data access control method provided in Embodiment 1 of this application is shown; Figure 3 The diagram illustrates the timing interaction of a dynamic data access control method provided in Embodiment 1 of this application. Figure 4 A flowchart of a semantic feature determination method provided in Embodiment 1 of this application is shown; Figure 5 A flowchart of a semantic knowledge base construction method provided in Embodiment 1 of this application is shown; Figure 6 This illustration shows a flowchart of a semantic knowledge base construction method provided in Embodiment 1 of this application; Figure 7 A flowchart of an access control policy generation method provided in Embodiment 1 of this application is shown; Figure 8 A flowchart of an access request processing method provided in Embodiment 1 of this application is shown; Figure 9A flowchart of a logic optimization method provided in Embodiment 1 of this application is shown; Figure 10 A flowchart of a post-optimization method provided in Embodiment 1 of this application is shown; Figure 11 This paper shows a schematic diagram of the structure of a dynamic data access control system provided in Embodiment 2 of this application; Figure 12 A schematic diagram of the structure of a computer device provided in Embodiment 3 of this application is shown. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0031] Example 1 The dynamic data access control method provided in Embodiment 1 of this application is applied to a dynamic data access control system, which includes a semantic analysis center, a dynamic strategy engine, an intelligent execution gateway, and a closed-loop feedback and optimization module.

[0032] See Figure 1 As shown, Figure 1This diagram illustrates the overall architecture of a dynamic data access control system provided in Embodiment 1 of this application, clearly demonstrating the system's module division and core interaction flow. The diagram divides the system into two core areas: a data execution plane and an intelligent control plane. The data execution plane includes an intelligent execution gateway, a backend database, and a user terminal. The intelligent control plane includes a multi-source data collector, a semantic analysis center, a semantic knowledge base, a dynamic strategy engine, and a closed-loop feedback and optimization module. The main data flow is indicated by red arrows in the diagram, fully illustrating the process from the user terminal initiating a raw SQL (Structured Query Language) request, which is intercepted by the intelligent execution gateway, rewritten secure SQL is generated, and sent to the backend database. The backend database returns the original query result, and the intelligent execution gateway performs anonymization processing on the result before returning the anonymized secure data to the user terminal—a complete path. Meanwhile, the diagram also illustrates the control flow interaction between the modules. The intelligent execution gateway sends the access context (user, IP, SQL, etc.) to the dynamic policy engine. The dynamic policy engine queries the semantic knowledge base for the resource semantic profile. After the semantic knowledge base returns the semantic features, the dynamic policy engine returns the dynamic policy object to the intelligent execution gateway. The intelligent execution gateway records the execution log (policy ID, de-identified fields, etc.). The closed-loop feedback and optimization module collects this log and the user's subsequent behavior on the user terminal (whether to export, apply for exemption), and sends feedback signals (such as high-frequency exemption fields) to the semantic analysis center. The semantic analysis center updates the semantic profile accordingly. The multi-source data collector collects metadata, samples, scripts, and other information and inputs them into the semantic analysis center. The closed-loop feedback and optimization module simultaneously optimizes the policy rule base, forming a complete system closed loop.

[0033] See Figure 2 As shown, Figure 2 A flowchart of a dynamic data access control method provided in Embodiment 1 of this application is shown, wherein the method includes steps S201-S204: S201: The semantic analysis center performs semantic analysis on the data assets to obtain the semantic features of the data assets, and constructs a semantic knowledge base containing the relationships between data and dynamic sensitivity scores based on the semantic features.

[0034] Specifically, the semantic analysis input for the semantic analysis center consists of multi-source data, including database metadata, data samples, data lineage, business terminology, and compliance documents. Metadata refers to table names, field names, and comments; data samples are the first N rows of actual values; and data lineage covers ETL (Extract-Transform-Load) scripts and table relationships. The center uses NLP (Natural Language Processing) and knowledge graph technologies to conduct multi-dimensional analysis of entity recognition, topic modeling, and association reasoning to obtain the semantic features of data assets. Entity recognition focuses on identifying PII-type information, topic modeling infers business topics, and association reasoning mines risks associated with field combinations.

[0035] The dynamic sensitivity score is calculated based on field content, combined risk, and business importance. In the project, a simple weighted calculation method is used, and the scoring weights vary in different specific business scenarios. This scoring method is not the core content of the project. The semantic knowledge base ultimately stores structured semantic profiles of data assets, relationships between data, and dynamic sensitivity scores of fields / field combinations. The structured semantic profiles also include structured labels, vectorized features, and other information.

[0036] S202: The dynamic strategy engine aggregates the context information of the access request in real time, performs joint reasoning with the information in the semantic knowledge base, and dynamically generates an access control strategy that adapts to the current access scenario.

[0037] Specifically, the dynamic policy engine adopts an enhanced ABAC (Attribute-Based Access Control) model, aggregating contextual information covering subjects, resources, environment, operations, and intentions. Figure 5 The large-dimensional attributes, among which the intent attributes are mainly distinguished from statistical queries and individual queries based on SQL syntax keywords through lightweight SQL parsing. For example, if the keyword GROUPBY is included, it is considered a statistical query.

[0038] During the strategy reasoning process, information such as semantic tags, dynamic risk scores, and data relationships in the semantic knowledge base will be called. Finally, the engine directly outputs dynamic strategy objects. Issues such as conflict detection and priority sorting have not yet been explicitly considered. The strategy objects contain core content such as operation permissions, de-identification rules, line limit, and audit level, which can accurately adapt to the current access scenario.

[0039] S203: The intelligent execution gateway intercepts the database access request initiated by the user terminal, processes the access request according to the access control policy, and then returns it to the user terminal.

[0040] Specifically, the intelligent execution gateway is deployed in front of the database as a transparent proxy. It will intercept all database access requests in the form of raw SQL initiated by the user terminal. After interception, it will first call the dynamic policy engine to obtain the corresponding access control policy, and then process the request according to the policy.

[0041] The gateway processes access requests using a dual-mode mechanism that executes SQL rewriting and result transformation sequentially. First, it rewrites the SQL using SQL syntax such as CASE WHEN, SUBSTRING, and LIMIT to achieve row-level filtering and basic field masking. Then, it performs a second transformation on the result set returned by the database using complex masking algorithms such as Format-Preserving Encryption (FPE). After processing, it returns secure data to the user and records a complete execution log, which includes information such as the policy basis, masked fields, and subsequent user operations.

[0042] See Figure 3 As shown, Figure 3 This diagram illustrates the timing interaction of a dynamic data access control method according to Embodiment 1 of this application, clearly demonstrating the core interaction sequence between the user terminal, smart gateway, policy engine, semantic library, and database. The diagram presents the complete interaction process in chronological order: the user terminal first initiates an SQL query to the smart gateway; upon receiving the query, the smart gateway sends the access context to the policy engine; the policy engine then queries the semantic library for semantic information; the semantic library returns corresponding semantic features based on the query; the policy engine generates an access control policy based on the semantic features and returns it to the smart gateway; the smart gateway generates secure SQL according to the policy and executes it in the database; after execution, the database returns the query results to the smart gateway; finally, the smart gateway returns the processed data to the user terminal, completing one full access control process.

[0043] S204: The closed-loop feedback and optimization module collects and analyzes access execution logs, and optimizes the logic of the semantic knowledge base or the dynamic strategy engine based on the analysis results, so as to iteratively update the processing basis for subsequent access requests.

[0044] Specifically, the information collected by the closed-loop feedback and optimization module includes not only access execution logs, but also various effect data such as user exemption applications and data export behavior. The analysis content mainly includes policy effectiveness and high-frequency user query patterns. Among them, the policy effectiveness analysis can flexibly choose single-dimensional or multi-dimensional analysis methods according to actual business needs.

[0045] The module will use the analysis results to complete optimization work through online learning. It will adjust the dynamic sensitivity scoring threshold and anomaly detection model in the semantic knowledge base, optimize the field association weights in the semantic graph, and adjust the inference logic and policy generation parameters of the dynamic strategy engine to achieve the self-evolution of the system. This will overcome the limitations of static systems and reduce long-term operation and maintenance costs.

[0046] In an optional implementation, see Figure 4 As shown, Figure 4 The flowchart of a semantic feature determination method provided in Embodiment 1 of this application is shown, wherein the semantic analysis of the data asset to obtain the semantic features of the data asset includes steps S401 to S404: S401: Parse the metadata, data samples, and data lineage information of the data assets.

[0047] Specifically, the metadata to be parsed includes basic information such as table names, field names, and annotations in the database; the data sample consists of the first N rows of real data in the data asset; and the data lineage information includes ETL scripts and various relationships between data tables. By comprehensively analyzing these three types of data, the basic characteristics of the data asset are mined, laying the foundation for subsequent semantic analysis.

[0048] S402: Use natural language processing techniques to identify sensitive entity information contained in data fields from the parsing results.

[0049] Specifically, relying on natural language processing technology to carry out entity recognition work, the core identification data fields are whether they contain sensitive entities such as ID card numbers, mobile phone numbers, and email addresses, and complete the accurate location of basic sensitive information in data assets, which is an important part of semantic analysis.

[0050] S403: Infer the business theme of the data field from the parsing results using topic modeling techniques.

[0051] Specifically, by combining the names of data fields, the actual values ​​of samples, and other basic features obtained through parsing, topic modeling technology is used to accurately infer the business theme to which the data fields belong. Common business themes include risk control scoring, health records, medical records, transaction records, etc., thereby enabling the classification of business attributes of data assets.

[0052] S404: Based on the sensitive entity information and the business theme, construct a relationship graph between data tables and fields, which serves as the semantic feature.

[0053] Specifically, based on the identified sensitive entity information and the inferred business themes, we delve into the inherent relationships between data tables and data fields, and construct table relationship graphs by parsing foreign keys and ETL logic to form a complete relationship map.

[0054] This relationship graph can accurately identify high-risk field combinations and regular combinations. High-risk field combinations include combinations that are prone to data leakage, such as gender + age + city, patient ID + diagnosis result + address, user ID + order amount + delivery address, and year of birth + postal code. This graph is the core semantic feature of data assets.

[0055] In an optional implementation, see Figure 5 As shown, Figure 5 The flowchart of a semantic knowledge base construction method provided in Embodiment 1 of this application is shown, wherein the step of constructing a semantic knowledge base containing data relationships and dynamic sensitivity scores based on the semantic features includes steps S501 to S503: S501: Based on the association graph in the semantic features, identify the association combinations between fields.

[0056] Specifically, based on the parsed data tables and field association logic in the relationship graph, the combination of fields is accurately identified and classified, clearly distinguishing between regular field combinations and high-risk field combinations. High-risk field combinations include both sensitive combinations of single fields and multi-field combinations that can form new sensitive scenarios, solving the problem that traditional static rules cannot identify combined sensitive scenarios.

[0057] S502: Calculate the dynamic sensitivity score of a field or combination of fields based on the content sensitivity of the field, its position in the relationship graph, and its business importance.

[0058] Specifically, the dynamic sensitivity scoring uses a simple weighted calculation method in the project. The basic score is determined by the sensitivity of the field content, and is also weighted by two dimensions: combined gain and compliance factor. The combined gain is the product of the number of associated fields and the importance of the business. The compliance factor is adjusted according to the compliance level, and the calculation weight of each dimension can be flexibly adjusted under different specific business scenarios. This scoring method is not the core content of the project.

[0059] The calculation takes into account the field type weight priority, with the priority order being ID card > mobile phone number > name. The dynamic sensitivity score can be calculated using the formula: RiskScore = α·BaseScore + β·ComboBonus + γ·ComplianceFactor. In this formula, each character is defined as follows: RiskScore is the dynamic sensitivity score of the field / field combination; α is the weight coefficient of the base score; · is the multiplication operator; BaseScore is the basic content sensitivity score of the field; β is the weight coefficient of the combination gain; ComboBonus is the combination gain value of the field / field combination; γ is the weight coefficient of the compliance factor; and ComplianceFactor is the compliance factor value of the field / field combination. The final score reflects the risk level of the field or field combination in real time.

[0060] S503: Store the association relationship and the dynamic sensitivity score in the semantic knowledge base.

[0061] Specifically, the semantic knowledge base stores not only the relationships between data and the dynamic sensitivity scores of fields / field combinations, but also the structured semantic profiles of data assets. These profiles cover information such as structured labels and vectorized features, and are important data support for strategy reasoning.

[0062] Structured tags contain information such as data type, business category, and sensitivity level. Examples include type: PII, category: identity identifier, and sensitivity: dynamic score. Vectorized features are a set of numerical values ​​that can be used to calculate data similarity, further improving the accuracy of semantic analysis.

[0063] See Figure 6 As shown, Figure 6This diagram illustrates a flowchart of a semantic knowledge base construction process provided in Embodiment 1 of this application, clearly demonstrating the complete construction process of the semantic knowledge base and the core analysis logic of the semantic analysis center. The input information in this diagram includes multiple types of data, specifically database metadata (table / field names, comments), data samples (the first 100 rows of actual values), data lineage (ETL tasks, table relationships), and business documents (glossary, compliance specifications). This information is uniformly input into the semantic analysis center. The semantic analysis center first parses the foreign key / ETL logic, constructs a table relationship graph, and then determines whether the field combination is a high-risk combination. An example is patient ID + diagnosis result + address. If so, it is identified as a high-risk combination; otherwise, it is determined as a normal combination. Simultaneously, the semantic analysis center performs entity recognition and topic classification. Entity recognition is used to identify sensitive entities such as ID cards, mobile phone numbers, and email addresses, while topic classification is used to categorize business topics such as medical records and transaction logs. After completing the above analysis, the Semantic Analysis Center performs dynamic sensitivity calculation, considering three dimensions: a base score, combined gain, and compliance factor. The base score considers the field type weights, with priority being ID card number > mobile phone number > name. The combined gain is the product of the number of associated fields and their business importance. The compliance factor is adjusted according to the compliance level, and the calculation formula is RiskScore = α. BaseScore+β ComboBonus+γ ComplianceFactor; Finally, the semantic analysis center stores the analysis results in the form of semantic profiles, outputting structured labels and vectorized features. Examples of structured labels are type:PII, category:identity identifier, sensitivity:0.92, and examples of vectorized features are 0.8, 0.3, 0.95, ..., which are used for similarity calculation. Finally, the semantic profiles are stored in the semantic knowledge base.

[0064] In an optional implementation, see Figure 7 As shown, Figure 7 The flowchart illustrates an access control policy generation method according to Embodiment 1 of this application, wherein the step of jointly reasoning with the context information and the information in the semantic knowledge base to dynamically generate an access control policy adapted to the current access scenario includes steps S701-S703: S701: Aggregate the subject attributes, resource attributes, environment attributes, operation attributes, and intent attributes of the access request to form the context information.

[0065] Specifically, each of the five dimensions of attributes has its own specific content. The main attributes include user role, department, and historical behavior anomaly score; the resource attributes include field semantic tags and dynamic risk score; the environment attributes include access time, IP address, and terminal type; the operation attributes include specific operation types such as SELECT / EXPORT / DOWNLOAD; and the intent attributes are determined through lightweight SQL parsing, mainly relying on SQL syntax keywords to distinguish between statistical and individual queries. For example, if the GROUP BY keyword is included, it is considered a statistical query.

[0066] S702: Match the context information with the semantic tags and dynamic sensitivity scores in the semantic knowledge base.

[0067] Specifically, the matching process is not only based on semantic tags and dynamic sensitivity scores, but also combines the relationships between data in the semantic knowledge base and information on high-risk field combinations to carry out multi-dimensional and accurate matching. Through matching, the resource risk level and business attributes corresponding to the access request can be accurately located, providing a comprehensive and objective basis for subsequent strategy generation.

[0068] S703: Dynamically generate access control policies that include allow or deny operations, de-identification rules, and row limit based on the matching results.

[0069] Specifically, the generated access control policy includes allow or deny operations, de-identification rules, and row limit, and will also configure the corresponding audit level according to the risk level of the access scenario, ultimately forming a standardized dynamic policy object, which is directly generated by the dynamic policy engine.

[0070] The de-identification rules will explicitly specify the corresponding de-identification algorithm. For example, mobile phone numbers will retain the first 3 and last 4 digits, and ID card numbers will only display the last 4 digits. The row number limit will be implemented by setting the row_limit parameter to achieve row-level filtering. For the generation of this strategy object, issues such as conflict detection and priority sorting are not explicitly considered at present. The output results can be based on the actual business needs.

[0071] In an optional implementation, see Figure 8 As shown, Figure 8 The flowchart of an access request processing method provided in Embodiment 1 of this application is shown, wherein the step of processing the access request according to the access control policy and returning it to the user terminal includes steps S801-S808: S801: Intercept the original database access request initiated by the user terminal.

[0072] Specifically, the intelligent execution gateway, as a transparent proxy deployed at the front end of the database, will fully intercept database access requests in the form of raw SQL queries initiated by user terminals, ensuring that no database access requests bypass the policy processing stage, and is the first line of defense for data access control.

[0073] S802: Rewrite the original database access request according to the access control policy to generate a rewritten access request.

[0074] Specifically, the intelligent execution gateway calls the access control policies generated by the dynamic policy engine and uses common SQL syntax such as CASEWHEN, SUBSTRING, and LIMIT to rewrite the original SQL request in a targeted manner. This rewriting achieves row-level filtering and basic field anonymization of the data, which is one of the core steps in access request processing.

[0075] S803: Send the rewritten access request to the database for execution, and receive the result set returned by the database after execution.

[0076] Specifically, the intelligent execution gateway sends the rewritten secure SQL request to the backend database, which then performs data querying, filtering, and statistical processing according to the rewritten request. After the database completes the execution, it feeds back the original query result set to the intelligent execution gateway in real time to prepare for subsequent secondary processing.

[0077] S804: Transform the result set according to the access control policy.

[0078] Specifically, for complex desensitization algorithms such as format-preserving encryption (FPE), accurate desensitization cannot be achieved through SQL rewriting. Therefore, the intelligent execution gateway will perform secondary transformation processing on the result set returned by the database according to the requirements of the access control policy after receiving the result set. Furthermore, SQL rewriting and result transformation are executed sequentially.

[0079] S805: Return the result set after deformation processing to the user terminal.

[0080] Specifically, after completing the dual desensitization and filtering processes of SQL rewriting and result set transformation, the intelligent execution gateway returns a secure data result set that meets the access control policy requirements to the user terminal, satisfying the user's normal business needs.

[0081] While returning the result set to the user, the intelligent execution gateway will simultaneously record a complete execution log. The log content includes information such as policy ID, policy basis, de-identified fields, and subsequent user operations. This log will flow back to the closed-loop feedback and optimization module in real time, providing data support for the system's self-evolution.

[0082] In an optional implementation, see Figure 9 As shown, Figure 9 The flowchart of a logic optimization method provided in Embodiment 1 of this application is shown, wherein optimizing the logic of the semantic knowledge base or the dynamic strategy engine based on the analysis results includes steps S901 to S904: S901: Collect access execution logs, wherein the access execution logs include policy execution results and subsequent user operations.

[0083] Specifically, the access execution logs collected by the closed-loop feedback and optimization module cover multiple types of information, including not only policy execution results and subsequent user operations, but also basic information such as policy ID, de-identified fields, and policy basis. At the same time, the module will also collect various effect data such as user exemption applications and data export behavior to ensure the comprehensiveness and authenticity of the data for subsequent analysis.

[0084] S902: Based on the execution result of the policy and the user's subsequent operation behavior, analyze the effectiveness of the policy, including evaluating the exemption rate or blocking rate of the policy.

[0085] Specifically, the rules for strategy effectiveness analysis are based on relevant parameters derived from specific business scenarios. This analysis scheme is highly flexible and can choose between single-dimensional analysis or multi-dimensional comprehensive analysis according to actual business needs, without the need for fixed analysis standards.

[0086] Single-dimensional analysis can only evaluate core indicators such as the exemption rate and interception rate of a strategy. For example, if the exemption rate of a certain de-identification rule reaches a certain percentage, the effectiveness of the strategy is judged to be low, and it is recommended to downgrade and adjust it. Multi-dimensional analysis, on the other hand, will conduct a comprehensive analysis by integrating multiple types of data such as execution logs, user export behavior, exemption application frequency, and query execution results, and more accurately judge the suitability of the strategy.

[0087] S903: Adjust the dynamic sensitivity scoring rules in the semantic knowledge base based on the analysis results.

[0088] Specifically, the module will use online learning to adjust the dynamic sensitivity scoring threshold and anomaly detection model in the semantic knowledge base based on the analysis results of the strategy effectiveness. At the same time, it will optimize the field association weights in the semantic graph by combining the user's high-frequency query patterns, so that the determination of association relationships is more in line with the actual business scenario.

[0089] Through the above adjustments, the dynamic sensitivity score of the semantic knowledge base can more accurately reflect the actual risk level of data assets, improve the system's coverage of sensitive data discovery (including combined scenarios), and solve the problem of high omission rate in traditional solutions.

[0090] S904: Or adjust the inference logic and strategy generation logic of the dynamic strategy engine based on the analysis results.

[0091] Specifically, if the analysis results show that there are deviations in the strategy reasoning or generation, such as an excessively high policy false blocking rate or a mismatch between the desensitization rules and business requirements, the module will adjust the five-dimensional attribute aggregation rules and strategy reasoning logic of the dynamic strategy engine accordingly, while optimizing the relevant parameters of strategy generation to make the access control policies generated by the engine more suitable for the actual access scenarios.

[0092] By adjusting the logic of the dynamic strategy engine, the accuracy of the strategy can be effectively improved, enabling dynamic adaptation to various access scenarios and solving the problem of high false blocking rate of traditional static rules.

[0093] In an optional implementation, see Figure 10 As shown, Figure 10 A flowchart of a post-optimization method provided in Embodiment 1 of this application is shown, wherein the method further includes steps S1001 to S1003: S1001: The dynamic strategy engine constructs a user behavior baseline based on the access execution log. The user behavior baseline includes the user's common access times, common IP ranges, common query tables, and common operation types.

[0094] Specifically, the dynamic strategy engine relies on the massive, full access execution logs collected by the closed-loop feedback and optimization module to deeply mine each user's database access behavior, extract the user's access behavior patterns, and integrate core behavioral characteristics such as the user's common access time, common IP range, common query tables, and common operation types.

[0095] Based on the aforementioned core behavioral characteristics, a personalized user behavior baseline is constructed for each user. This baseline is an important basis for determining whether a user's subsequent access behavior is abnormal, enabling the system to promptly identify risky behaviors such as abnormal logins and abnormal operations, thereby improving the security of data access.

[0096] S1002: When a current database access request is intercepted, the dynamic strategy engine compares the context information of the current access request with the user behavior baseline and calculates the behavior deviation.

[0097] Specifically, after the intelligent execution gateway intercepts the current database access request initiated by the user, the dynamic strategy engine will extract key context information such as access time, IP address, queried data table, and type of operation from the request, and compare it with the user's pre-built personalized behavior baseline in multiple dimensions.

[0098] The results are compared and quantitatively analyzed using a preset algorithm to calculate the behavioral deviation value of the current access behavior. This value can intuitively reflect the degree of difference between the current access behavior and the user's normal behavior. The higher the value, the greater the risk of anomaly.

[0099] S1003: If the deviation of the behavior exceeds a preset threshold, the dynamic policy engine adds additional verification requirements or increases the desensitization strength in the generated access control policy.

[0100] Specifically, when the calculated deviation value of the behavior exceeds the system's preset threshold, it is determined that the database access behavior has security risks such as abnormal login or abnormal operation. In order to avoid the risk of data leakage, the dynamic policy engine will strengthen the access control policy for the request.

[0101] There are two main ways to strengthen the policy: one is to add additional verification requirements such as identity verification to the policy to ensure that visitors are legitimate users; the other is to further improve the strength of data anonymization to reduce the possibility of sensitive data leakage, thereby achieving dynamic protection of sensitive data and balancing data security and business availability.

[0102] To facilitate understanding of the dynamic data access control method provided in this application, the following examples are provided for illustration: Zhang, a payroll specialist in the finance department of a company, is responsible for the daily compilation, calculation, and distribution of payroll for all employees. The company has deployed this dynamic data access control system and implemented this dynamic data access method. For Zhang's access to payroll data, the system performs full-process dynamic control, as follows: 1. User Terminal Semantic Analysis and Knowledge Base Construction: The system's semantic analysis center first performs multi-source data parsing on the enterprise salary table database, collecting metadata (table name, field names such as employee ID, name, ID card number, bank card number, monthly salary, year-end bonus, etc.), data samples, ETL scripts, and other information. Using NLP technology, it identifies ID card number, bank card number, and name as PII-type sensitive entities. Through topic modeling, it infers that the business theme of the table is "employee salary calculation" and constructs a relational graph, identifying "employee ID + name + bank card number" as a high-risk field combination. Subsequently, the system calculates dynamic sensitivity scores based on field content sensitivity and business importance. Bank card number and ID card number are high-sensitivity fields, monthly salary is a medium-sensitivity field, and employee ID is a low-sensitivity field. These relational relationships and scores are then stored in the semantic knowledge base.

[0103] 2. User Terminal Access Request Initiation and Context Aggregation: During working hours on a weekday, Zhang initiated an SQL query request through his office computer (fixed IP segment) on the company's intranet, intending to calculate the total monthly salary disbursement for each department. The intelligent execution gateway immediately intercepted the original request and extracted the context information, sending it to the dynamic strategy engine. The engine aggregated five dimensions of attributes: the main attributes were "finance department, payroll specialist, Zhang, no abnormal historical behavior"; the resource attributes were "salary table, dynamic sensitivity scores of each field, high-risk field combination"; the environment attributes were "working hours on a weekday, fixed IP on the company's intranet, office terminal"; the operation attribute was "SELECT"; and the intent attribute was identified by parsing the SQL syntax and found to contain the GROUP BY keyword, thus determining it to be a "statistical query".

[0104] 3. User Terminal Dynamic Policy Generation: The policy engine matches the aggregated context information with the information in the semantic knowledge base to generate a dynamic access control policy. The policy content is: {"action":"allow", "masking": [{"field": "ID card number", "algorithm": "only display the last 4 digits"}, {"field": "bank card number", "algorithm": "keep the first 6 and last 4"}, {"field": "name", "algorithm": "last name kept + first name asterisk"}], "row_limit": "limit the number of rows according to business needs", "audit_level": "medium"}.

[0105] 4. User Terminal Access Request Processing and Result Return: The intelligent execution gateway rewrites the original SQL request according to the policy, implements the basic configuration of field anonymization rules through SQL syntax, and sends the rewritten secure SQL to the backend database for execution. The database returns the original result set of salary statistics for each department. The gateway performs secondary transformation processing on the sensitive fields in the result set to ensure that the anonymization rules are accurately implemented. Then, the anonymized statistical results are returned to Zhang's office computer, and the execution log (including policy ID, anonymized fields, access behavior, etc.) is recorded.

[0106] 5. User Terminal Abnormal Behavior Control: On a certain day outside of working hours, Zhang's account initiated an EXPORT download request for a salary table from a non-authorized terminal located elsewhere. The system's dynamic policy engine extracted the request context information and compared it with Zhang's behavioral baseline (frequent access time is during working hours on weekdays, frequent IP is the company's intranet, frequent operation is SELECT statistics, no EXPORT download record). The engine calculated that the behavioral deviation far exceeded the preset threshold. The engine then generated an enhanced control policy with the following content: {"action": "allow", "masking": [{"field": "ID number", "algorithm": "full masking"}, {"field": "bank card number", "algorithm": "full masking"},{"field": "monthly salary", "algorithm": "range anonymization"}], "row_limit": "limit a small number of rows", "audit_level": "high", "verify": The system required Zhang to complete additional facial recognition and employee ID verification before he could obtain the anonymized limited data, and prohibited full downloads, effectively avoiding the risk of salary data leakage.

[0107] 6. User Terminal Closed-Loop Feedback and System Optimization: The system closed-loop feedback and optimization module continuously collects the salary table access execution logs of Mr. Zhang and other finance personnel. It was found that the field combination "employee's start date + monthly salary" was frequently queried by multiple finance personnel, and this combination could help locate specific employees. The system then optimized the association weights of the semantic graph through online learning, identified this combination as a medium-risk field combination, and adjusted its dynamic sensitivity score to the medium-risk level. At the same time, it was found that the exemption rate of the anonymization rule for the "year-end bonus" field was low and no adjustment was needed, while the exemption rate of the anonymization rule for the "employee ID" field was high. The system automatically lowered the sensitivity score of this field and optimized the reasoning logic of the strategy engine, canceling the anonymization requirement for employee IDs, improving the office efficiency of finance personnel, and achieving a dynamic balance between data security and business efficiency.

[0108] In summary, this application, by integrating semantic analysis and a dynamic policy engine, achieves end-to-end control from semantic knowledge base construction, dynamic policy generation, access request processing to closed-loop feedback optimization. Compared to traditional static access control schemes, this application overcomes the limitations of fixed rules and can dynamically adjust access control policies based on the semantic characteristics of data assets, access context, and user behavior, effectively balancing data security and business availability.

[0109] The beneficial effects of this application are mainly reflected in the following aspects: First, by performing multi-dimensional semantic analysis on data assets through the semantic analysis center, a semantic knowledge base containing field relationships and dynamic sensitivity scoring is constructed. This can accurately identify high-risk field combinations, solving the problem of high missed detection rates in traditional solutions for sensitive scenarios and significantly improving the coverage of sensitive data discovery. Second, the dynamic policy engine performs joint reasoning based on contextual information and the semantic knowledge base to generate dynamic policies adapted to the current access scenario. This enables refined control over different users, environments, and operations, effectively reducing the policy false blocking rate and improving business efficiency. Third, the intelligent execution gateway adopts a dual-mode processing mechanism of SQL rewriting and result transformation. It can achieve row-level filtering and field desensitization through basic SQL syntax, and can also perform secondary transformation processing for complex desensitization algorithms, ensuring the accurate implementation of access control policies. Finally, the closed-loop feedback and optimization module continuously optimizes the logic of the semantic knowledge base and the dynamic policy engine by collecting access execution logs and subsequent user behavior, achieving system self-evolution. At the same time, combined with user behavior baseline and behavior deviation detection, it can promptly identify abnormal access behavior and strengthen control, further improving the security of data access.

[0110] Example 2 See Figure 11 As shown, Figure 11 The diagram shows a schematic of the structure of a dynamic data access control system provided in Embodiment 2 of this application, wherein the system includes a semantic analysis center 1101, a dynamic strategy engine 1102, an intelligent execution gateway 1103, and a closed-loop feedback and optimization module 1104. The semantic analysis center is used to perform semantic analysis on data assets to obtain the semantic features of the data assets, and to construct a semantic knowledge base containing the relationships between data and dynamic sensitivity scores based on the semantic features. The dynamic strategy engine is used to aggregate the context information of access requests in real time, perform joint reasoning with the information in the semantic knowledge base, and dynamically generate access control strategies that are adapted to the current access scenario. The intelligent execution gateway is used to intercept database access requests initiated by user terminals, process the access requests according to the access control policy, and then return them to the user terminals. The closed-loop feedback and optimization module is used to collect and analyze access execution logs, and optimize the logic of the semantic knowledge base or the dynamic strategy engine based on the analysis results, so as to iteratively update the processing basis for subsequent access requests.

[0111] In an optional implementation, the semantic analysis of the data assets to obtain the semantic features of the data assets includes: The metadata, data samples, and data lineage information of the data assets are parsed; Natural language processing techniques are used to identify sensitive entity information contained in data fields from the parsed results; The business theme of the data fields is inferred from the parsing results using topic modeling techniques; Based on the sensitive entity information and the business theme, a relationship graph between data tables and fields is constructed as the semantic feature.

[0112] In an optional implementation, the step of constructing a semantic knowledge base containing inter-data relationships and dynamic sensitivity scores based on the semantic features includes: Based on the association graph in the semantic features, identify the association combinations between fields; Calculate the dynamic sensitivity score of a field or combination of fields based on its content sensitivity, position in the relationship graph, and business importance. The association and the dynamic sensitivity score are stored in a semantic knowledge base.

[0113] In an optional implementation, the step of jointly reasoning with the context information and the information in the semantic knowledge base to dynamically generate an access control policy adapted to the current access scenario includes: The context information is formed by aggregating the subject attributes, resource attributes, environment attributes, operation attributes, and intent attributes of the access request. The context information is matched with the semantic tags and dynamic sensitivity scores in the semantic knowledge base; Based on the matching results, an access control policy is dynamically generated, which includes allow or deny operations, de-identification rules, and row limit.

[0114] In an optional implementation, the step of processing the access request according to the access control policy and then returning it to the user terminal includes: Intercept the original database access request initiated by the user terminal; The original database access request is rewritten according to the access control policy to generate a rewritten access request; The rewritten access request is sent to the database for execution, and the result set returned by the database after execution is received. The result set is transformed according to the access control policy; The result set after deformation processing is returned to the user terminal.

[0115] In an optional implementation, the logic for optimizing the semantic knowledge base or the dynamic strategy engine based on the analysis results includes: Collect access execution logs, wherein the access execution logs include policy execution results and subsequent user operations; Based on the policy execution results and the user's subsequent actions, the effectiveness of the policy is analyzed, including evaluating the policy's exemption rate or blocking rate. Adjust the dynamic sensitivity scoring rules in the semantic knowledge base based on the analysis results; Alternatively, the inference logic and strategy generation logic of the dynamic strategy engine can be adjusted based on the analysis results.

[0116] In an optional implementation, the dynamic policy engine is further configured to construct a user behavior baseline based on the access execution log, the user behavior baseline including the user's common access times, common IP ranges, common query tables, and common operation types; The dynamic strategy engine is also used to compare the context information of the current access request with the user behavior baseline when the current database access request is intercepted, and to calculate the behavior deviation. The dynamic policy engine is also used to add additional verification requirements or increase the desensitization strength in the generated access control policy if the deviation of the behavior exceeds a preset threshold.

[0117] Example 3 Based on the same application concept, see [link / reference] Figure 12 As shown, Figure 12 This illustration shows a structural schematic diagram of a computer device provided in Embodiment 3 of this application, wherein, as shown... Figure 12 As shown, the computer device 1200 provided in Embodiment 3 of this application includes: The computer device 1200 includes a processor 1201, a memory 1202, and a bus 1203. The memory 1202 stores machine-readable instructions that can be executed by the processor 1201. When the computer device 1200 is running, the processor 1201 and the memory 1202 communicate through the bus 1203. When the machine-readable instructions are executed by the processor 1201, the steps of the dynamic data access control method shown in Embodiment 1 are performed.

[0118] Example 4 Based on the same concept, this application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the dynamic data access control method described in any of the above embodiments.

[0119] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the system and apparatus described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0120] The computer program product for dynamic data access control provided in this application includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the methods described in the preceding method embodiments. For specific implementation details, please refer to the method embodiments, which will not be repeated here.

[0121] The dynamic data access control system provided in this application embodiment can be specific hardware on a device or software or firmware installed on the device. The system provided in this application embodiment has the same implementation principle and technical effects as the foregoing method embodiments. For the sake of brevity, any parts not mentioned in the system embodiment can be referred to the corresponding content in the foregoing method embodiments. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, systems, and units described above can all be referred to the corresponding processes in the above method embodiments, and will not be repeated here.

[0122] In the embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. The system embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the coupling or direct coupling or communication connection shown or discussed may be through some communication interfaces; the indirect coupling or communication connection between systems or units may be electrical, mechanical, or other forms.

[0123] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0124] In addition, the functional units in the embodiments provided in this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0125] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0126] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0127] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The protection scope of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application. All should be covered within the protection scope of this application. Therefore, the protection scope of this application should be determined by the protection scope of the claims.

Claims

1. A dynamic data access control method, characterized in that, An application to a dynamic data access control system, the system comprising a semantic analysis center, a dynamic strategy engine, an intelligent execution gateway, and a closed-loop feedback and optimization module, the method comprising: The semantic analysis center performs semantic analysis on the data assets to obtain the semantic features of the data assets, and constructs a semantic knowledge base containing the relationships between data and dynamic sensitivity scores based on the semantic features. The dynamic strategy engine aggregates the context information of the access request in real time, performs joint reasoning with the information in the semantic knowledge base, and dynamically generates an access control strategy that adapts to the current access scenario. The intelligent execution gateway intercepts database access requests initiated by user terminals, processes the access requests according to the access control policy, and then returns the results to the user terminals. The closed-loop feedback and optimization module collects and analyzes access execution logs, and optimizes the logic of the semantic knowledge base or the dynamic strategy engine based on the analysis results, so as to iteratively update the processing basis for subsequent access requests.

2. The method according to claim 1, characterized in that, The semantic analysis of the data assets to obtain their semantic features includes: The metadata, data samples, and data lineage information of the data assets are parsed; Natural language processing techniques are used to identify sensitive entity information contained in data fields from the parsed results; The business theme of the data fields is inferred from the parsing results using topic modeling techniques; Based on the sensitive entity information and the business theme, a relationship graph between data tables and fields is constructed as the semantic feature.

3. The method according to claim 2, characterized in that, The construction of a semantic knowledge base containing inter-data relationships and dynamic sensitivity scores based on the semantic features includes: Based on the association graph in the semantic features, identify the association combinations between fields; Calculate the dynamic sensitivity score of a field or combination of fields based on its content sensitivity, position in the relationship graph, and business importance. The association and the dynamic sensitivity score are stored in a semantic knowledge base.

4. The method according to claim 1, characterized in that, The step of jointly reasoning with the context information and the information in the semantic knowledge base to dynamically generate an access control policy adapted to the current access scenario includes: The context information is formed by aggregating the subject attributes, resource attributes, environment attributes, operation attributes, and intent attributes of the access request. The context information is matched with the semantic tags and dynamic sensitivity scores in the semantic knowledge base; Based on the matching results, an access control policy is dynamically generated, which includes allow or deny operations, de-identification rules, and row limit.

5. The method according to claim 1, characterized in that, The step of processing the access request according to the access control policy and then returning it to the user terminal includes: Intercept the original database access request initiated by the user terminal; The original database access request is rewritten according to the access control policy to generate a rewritten access request; The rewritten access request is sent to the database for execution, and the result set returned by the database after execution is received. The result set is transformed according to the access control policy; The result set after deformation processing is returned to the user terminal.

6. The method according to claim 1, characterized in that, The logic for optimizing the semantic knowledge base or the dynamic strategy engine based on the analysis results includes: Collect access execution logs, wherein the access execution logs include policy execution results and subsequent user operations; Based on the policy execution results and the user's subsequent actions, the effectiveness of the policy is analyzed, including evaluating the policy's exemption rate or blocking rate. Adjust the dynamic sensitivity scoring rules in the semantic knowledge base based on the analysis results; Alternatively, the inference logic and strategy generation logic of the dynamic strategy engine can be adjusted based on the analysis results.

7. The method according to claim 6, characterized in that, The method further includes: The dynamic strategy engine constructs a user behavior baseline based on the access execution log. The user behavior baseline includes the user's common access times, common IP ranges, common query tables, and common operation types. When a current database access request is intercepted, the dynamic strategy engine compares the context information of the current access request with the user behavior baseline and calculates the behavior deviation. If the deviation of the behavior exceeds a preset threshold, the dynamic policy engine adds additional verification requirements or increases the desensitization strength in the generated access control policy.

8. A dynamic data access control system, characterized in that, The system includes a semantic analysis center, a dynamic strategy engine, an intelligent execution gateway, and a closed-loop feedback and optimization module; The semantic analysis center is used to perform semantic analysis on data assets to obtain the semantic features of the data assets, and to construct a semantic knowledge base containing the relationships between data and dynamic sensitivity scores based on the semantic features. The dynamic strategy engine is used to aggregate the context information of access requests in real time, perform joint reasoning with the information in the semantic knowledge base, and dynamically generate access control strategies that are adapted to the current access scenario. The intelligent execution gateway is used to intercept database access requests initiated by user terminals, process the access requests according to the access control policy, and then return them to the user terminals. The closed-loop feedback and optimization module is used to collect and analyze access execution logs, and optimize the logic of the semantic knowledge base or the dynamic strategy engine based on the analysis results, so as to iteratively update the processing basis for subsequent access requests.

9. A computer device, characterized in that, include: The computer device includes a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the computer device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, they perform the steps of the dynamic data access control method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of the dynamic data access control method as described in any one of claims 1 to 7.

Images