An identity recognition-based archive management method

Abstract

This invention discloses an identity recognition-based archive management method, specifically relating to the field of electronic archive security management, to solve the problems of permission generalization and uncontrolled unauthorized retrieval in temporary proxy access. By compressing the authorizing person's first identity feature, the agent's second identity feature, and structured search conditions into a composite proxy credential, real-time identity verification, abnormal intent identification, and structured search condition restoration are performed after the proxy request arrives. The restored target data table name and row record matching logic are further subdivided into a temporary search sandbox and session addressing boundary, completing read-only data stream feedback and credential cancellation and recycling, forming a closed processing link of single authorization, targeted retrieval, address locking, and post-meeting clearing. This ensures that the authorization boundary, search scope, addressing scope, and recycling node maintain a one-to-one correspondence within the same proxy access cycle, and operate continuously under the constraint of the second identity unique identifier throughout the process.

Description

Technical Field

[0001] This invention relates to the field of electronic records security management, and more specifically, to a record management method based on identity recognition. Background Technology

[0002] With the deepening of digital transformation in enterprises and institutions, the demand for cross-departmental collaboration and temporary proxy access to massive amounts of highly confidential electronic archives is increasing. In the existing electronic archive management architecture, in order to ensure data security, access control mechanisms based on identity recognition are generally adopted. When managers with high-level permissions are unable to operate personally due to reasons such as performing urgent official duties, it is usually necessary to temporarily grant specific archive retrieval and extraction permissions to lower-level personnel for proxy access. In order to achieve the above purpose, the prior art document "Access Control Method for Electronic Archives Based on Ciphertext Attribute Base Encryption" (application number: 109815802) discloses a technical solution for achieving cross-level archive access by sharing identity verification identifiers or distributing temporary decryption credentials. In this conventional proxy business interaction, after receiving the authorization instruction, the system platform will generate a temporary identity verification status with target archive retrieval and viewing permissions for the proxy operator, thereby ensuring the efficiency of collaborative office workflow.

[0003] However, the aforementioned proxy authentication mechanism, which relies on the distribution of overall identity credentials or the sharing of decryption keys, has revealed technical shortcomings in practical applications, such as over-generalization of permissions and the ease with which the scope of proxying can get out of control. Because existing low-level file retrieval frameworks often strongly bind identity status to macro-level data tables or the entire file directory, agents holding this high-level temporary identity credential can not only easily access specific target files that are explicitly authorized, but also use this credential to overstep their authority to retrieve and extract other confidential data in the database that is not within their access scope. This crude identity proxy mechanism is essentially a complete replacement of identity rather than a precise division of permissions. If the proxy terminal is maliciously controlled, or if there is a subjective intent to steal secrets, the system will be unable to intercept unauthorized retrieval commands during the low-level data flow, which can easily lead to a large-scale leakage of core files and is difficult to meet the current security verification requirements for precise control of file data at the micro-granular level.

[0004] To address the aforementioned problems, a technical solution is provided. Summary of the Invention

[0005] To overcome the aforementioned deficiencies of the prior art, embodiments of the present invention provide an identity-based file management method. This method unifies the first identity feature of the authorizing person, the second identity feature of the agent, and structured search conditions into a composite proxy credential. Upon arrival of a proxy request, real-time identity verification, abnormal intent identification, and restoration of structured search conditions are performed. The restored target data table name and row record matching logic are further degraded into a temporary search sandbox and session addressing boundary, completing read-only data stream feedback and credential cancellation and recycling. This forms a closed processing link of single authorization, targeted retrieval, address locking, and post-meeting clearing, ensuring that the authorization boundary, retrieval scope, addressing scope, and recycling node maintain a one-to-one correspondence within the same proxy access cycle and operate continuously under the constraint of the unique identifier of the second identity throughout the process, thereby solving the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: S1: Obtain the first identity feature of the authorizing person, the structured search conditions that limit the scope of file access, and the second identity feature of the designated agent. Generate a unique key based on the first identity feature. Use the unique key to encrypt the underlying character sequence of the structured search conditions to generate the initial authorization ciphertext. Establish a mapping data table entry with the second identity unique identifier generated by the second identity feature as the primary key index and solidify it as a composite agent credential. S2: Receive the file retrieval request initiated by the agent terminal, obtain the real-time identity features of the current operator and perform hash comparison with the second identity features. After the comparison is successful, generate the isolated path evaluation coefficient based on the screen vertical capacitive pressure sequence and the original search terms. When the isolated path evaluation coefficient meets the abnormal cutting threshold, retrieve the initial authorization ciphertext based on the second identity unique identifier and restore the structured search conditions. S3: Extract the target data table name and row record matching logic from the structured search conditions, generate a target record identifier set and compile it into a normalized execution expression, write the normalized execution expression into the underlying routing interception instruction, divide the database physical memory pool into independent cache areas according to the target record identifier set, and form a temporary search sandbox description table containing the start address space, the end address space and the address mapping table. S4: Locate the session pointer attribute corresponding to the file retrieval request, rewrite the default addressing base address and maximum addressing offset according to the temporary retrieval sandbox description table, complete the file data reading item by item in the independent buffer and encapsulate it into a read-only data stream and feed it back to the agent terminal, and erase the independent buffer and delete the mapping data table entry and the slot number corresponding to the composite agent credential after the transmission is detected to be finished.

[0007] Furthermore, before generating the unique key in step S1, the first identity feature is collected three times consecutively, and the facial depth texture sequence, iris coding sequence, and finger vein topology sequence are denoised, scale aligned, orientation registered, and position unified in a fixed order. Then, the consistency ratio and consistency threshold are used for judgment. After the judgment is passed, the first biometric vector is generated by majority voting bit by bit, which serves as the input object for generating the unique key.

[0008] Furthermore, in step S1, when generating the unique key, a random salt value is first generated and concatenated with the first biometric vector. Then, the unique key is obtained through secure hashing. At the same time, the unique key and the random salt value are encapsulated into a key encapsulation value, and a slot number associated with the second identity unique identifier is assigned. The initial authorization ciphertext, integrity verification value, and slot number are written together into the mapping data table entry.

[0009] Furthermore, in step S2, when comparing the real-time identity features of the current operator with the second identity features, a real-time identity comparison vector and a registered identity comparison vector are first formed according to the positional rules consistent with the registration stage. Then, local sensitive hashing is used to generate a real-time identity hash signature and a registered identity hash signature. Based on the comparison result of the number of identity difference bits and the identity difference threshold, it is determined whether to continue executing the subsequent file retrieval request.

[0010] Furthermore, in step S2, after the identity verification is passed, the screen longitudinal capacitive pressure sequence before the file retrieval request is triggered is collected. After the low-frequency click part is removed by fast Fourier transform, the high-frequency pressure component is obtained, and the high-frequency touch press momentum integral value is accumulated along the sampling window. At the same time, the original search terms are mapped to the preset global file knowledge graph, and the search semantic topological discrete entropy value is generated according to the shortest path edge distribution. Then, both are written into the two-dimensional feature node.

[0011] Furthermore, in step S2, the two-dimensional feature nodes are input into the pre-trained isolated forest model, and the isolated path evaluation coefficient is generated based on the average path depth in multiple random trees. The isolated path evaluation coefficient is then compared with the abnormal cutting threshold. After the comparison passes, the key encapsulation value is retrieved based on the slot number to restore the unique key. Finally, the initial authorization ciphertext and integrity verification value are reviewed to restore the structured retrieval conditions.

[0012] Furthermore, in step S3, the candidate row record is first determined one by one according to the matching logic between the target data table name and the row record. A target record identifier set consisting of the primary key values ​​of the matched records is generated. Then, a normalized execution expression is compiled based on the target record identifier set and the read-only access mode. The normalized execution expression is written into the underlying routing interception instruction of the structured query statement parser so that the file access request is executed according to the fixed query entry.

[0013] Furthermore, in step S3, the serialized byte length of each hit record is read according to the target record identifier set. The total byte requirement of the independent cache area is calculated by combining the memory alignment granularity, address mapping table entry length and control header length. The page load boundary is divided according to the page filling threshold. Then, the starting address space, the ending address space and the address mapping table are generated. Finally, they are written together with the normalized execution expression and the single access cancellation flag into the temporary retrieval sandbox description table.

[0014] Furthermore, in step S4, after locating the session pointer attribute corresponding to the file retrieval request, the default addressing base address and the maximum addressing offset are rewritten according to the starting addressing space and the ending addressing space in the temporary retrieval sandbox description table, and written to the temporary retrieval sandbox binding flag. Then, according to the address mapping table, the hit records in the target record identifier set are read byte by byte, and the reading results are encapsulated into a read-only sequence frame according to the length field, primary key field, read-only flag field, content field and frame check field.

[0015] Furthermore, in step S4, all read-only sequence frames are connected in primary key order and a transmission end symbol is appended to form a read-only data stream. After the continuous monitoring results reach the transmission end confirmation threshold, zeros are written bit by bit to the independent buffer according to the total byte range corresponding to the start address space and the end address space. The mapped data table entry is deleted according to the second unique identifier code, and the corresponding key encapsulation value is cancelled according to the slot number.

[0016] The technical effects and advantages of the identity recognition-based file management method of the present invention are as follows: This invention focuses on temporary proxy access scenarios, compressing the authorizing person's primary identity characteristics, the agent's secondary identity characteristics, and structured search conditions into a composite proxy credential. Upon receiving a proxy request, it sequentially completes identity verification, abnormal intent identification, structured search condition restoration, temporary search sandbox construction, and session address boundary rewriting. This ensures that proxy access no longer remains at the level of overall identity substitution, but rather falls within an execution chain jointly defined by the target data table name, row record matching logic, and physical address range. The scope of access remains consistent across the authorization registration, search execution, data feedback, and post-meeting recovery stages.

[0017] Compared to processing methods that rely solely on static identity verification and temporary permission assignment, this invention introduces high-frequency touch press momentum integral value, retrieval semantic topology discrete entropy value, and isolated path evaluation coefficient after identity verification to dynamically identify proxy requests. This ensures that the access link has a behavior screening entry point before authorization is restored, and abnormal requests will not directly enter the structured retrieval condition restoration section. The triggering condition for authorization boundaries is expanded from single identity matching to continuous determination of identity, behavior, and retrieval content.

[0018] Meanwhile, the present invention further refines the recovered structured search conditions into a target record identifier set, a normalized execution expression, an address mapping table, and a temporary search sandbox description table. Then, the session pointer attribute compresses the default addressing base address and the maximum addressing offset into the range of the independent buffer. Data feedback is output only in the form of a read-only data stream. After the transmission ends, the independent buffer is erased, the mapped data table entries are deleted, and the slot number is cancelled simultaneously, so that a single proxy retrieval forms a closed processing link of entry locking, range convergence, and exit clearing. Attached Figure Description

[0019] Figure 1 This is a flowchart illustrating an identity recognition-based file management method according to the present invention. Figure 2 This is a schematic diagram of the composite proxy credential generation process in this invention; Figure 3 This is a schematic diagram of the proxy request verification and abnormal intent identification process in this invention; Figure 4 This is a schematic diagram illustrating the construction of a temporary retrieval sandbox under the structured retrieval conditions in this invention; Figure 5 This is a schematic diagram of the session addressing boundary rewriting, read-only data stream feedback, and recycling / deregistration process in this invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] Please see Figure 1 This invention provides a file management method based on identity recognition, comprising: S1: Obtain the first identity feature of the authorizing person, the structured search conditions that limit the scope of file access, and the second identity feature of the designated agent. Generate a unique key based on the first identity feature. Use the unique key to encrypt the underlying character sequence of the structured search conditions to generate the initial authorization ciphertext. Establish a mapping data table entry with the second identity unique identifier generated by the second identity feature as the primary key index and solidify it as a composite agent credential. S2: Receive the file retrieval request initiated by the agent terminal, obtain the real-time identity characteristics of the current operator and perform hash comparison with the second identity characteristics. After the comparison is successful, generate the isolated path evaluation coefficient based on the screen vertical capacitance change sequence and the original search terms. When the isolated path evaluation coefficient is not greater than the abnormal cutting threshold, retrieve the mapping data table entry based on the second identity unique identifier code, and retrieve the key encapsulation value based on the slot number to restore the unique key. After the integrity verification is successful, restore the structured search conditions. S3: Extract the target data table name and row record matching logic from the structured search conditions, generate a target record identifier set and compile it into a normalized execution expression, write the normalized execution expression into the underlying routing interception instruction, divide the database physical memory pool into independent cache areas according to the target record identifier set, and form a temporary search sandbox description table containing the start address space, the end address space and the address mapping table. S4: Locate the session pointer attribute corresponding to the file retrieval request, rewrite the default addressing base address and maximum addressing offset according to the temporary retrieval sandbox description table, complete the file data reading item by item in the independent buffer and encapsulate it into a read-only data stream and feed it back to the agent terminal, and erase the independent buffer and delete the mapping data table entry and the slot number corresponding to the composite agent credential after the transmission is detected to be finished.

[0022] This invention establishes a continuous processing link from authorization registration to post-meeting cleanup based on a temporary proxy access. First, an initial authorization ciphertext is generated using the authorizer's primary identity features and structured search conditions. Then, a composite proxy credential is established using the agent's secondary identity features. Real-time identity verification and abnormal intent identification are performed when the proxy request arrives. Subsequently, the structured search conditions are restored and transformed into a target record identifier set, a low-level routing interception instruction, and a temporary search sandbox description table. Finally, the session addressing boundary is rewritten, a read-only data stream is output, and deregistration and recycling are performed.

[0023] Before a temporary proxy retrieval is actually initiated, the authorization boundary remains at the level of the authorizing person's verbal intent, the designated relationship of the proxy object, and the description of the target file scope. If the authorizing person's identity, the agent's identity, and the retrieval scope are not compressed into indexable, encryptable, and recyclable underlying objects at this stage, subsequent identity verification can only identify who the operator is, but cannot accurately limit the retrieval boundaries that can be recovered. Therefore, step S1 first undertakes the task of consolidating the authorization registration entry, solidifying the personnel information and scope information involved in a proxy retrieval into a composite proxy credential, providing a unique handle for identity verification and authorization restoration when subsequent requests arrive.

[0024] Step S1 includes the following processing: S101. First identity feature acquisition, consistency determination and first biometric vector generation.

[0025] After entering the authorization registration stage, the first identity feature of the authorizing person is collected. The first identity feature is defined as a set of multi-source biometric identities used to uniquely represent the authorizing person. The composition is fixed as facial deep texture sequence, iris coding sequence, and finger vein topology sequence. The collection order remains unchanged, and the number of collections is fixed to three consecutive times. After the three collections are completed, denoising, scale alignment, orientation registration, and positional unification processing are performed on each type of biometric data to map the three collection results into a completely consistent positional framework. Then, using all positions as the basis for judgment, the consistency of the three collection results is compared position by position. The ratio of the number of positions that are all the same in the same position in the three results to the total number of all positions is calculated to obtain the consistency ratio.

[0026] The consistency ratio is defined as the degree of stable repetition of the three collection results under a unified position. Its value range is fixed between zero and one. The closer the consistency ratio is to one, the higher the degree of reproducibility of the first identity feature in this registration. The consistency threshold is defined as the minimum consistency ratio allowed to enter the key export processing. The consistency threshold is not temporarily specified, but is obtained through a pre-deployed sample set. For example, the acquisition method can be to statistically analyze the consistency distribution when the legitimate authorized person repeatedly collects data and the consistency distribution when the unauthorized person accidentally overlaps under the same model of acquisition device, the same acquisition posture, and the same illumination conditions, and then take the boundary position of the misjudgment of the two distributions as the consistency threshold.

[0027] When the consistency ratio reaches or exceeds the consistency threshold, a majority vote is performed on each of the three acquisition results. If at least two of the three acquisition results are the same for a certain bit, the majority result of that bit is written into the stable output bit sequence. All stable output bit sequences are concatenated end to end in a predetermined order to form the first biometric vector. The first biometric vector is defined as a fixed-length bit sequence obtained by processing the first identity feature through unified bit sequence processing, consistency judgment and majority voting. The subsequent unique key derivation is based on the first biometric vector as the unique input basis. For example, after the file manager completes facial gaze, iris sampling and finger vein compression at the authorization station, only if the three acquisitions show stable repetition in the vast majority of bit sequences can the registration link continue to be executed. Only in this way can the first biometric vector have repeated derivation value.

[0028] S102. Exporting the unique key, writing the random salt value, and registering the key encapsulation value.

[0029] After the first biometric vector is formed, a random salt value is generated. The random salt value is defined as a fixed-length random byte sequence generated by a cryptographically secure random number source during authorization registration. Its purpose is to break up the static comparability of similar inputs, so that different authorization registration batches will not have a fixed output pattern due to similar first biometric vectors.

[0030] The first biometric vector and the random salt value are then concatenated end-to-end in the order of identity followed by randomness, and input into the Secure Hash Algorithm 256 (SHA-256). The first 128 bits of the hash result are taken as the unique key. The unique key is defined as a symmetric encryption key that serves only this agency authorization registration, and its length is consistent with the subsequent AES-128-CBC encryption process. Since the authorizing person usually leaves the registration site when the agency access occurs later, step S2 cannot rely on collecting the first identity feature again to retrieve the unique key. Therefore, the unique key and the random salt value also need to be passed to the Advanced Encryption Standard Key Encapsulation Algorithm (AES Key Encapsulation). The system processes the data using a wrapper (AES-KW) to generate a key encapsulation value. The key encapsulation value is defined as a controlled ciphertext field obtained by encapsulating the unique key and a random salt value using the root key. Only a controlled link holding the root key can decapsulate the data. After the key encapsulation value is generated, a unique slot number is assigned to this authorization registration. The slot number is defined as a unique integer index within the key escrow area used to locate the storage location of the key encapsulation value. The key encapsulation value is then written into the key slot corresponding to the slot number. Subsequent step S2 can read the key encapsulation value and restore the unique key based on the slot number. This transforms the first identity feature from a one-time identity input into a controllable and callable encryption capability, rather than exposing the biometric information itself in the retrieval link.

[0031] S103. Construction of structured search criteria and arrangement of underlying character sequences.

[0032] After the unique key is registered, the authorization boundaries need to be written as structured search conditions that can be directly understood and restored by the underlying database. These structured search conditions are defined as a set of normalized fields that limit the scope of a single proxy access. The fixed components include the target data table name, row record matching logic, read-only access mode, and a single access cancellation flag. The target data table name is defined as the name of the only archive data table that is allowed to be accessed during this proxy access. The row record matching logic is defined as the field constraints that filter records within the target data table name, including at least the field name, comparison relationship, and field value. The read-only access mode is defined as allowing only retrieval and viewing, but not adding, modifying, or deleting data. Status flags, the single access cancellation flag is defined as a session flag that must be triggered for cancellation and recycling after a single access. To prevent boundary ambiguity when concatenating fields, a length field plus a content field is used for sequential arrangement. That is, the length information of the target data table name is written first, followed by the content of the target data table name, then the length information and content of the row record matching logic, and then the length information and content of the read-only access mode and the single access cancellation flag are written in sequence. All content is uniformly converted into a unified encoded byte sequence and then concatenated to form the underlying character sequence. The underlying character sequence is defined as a byte stream object that can be encrypted, decomposed, and reversibly restored, formed by lengthening the structured search conditions.

[0033] For example, if a proxy access only allows viewing the main text record corresponding to a certain contract number and does not allow expansion to the attachment directory and files with the same subject, then only the contract master file table should be written in the target data table name, and only the targeted filtering conditions of contract number and security level should be written in the row record matching logic. The read-only access mode should be written as read-only status, and the single access cancellation mark should be written as single cancellation status. The underlying character sequence formed in this way can be decomposed segment by segment after subsequent decryption, and the authorization boundary will not drift due to natural language ambiguity.

[0034] S104. Generation of second identity unique identifier, generation of initial authorization ciphertext and generation of integrity verification value.

[0035] After the authorization boundary has been compressed into a basic character sequence, the agent's second identity features are then collected. The second identity features are defined as a unique identifier for the agent's identity and a set of identity comparisons, including at least a personnel number byte sequence, a document sequence byte sequence, a pre-registered facial texture digest, and a pre-registered iris texture digest. The personnel number byte sequence and document sequence byte sequence are used to generate the second unique identifier, while the pre-registered facial texture digest and pre-registered iris texture digest are used for subsequent real-time identity comparison. The personnel number byte sequence, document sequence byte sequence, pre-registered facial texture digest, and pre-registered iris texture digest are concatenated in a fixed order and input into the secure hash algorithm SHA-256. The result, truncated to a predetermined length, is used as the second unique identifier, defined as a unique identifier field used to index the agent's identity and locate the authorization registration record.

[0036] An initial vector is then generated, defined as the starting perturbation sequence for the block chaining used in this encryption process. Its length is the same as the unique key length. The underlying character sequence is then padded according to the block length, dividing it into several consecutive plaintext blocks. Encryption is then performed using Advanced Encryption Standard-128 Cipher Block Chaining (AES-128-CBC). The specific processing order is as follows: the first plaintext block is XORed bit by bit with the initial vector, and then sent to the AES-128 transformation under the control of the unique key to obtain the first ciphertext block. Each subsequent plaintext block is XORed bit by bit with the previous ciphertext block, and then sent to the AES-128 transformation under the control of the same unique key to obtain a new ciphertext block. All ciphertext blocks are concatenated with the initial vector in a fixed order to form the initial authorization ciphertext. The initial authorization ciphertext is defined as the core authorization field that carries the ciphertext results of the structured retrieval conditions.

[0037] Confidentiality alone is insufficient to support subsequent authorization restoration. Therefore, an integrity check value also needs to be generated. The integrity check value is defined as a verification field used to verify whether the initial authorization ciphertext, the second identity unique identifier, and the slot number have been tampered with during storage. Specifically, the second identity unique identifier, the initial authorization ciphertext, and the slot number are concatenated in a fixed order and then input into the secure hash algorithm SHA-256. A predetermined length is then extracted as the integrity check value. In subsequent step S2, after retrieving the initial authorization ciphertext and the unique key, the integrity check value is first reviewed before proceeding to the authorization boundary restoration. This limits who can act as a proxy and also limits the scope of authorization that can only be restored without tampering during proxying.

[0038] S105. Writing Mapped Data Table Entries and Solidifying Composite Proxy Credentials.

[0039] After completing the registration of the second identity unique identifier, initial authorization ciphertext, integrity check value, and slot number, a mapping data table entry is established in the relational database. The mapping data table entry is defined as an authorization record unit with the second identity unique identifier as the primary key index and the initial authorization ciphertext, integrity check value, and slot number as associated fields. The second identity unique identifier is responsible for establishing a one-to-one correspondence between the agent's identity and the unique authorization record. The initial authorization ciphertext is responsible for carrying the reversibly decryptable authorization boundary content. The integrity check value is responsible for identifying whether the record has been tampered with during the invocation phase. The slot number is responsible for accurately corresponding the database record with the key encapsulation value in the key escrow area.

[0040] Subsequently, the second identity unique identifier, the initial authorization ciphertext, the integrity check value, and the slot number are jointly solidified into a composite proxy credential. The composite proxy credential is defined as a single-time proxy authorization carrier that can be directly invoked in step S2. After receiving the file retrieval request initiated by the proxy terminal, step S2 first completes the identity comparison based on the second identity characteristics and locates the second identity unique identifier. Then, it retrieves the mapped data table entry based on the second identity unique identifier. Next, it reads the key encapsulation value based on the slot number and restores the unique key. Then, it performs a review of the integrity check value. After confirming that the authorization record has not been tampered with, it performs reverse decryption on the initial authorization ciphertext. Finally, it restores the underlying character sequence and its corresponding structured search conditions. Only in this way can step S3 compile the target data table name and row record matching logic into underlying filtering rules, and only in this way can step S4 lock the session addressing scope within the temporary search sandbox.

[0041] After step S1 is completed, the first identity feature of the authorizing person has been transformed into a unique key, the structured search conditions that limit the scope of access have been transformed into the initial authorization ciphertext, and the second identity feature of the agent has been transformed into a second identity unique identifier code. Together, they are solidified into a composite agent credential through the mapping data table entries. At this time, the identity entry, scope boundary and call index required for one agent access have been written, and the authorization link has been transformed from an abstract authorization relationship to a credential state that can be directly called in step S2.

[0042] After the composite proxy credentials are written, each file retrieval request initiated by the proxy terminal has an index entry. However, the structured search conditions cannot be directly restored at this time. This is because when the request arrives, it is necessary to confirm whether the current operator is the designated proxy and to identify whether the current touch behavior and search content deviate from the single authorization scenario. If the dynamic judgment is skipped at this stage and the initial authorization ciphertext is directly decrypted, the proxy retrieval boundary will revert to the static identity release state. Therefore, step S2 focuses on identity verification, abnormal intent identification and authorization restoration around the time the request is triggered.

[0043] Step S2 includes the following processing: S201. Real-time identity verification and extraction of composite proxy credentials.

[0044] After the proxy terminal submits a file retrieval request, it first calls the identity recognition component to collect the real-time identity features of the current operator. These real-time identity features are fixed and include the personnel number, document sequence, facial texture information, and iris texture information corresponding to the current login session. Then, according to the positional rules fixed during the registration phase, the real-time identity features are converted into a real-time identity comparison vector. Simultaneously, the corresponding comparison fields in the second identity features retained from the previous registration process are converted into a registered identity comparison vector according to the exact same positional rules. After real-time identity verification is successful, the second unique identifier is recalculated based on the personnel number and document sequence in the current login session, and this second unique identifier is used to locate the corresponding mapping data table entry.

[0045] To meet the hash comparison requirements and preserve nearest neighbor similarity, Locality Sensitive Hashing (LSH) is performed on both the real-time identity comparison vector and the registered identity comparison vector using the same set of random projection directions and the same set of projection biases. Specifically, each random projection direction is read sequentially, the identity comparison vector is multiplied by the corresponding random projection direction, and then the corresponding projection bias is added. A positive signature is recorded when the result is not less than zero, and a negative signature is recorded when the result is less than zero. All signature bits are concatenated in a fixed order to form the real-time identity hash signature and the registered identity hash signature, respectively. Then, the two sets of hash signatures are compared bit by bit, and the bits with different values ​​are accumulated to obtain the identity difference bits. The identity difference bits are defined as the degree of difference between the current operator and the designated agent at the hash signature level. The identity difference threshold is defined as the maximum allowable difference bits for identifying the two as belonging to the same agent. The identity difference threshold is determined by the difference bits between a legitimate resampled sample and a sample not belonging to the user. The distribution boundary position is obtained, for example, by first calculating the upper boundary of the difference in the number of bits between legitimate agents under repeated collection conditions, and then calculating the lower boundary of the difference in the number of bits between non-personal samples. The intersection of the two boundaries is written into the identity difference threshold. When the number of bits of identity difference does not exceed the identity difference threshold, the current operator is identified as the designated agent, and the initial authorization ciphertext, integrity check value and slot number in the corresponding composite agency certificate are extracted based on the second identity unique identifier. When the number of bits of identity difference exceeds the identity difference threshold, the file access request is terminated at the identity entry point. For example, after the designated clerk completes the authorization registration, he / she is transferred to the agent terminal to access a certain contract file. Only when the real-time identity hash signature and the registered identity hash signature are kept in close proximity will the subsequent anomaly identification link continue.

[0046] S202. Extraction of high-frequency touch-press momentum integral value.

[0047] After identity verification, the file retrieval request does not immediately proceed to the authorization restoration phase. Instead, it first extracts the near-field touch behavior before the request is triggered. It reads the screen longitudinal capacitance change sequence reported within three consecutive sampling windows before the request is triggered from the agent terminal hardware sensor. The duration of each sampling window is preferably 1 second, and the sampling frequency is preferably 100Hz to 200Hz. The touch driver calculates the screen longitudinal capacitance pressure sequence based on the capacitance change amplitude, contact area, and time increment. Then, a Fast Fourier Transform (FFT) is performed on the screen longitudinal capacitance pressure sequence to convert the time-domain signal into a frequency-domain pressure spectrum. After the conversion, the frequency-domain pressure spectrum is divided into a low-frequency click component and a high-frequency disturbance component according to a pre-calibrated high-frequency boundary frequency. The high-frequency boundary frequency is defined as the boundary frequency between the upper limit of the stable click main energy and the abnormal jitter frequency band. It is obtained by statistically analyzing the highest frequency in the main energy concentration area from multiple sets of stable click samples and writing the frequency corresponding to the upper limit of the envelope into the high-frequency boundary frequency. After the boundary is completed, only the spectral components above the high-frequency boundary frequency are retained, and then the high-frequency pressure components are restored through an inverse transform. The high-frequency pressure components are defined as... The high-frequency disturbance trajectory remaining after stripping the normal click rhythm from the vertical capacitive pressure sequence of the screen is then read hourly along the entire sampling window, and continuously accumulated to obtain the high-frequency touch press momentum integral value. The dimension of the high-frequency touch press momentum integral value is Newton-second, which is used to characterize the cumulative intensity of the fine jitter and short tentative presses in the period before the request is initiated. For example, when the agent repeatedly touches, pauses, deletes, and re-triggers the search box multiple times, the high-frequency disturbance in the vertical capacitive pressure sequence of the screen will increase significantly, and the high-frequency touch press momentum integral value will rise accordingly, thus distinguishing the stable input state from the tentative input state.

[0048] S203. Extraction of semantic topological discrete entropy values.

[0049] After physical interaction anomalies are generated, semantic anomalies are extracted based on the search content itself. This begins by parsing the original search terms from the archive retrieval requests. Before mapping, the original search terms undergo word segmentation, stop word removal, synonym unification, and field alias merging. Subsequently, each original search term is mapped to a bottom-level node in a pre-built global archive knowledge graph. This pre-built global archive knowledge graph uses fixed nodes based on archive subject, file number, security classification, responsible entity, timeline, and business line, with edges representing citation relationships, hierarchical relationships, parallel relationships, and derivation relationships. This knowledge graph can be pre-constructed from archive metadata tables, case file catalog tables, and business relationship tables. After all activated bottom-level nodes form a node set, Dijkstra's shortest path algorithm is used to calculate the number of edges for the shortest path between any two nodes. All shortest path edges are written into an edge number sequence in a unified order. Then, the frequency of each discrete edge number in the edge number sequence is counted. The frequency of each discrete edge number is divided by the total length of the edge number sequence to obtain the corresponding probability of occurrence. Finally, the probability of occurrence of all discrete edge numbers is substituted into the Shannon information entropy calculation rule. Specifically, for each discrete edge number, the negative value of the probability of occurrence is multiplied by the base-2 logarithm, and then all results are summed to obtain the retrieval semantic topology discrete entropy value. When there are fewer than two activated nodes, the retrieval semantic topology discrete entropy value is recorded as zero. When the original search term cannot be mapped to any knowledge graph node, the system marks the request as a high-risk request and directly terminates the subsequent authorization recovery link. The retrieval semantic topology discrete entropy value is measured in bits and is used to characterize the degree of semantic diffusion of the original retrieval terms in the archival knowledge graph. When the original retrieval terms are concentrated around the same file number, the same responsible entity, or the same business chain, the number of shortest path edges between nodes will be concentrated in a few categories, and the retrieval semantic topology discrete entropy value is in a convergent state. When the original retrieval terms cross multiple security levels, multiple responsible entities, and multiple timelines, the number of shortest path edges will be dispersed to multiple categories, and the retrieval semantic topology discrete entropy value will increase accordingly. For example, if an agent only needs to access the procurement contract but continuously enters heterogeneous terms such as acceptance records, audit opinions, and cadre appointments and removals, the activated nodes in the archival knowledge graph will expand across domains, and the retrieval semantic topology discrete entropy value thus reflects the expansion of the semantic travel range.

[0050] S204. Two-dimensional feature node writing and abnormal cutting judgment.

[0051] Once the high-frequency touch press momentum integral value and the retrieval semantic topology discrete entropy value have been formed, the two types of heterogeneous masses need to be written into the same discrimination entry. The writing method is not abstract superposition, but rather the high-frequency touch press momentum integral value is fixedly written into the first coordinate position, and the retrieval semantic topology discrete entropy value is fixedly written into the second coordinate position, thereby forming a two-dimensional feature node. The two-dimensional feature node is defined as the joint input object after the physical interaction anomaly quantity and the semantic anomaly quantity are arranged in a fixed coordinate order.

[0052] To ensure that two-dimensional feature nodes can enter a stable anomaly detection chain, a pre-trained Isolation Forest model needs to be constructed first. For example, in one construction example, 5000 sets of legitimate proxy samples that have been manually verified within 30 days and have no unauthorized records are collected. The high-frequency touch press momentum integral value and the retrieval semantic topological discrete entropy value of each set of samples are written as two-dimensional feature nodes. Then, a pre-trained Isolation Forest model is generated with 200 random trees, a single tree sampling capacity of 256, a maximum tree depth of 8, a minimum number of leaf node samples of 1, and a split dimension of 1. In another construction example, the number of random trees is set to 300, the single tree sampling capacity to 512, and the maximum tree depth to 9, suitable for archival environments with a large number of proxy terminal models and high sample dispersion. Here, the pre-trained Isolation Forest model uses legitimate proxy samples as the main training component; anomaly probe samples do not directly participate in tree structure fitting but are used for subsequent parameter selection and threshold calibration.

[0053] To improve the stability of the judgment, the pre-trained isolated forest model also needs to be trained and optimized. For example, in one training optimization example, 1000 sets of legitimate proxy samples and 1000 sets of abnormal trial samples are first extracted from the historical records to form a validation set. The number of random trees, the sampling capacity of a single tree, and the maximum tree depth are changed for each set. The pass rate of legitimate proxy samples and the interception rate of abnormal trial samples are compared. The parameter combination that simultaneously satisfies the pass rate of legitimate proxy samples is not less than 95% and the interception rate of abnormal trial samples is not less than 90% is retained. In another training optimization example, ten rounds of resampling verification are added. The consistency of the average path depth distribution obtained in each round is compared. The parameter combination with fluctuations exceeding the preset range is removed. Only the model version that remains stable for ten consecutive rounds is retained as the online version.

[0054] After completing the construction and training optimization, the two-dimensional feature nodes are input into the pre-trained isolated forest model. The pre-trained isolated forest model consists of multiple random trees. Each random tree recursively splits the input space along randomly selected split dimensions and split positions. When a two-dimensional feature node is isolated in a random tree, the number of split layers traversed from the root node to the isolated leaf node is recorded as the first-order path depth. The first-order path depths of all random trees are averaged to obtain the average path depth. After obtaining the average path depth, a maximum-minimum linear mapping is applied to project the average path depth onto a value between 0 and 1. The mapping result is the isolated path evaluation coefficient. The minimum and maximum path depths used in the linear mapping are taken from the minimum and maximum average path depths of the validation set before the model goes live. When the maximum path depth is equal to the minimum path depth, the isolated path evaluation coefficient is recorded as zero. The isolated path evaluation coefficient is defined as the degree to which a two-dimensional feature node deviates from the center of the distribution of legitimate proxy samples. The closer the value is to 1, the easier it is for the two-dimensional feature node to be randomly separated.

[0055] The anomaly cutoff threshold is defined as the maximum isolated path evaluation coefficient allowed by the authorization restoration link. This threshold is jointly calibrated using legitimate proxy samples and anomalous probing samples. For example, in one threshold calibration example, the 95th percentile boundary of the isolated path evaluation coefficient in the legitimate proxy samples is first calculated, and then the 5th percentile boundary of the isolated path evaluation coefficient in the anomalous probing samples is calculated. The midpoint between these two boundaries is written into the anomaly cutoff threshold. In another example, the anomaly cutoff threshold is incremented in 0.02 increments, and the threshold with the lowest simultaneous false rejection rate for legitimate proxy samples and the lowest missed release rate for anomalous probing samples is written into the anomaly cutoff threshold. When the isolated path evaluation coefficient does not exceed the anomaly cutoff threshold, the current request is considered not to exhibit anomalous probing characteristics, and the authorization restoration link continues execution. When the isolated path evaluation coefficient exceeds the anomaly cutoff threshold, the current request is considered to have anomalous probing tendencies, and the file retrieval request is terminated at the behavior screening stage.

[0056] S205. Integrity verification, unique key retrieval, and restoration of structured search conditions.

[0057] Only after the isolated path evaluation coefficient passes the abnormal segmentation threshold does it enter the authorization boundary recovery stage. First, the key encapsulation value is retrieved from the key escrow location based on the slot number, and decapsulated using the AES-KW decapsulation algorithm consistent with step S102 to obtain the unique key. Then, the second identity unique identifier, the initial authorization ciphertext, and the slot number are re-concatenated end-to-end according to the fixed order in the previous registration process, and input into the secure hash algorithm SHA-256. A fixed-length output result is taken to form a verification value. Subsequently, the verification value is compared bit-by-bit with the integrity verification value. When the two are completely consistent, it is determined that the composite proxy credential has not undergone byte tampering during the storage stage, and the authorization restoration link continues to execute. If any bit difference occurs between the two, it is determined that the content of the composite proxy credential has been altered, and an immediate termination is requested. After the integrity verification passes, an AES-128-CBC reverse operation is performed on the initial authorization ciphertext using a unique key to recover the underlying character sequence written in the previous registration process. Then, according to the predetermined disassembly order of the length field and content field, the target data table name, row record matching logic, read-only access mode, and single access cancellation mark are restored in sequence. If decryption fails, the length field is invalid, or any essential field is missing in the disassembly result, an immediate termination is requested, and the credential retrieval process is triggered. This fully restores the structured search conditions. For example, if the agent enters search terms around a specified contract number, and the touch action is smooth, the semantic range is concentrated, and the verification value and integrity verification value are consistent, the finally restored structured search conditions will only point to the range of contract records already written during authorization registration and will not expand to the file set outside the range.

[0058] After step S2 is completed, the consistency between the current operator and the designated agent has been confirmed, abnormal touch behavior and abnormal retrieval semantics have been eliminated, and the initial authorization ciphertext has been restored to structured retrieval conditions under the condition that the integrity verification is passed. At this time, the agent access boundary has changed from the encrypted storage state to the parsable state. The target data table name, row record matching logic, read-only access mode and single access cancellation mark have all returned to the executable layer, providing direct input for step S3 to further compress the logical boundary into the execution boundary.

[0059] Once the structured search conditions are restored, the scope of authorization is clear, but it remains at the level of logical expression. If the agent terminal continues to use the original query entry and the original cache addressing method, the logically defined access boundary may still be extended to records outside the scope during execution. Therefore, step S3 no longer focuses on identity or encrypted processing, but further decentralizes the matching logic between the target data table name and row record to fixed hit records, fixed query entry, and fixed cache address range, so that the scope of authorization changes from interpretable conditions to executable physical boundaries.

[0060] Step S3 includes the following processing: S301. Target record identifier set generation.

[0061] In a scenario where the matching logic between the target data table name and row records has been successfully restored, the unique archive data table is first located based on the target data table name. Then, the row record matching logic is broken down into multiple parallel clauses, each of which is further broken down into multiple atomic comparison units. Each atomic comparison unit is fixed and consists of a field name, a comparison relation, and a comparison constant. The comparison relation includes at least one of equality, interval inclusion, set inclusion, and prefix matching. Subsequently, all candidate row records in the archive data table corresponding to the target data table name are evaluated one by one. The evaluation order is fixed as follows: first, each atomic comparison unit is checked item by item; then, the results of the parallel clauses are summarized; finally, all parallel clause results are merged into the matching result of the entire candidate row record. When a candidate row record satisfies the row record matching logic, the primary key value of this candidate row record is written into the target record identifier set. The target record identifier set is defined as the set of primary keys of all records in the archive data table corresponding to the target data table name that conform to the row record matching logic. Its purpose is to transform the originally abstract logical boundary into a fixed range of records that can be directly referenced by subsequent cache loading. If an unsupported comparison relationship occurs in the row record matching logic, or if the target record identifier set is empty, the system will not proceed to the subsequent cache loading process. Instead, it will generate an empty read-only result and directly perform deregistration and recycling. For example, when the scope of proxy access is limited to a certain contract number and the same security level, only row records that simultaneously meet the contract number and security level conditions will enter the target record identifier set; the remaining records will be excluded in this processing stage.

[0062] S302. Normalization of execution expression and generation of underlying route interception instructions.

[0063] After the target record identifier set is generated, the target data table name, target record identifier set, and read-only access mode are further transcribed into a normalized execution expression. The normalized execution expression is defined as a fixed query expression that is uniquely allowed to enter the subsequent retrieval chain. The target data table name determines the archive data table to which the retrieval object belongs, the target record identifier set determines the range of primary keys that can be hit, and the read-only access mode determines that the returned fields are limited to the set of readable fields. The set of readable fields is preferably pre-configured in the archive table structure metadata to exclude internal audit fields, write control fields, and system reserved fields. Subsequently, the original request statement sent to the structured query parser from the proxy terminal undergoes a syntax-level check. This check includes verifying that the table name equals the target table name, the access mode equals the read-only access mode, and the field set is included within the readable field set. Further checks are performed to ensure the original request statement does not contain joins, subqueries, write operations, stored procedure calls, or unauthorized sorting / pagination instructions. If all checks pass, the original request statement is not executed directly but is forcibly rewritten as a parameterized normalized execution expression with the target record identifier set as the primary key filter. If any check fails, the original request statement terminates during the parsing phase. This results in a low-level routing interception instruction, defined as a fixed interception rule written into the structured query parser's rule slot. Its purpose is not to prompt the proxy terminal on how to rewrite the statement, but rather to directly replace all qualified original request statements with normalized execution expressions at the database execution entry point, ensuring that the retrieval actions actually entering the execution layer always correspond only to the target record identifier set.

[0064] S303. Calculation of independent cache capacity and generation of page load rules.

[0065] After the normalized execution expression is fixed, an independent cache area is constructed around the target record identifier set. First, the serialized byte length of each hit row record in the target record identifier set is read one by one. Then, each hit row record is expanded to the aligned record length according to the preset memory alignment granularity, thereby eliminating address misalignment caused by directly concatenating different record lengths. After summing all aligned record lengths, the address mapping table entry length and control header length are added together to obtain the total byte requirement of the independent cache area. Subsequently, the number of physical pages to be requested is calculated based on the single-page byte length of the database physical memory pool. The memory alignment granularity is preferably one of 8 bytes, 16 bytes, or 32 bytes, and the page fill threshold is preferably obtained through historical proxy sample playback. When the total number of bytes of records loaded into a page reaches the page fill threshold, or if loading the next record would cause a page overflow, the current page is sealed and loaded onto the next page. If the target record identifier set is empty, the total byte requirement of the independent cache area is recorded as zero, and subsequent page allocation actions are skipped. An independent buffer is defined as a dedicated buffer area that only loads the record content corresponding to the target record identifier set, the address mapping table, and the control header. Its capacity calculation result directly determines the length range of the subsequent start address space and end address space.

[0066] S304. Generation of the starting address space, the ending address space, and the address mapping table.

[0067] Once the number of physical pages is determined, a request for contiguous page allocation is made to the operating system kernel. When the allocation is complete, the starting address of the independent cache is returned as the starting addressing space. Then, the ending address of the independent cache is calculated according to the number of physical pages and the length of a single page in bytes as the ending addressing space. The starting addressing space and the ending addressing space together define the complete physical boundary of the independent cache. When the total number of bytes required by the independent cache is zero, both the starting addressing space and the ending addressing space point to the preset read-only address of the empty result buffer. Subsequently, according to the fixed sorting order of the primary key values ​​in the target record identifier set, all hit records are written sequentially to an independent buffer. The offset position of the first hit record is fixed at zero, and the offset position of each subsequent hit record is obtained by continuously adding the aligned record lengths of all previous hit records, thus forming an address mapping table. The address mapping table is defined as an index table that writes the primary key value, independent buffer offset position, and aligned record length of each hit record one-to-one. Its function is to accurately map the record objects in the target record identifier set to a specific byte range in the independent buffer. For example, if a proxy access only hits one contract text record and one security classification record, the address mapping table will only retain the primary key value, offset position, and record length of these two records. Subsequent read operations can only enter the independent buffer along this fixed mapping.

[0068] S305. Temporary retrieval sandbox description table generation and instance mounting.

[0069] After the starting address space, ending address space, address mapping table, normalized execution expression, and single access cancellation flag are all generated, the five items are written into the temporary retrieval sandbox description table in a fixed order. The temporary retrieval sandbox description table is defined as a sandbox boundary description object that can be directly called in step S4. The starting address space and ending address space are used to limit the activity boundary of the session pointer attribute, the address mapping table is used to limit the offset relationship of the hit record in the independent cache area, the normalized execution expression is used to limit the query entry point that actually enters the execution layer, and the single access cancellation flag is used to limit the sandbox to only serve a single proxy access. After writing is complete, the temporary retrieval sandbox description table is mounted to the database instance engine to form a temporary retrieval sandbox. The temporary retrieval sandbox is defined as being open only to normalized execution expressions within the database instance engine, and its addressing range is limited to an isolated retrieval area between the start addressing space and the end addressing space. This mounting is not an abstract association, but rather registers the temporary retrieval sandbox description table as the sole boundary source for subsequent session pointer attribute modification actions. This eliminates the need for step S4 to deduce the authorization range again; step S4 can directly read the start addressing space and the end addressing space in the temporary retrieval sandbox description table to complete the retrieval boundary locking.

[0070] After step S3 is completed, the structured search conditions have been decomposed into a set of target record identifiers, a normalized execution expression, a low-level routing interception instruction, an independent cache, an address mapping table, and a temporary search sandbox description table. The record objects and address ranges that the proxy can access have been pre-defined. The database execution link no longer depends on the proxy terminal to organize the query conditions itself. Therefore, step S4 can directly rewrite the session entry based on the temporary search sandbox description table and launch a single read-only feedback.

[0071] After the temporary retrieval sandbox description table is generated, the scope of proxy retrieval has been determined to the starting address space, the ending address space and the address mapping relationship. However, as long as the session entry in the database connection pool still retains the original addressing context, the data pointer of the proxy terminal may still trace back from the existing connection state to the cache outside the scope. Therefore, step S4 focuses on the session pointer attribute to carry out the last layer of entry compression, truly write the physical boundary formed in step S3 into the current connection, and limit the output link to one-way read-only feedback and post-meeting clearing.

[0072] Step S4 includes the following processing: S401. Session entry rebinding and session addressing boundary writing.

[0073] After the temporary retrieval sandbox description table has been written to the database instance engine, the session pointer attribute corresponding to the file retrieval request in the database connection pool is located first. The session pointer attribute is defined as an addressing control object that controls the starting point and moving span of the memory accessible by the current connection. It includes two fixed contents: the default addressing base address and the maximum addressing offset. The default addressing base address is defined as the starting address used when the current connection performs byte reading, and the maximum addressing offset is defined as the maximum byte span allowed to move backward from the default addressing base address. After reading the starting addressing space and ending addressing space in the temporary retrieval sandbox description table in step S4, the default addressing base address is directly rewritten as the starting addressing space, and then the address span obtained by subtracting the starting addressing space from the ending addressing space is calculated. The maximum addressing offset is written, and a temporary retrieval sandbox binding flag is generated. The temporary retrieval sandbox binding flag is defined as a unique binding value that the current connection can only access within the address range pointed to by the temporary retrieval sandbox description table. The writing order is fixed as follows: first write the default addressing base address, then write the maximum addressing offset, and finally write the temporary retrieval sandbox binding flag. This rebinding is not an abstract association, but rather switches the current connection entry from the original file cache page to the address range limited by the temporary retrieval sandbox description table. For example, when an agent retrieves the text of a single procurement contract, after the session entry is rewritten, the address range that the connection entry can reach is only the independent cache area where the contract text record and the security classification record are located. The original file cache page will no longer enter the subsequent reading link.

[0074] S402. Address mapping verification and byte-by-byte reading.

[0075] After the session entry is rebounded, the address mapping table is expanded and read item by item. In step S3, the address mapping table has been written as a fixed mapping item with the primary key value, offset position, and aligned record length of each hit record. When reading each mapping item in step S4, it is first checked whether the primary key value of the hit record belongs to the target record identifier set, and then it is checked whether the end address formed by adding the offset position and the aligned record length falls within the maximum addressing offset. Only when both conditions are met is the current mapping item recognized as a hit record that can be read. After the check is passed, the default addressing base address in the session addressing boundary is added sequentially to the offset position in the current mapping item to obtain the first byte address of the current hit record. Then, the data is read byte by byte along the record length, thus forming a byte-by-byte reading chain. Since the default addressing base address has been rewritten to the starting addressing space, and the maximum addressing offset has been compressed to the address span between the ending addressing space and the starting addressing space, all read addresses formed during the byte-by-byte reading process will fall between the starting addressing space and the ending addressing space. Any byte displacement that exceeds this boundary will be blocked during the address mapping verification stage. For example, when the hit record only contains the contract text, the approval summary, and the security classification field, the byte-by-byte reading action will only unfold along the fixed address sequence of the three records in the independent cache area, and will not extend to the address range of other files of the same topic.

[0076] S403. Read-only sequence frame encapsulation and read-only data stream formation.

[0077] After reading each byte, each hit record is encapsulated into a read-only sequence frame. The read-only sequence frame is defined as a fixed output unit arranged in the following order: length field, primary key field, read-only flag field, content field, and frame check field. The length field indicates the byte length of the content field, the primary key field indicates the unique primary key value of the current hit record in the target record identifier set, the read-only flag field is fixed with a write-prohibited status code, the content field carries the record content obtained from reading each byte, and the frame check field indicates the integrity of the current read-only sequence frame in the output link. In this embodiment, the frame check field is preferably generated using Cyclic Redundancy Check (CRC32). During encapsulation, the length field is written first, followed by the primary key field, then the read-only flag field, then the content field, and finally the frame check field, forming a complete read-only sequence frame. All read-only sequence frames are then concatenated end-to-end according to the primary key order in the address mapping table, and a transmission end marker is appended to the end to form a read-only data stream. The read-only data stream is defined as a unidirectional output byte stream fed back to the agent terminal, which does not contain any write-back entry and is not allowed to be reassembled into a write request on the agent terminal side. For example, when the agent accesses a procurement contract, the content received by the agent terminal is only the contract text, the signature summary, multiple read-only sequence frames corresponding to the security level field, and the transmission end marker at the end. Although the agent terminal can view the content, it cannot write the modification action back to the database instance engine along the same link.

[0078] S404. Transmission completion confirmation and independent buffer erasure.

[0079] After the read-only data stream begins output, the output end continuously monitors whether the last byte window matches the end-of-transmission marker. Each monitoring cycle generates an end-of-transmission determination value, defined as the binary result of whether the current monitoring window has hit the end-of-transmission marker. A perfect match between the monitoring window and the end-of-transmission marker is recorded as a hit; a mismatch is recorded as a miss. To distinguish between occasional identical bytes in the text content and the true end of output, a transmission end confirmation threshold is introduced. This threshold is defined as the number of consecutive end-of-transmission hits required to confirm the end of an output cycle. It is obtained by statistically analyzing historical playback samples under fixed frame format and fixed link length conditions, counting both false positives and false negatives, and then mapping the intersection of these two error rates to... Transmission end confirmation threshold: When the most recent continuous monitoring results reach the transmission end confirmation threshold, or when continuous monitoring exceeds the preset transmission timeout threshold, the output link is considered to have ended. Then, the total number of bytes to be erased in the independent buffer is calculated. The calculation method is to subtract the starting address space from the ending address space, and add the length of one byte that is included in both the beginning and end addresses to obtain the total byte range of the complete independent buffer. Then, the kernel release function is called to write zeros to all bytes in this total byte range bit by bit. The erasure order is fixed to advance byte by byte from the starting address space in the address increment direction until the last byte corresponding to the ending address space is written to zero. After the zeroing is completed, the record content in the independent buffer is physically erased, and there are no more file bytes left in the temporary retrieval sandbox that can be read again.

[0080] S405. Deletion of mapped data table entries and cancellation / recycling of slot numbers.

[0081] After the independent cache erasure is complete, the recycling process continues with the composite proxy credentials. First, a physical deletion command carrying the second unique identifier is sent to the relational database to delete the mapping data table entry indexed by the second unique identifier, completing the recycling of the authorized index entry. Then, a slot deregistration command is sent to the key escrow area based on the slot number. The slot deregistration command is defined as a recycling action that overwrites the key encapsulation value corresponding to the slot number with zero and releases the slot's occupied state. Here, deleting the mapping data table entry and deregistering the slot number are not simply parallel actions; rather, the authorized index entry in the relational database is deleted first, and then the key encapsulation value storage location in the key escrow area is deregistered, thus simultaneously severing the composite proxy credential link and the unique key invocation link. If database deletion succeeds but slot deregistration fails, the system records an abnormal recycling log and continues to retry slot recycling until the preset number of retries is reached or manual intervention is required. If database deletion fails, the reuse of the current second unique identifier is prohibited, and the authorized record is marked as invalid. For example, after an agent completes a single contract file retrieval, although the agent terminal retains the browsing results, the mapping data table entries in the relational database have disappeared, and the key encapsulation value corresponding to the slot number has also been overwritten with a zero value. When the same request is submitted again later, the connection entry can no longer rebuild the structured search conditions.

[0082] After step S4 is completed, the default addressing base address and maximum addressing offset of the current connection have been locked inside the temporary retrieval sandbox. The hit record is read item by item according to the address mapping table and encapsulated into a read-only data stream and returned to the proxy terminal. After the transmission is completed, the independent buffer, mapping data table entries and slot numbers are cleared in sequence. A single proxy retrieval thus forms a complete closed link from session entry locking to exit recycling. The proxy request always corresponds to the authorized record range and address range throughout the entire execution cycle.

[0083] The above embodiments are merely preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A record management method based on identity recognition, characterized in that, Including the following steps: S1: Obtain the first identity feature of the authorizing person, the structured search conditions that limit the scope of file access, and the second identity feature of the designated agent. Generate a unique key based on the first identity feature. Use the unique key to encrypt the underlying character sequence of the structured search conditions to generate the initial authorization ciphertext. Establish a mapping data table entry with the second identity unique identifier generated by the second identity feature as the primary key index and solidify it as a composite agent credential. S2: Receive the file retrieval request initiated by the agent terminal, obtain the real-time identity features of the current operator and perform hash comparison with the second identity features. After the comparison is successful, generate the isolated path evaluation coefficient based on the screen vertical capacitive pressure sequence and the original search terms. When the isolated path evaluation coefficient meets the abnormal cutting threshold, retrieve the initial authorization ciphertext based on the second identity unique identifier and restore the structured search conditions. S3: Extract the target data table name and row record matching logic from the structured search conditions, generate a target record identifier set and compile it into a normalized execution expression, write the normalized execution expression into the underlying routing interception instruction, divide the database physical memory pool into independent cache areas according to the target record identifier set, and form a temporary search sandbox description table containing the start address space, the end address space and the address mapping table. S4: Locate the session pointer attribute corresponding to the file retrieval request, rewrite the default addressing base address and maximum addressing offset according to the temporary retrieval sandbox description table, complete the file data reading item by item in the independent buffer and encapsulate it into a read-only data stream and feed it back to the agent terminal, and erase the independent buffer and delete the mapping data table entry and the slot number corresponding to the composite agent credential after the transmission is detected to be finished.

2. The file management method based on identity recognition according to claim 1, characterized in that, Before generating the unique key in step S1, the first identity feature is collected three times consecutively. The facial depth texture sequence, iris coding sequence, and finger vein topology sequence are denoised, scale aligned, orientation registered, and position unified in a fixed order. Then, the consistency ratio and consistency threshold are used for judgment. After the judgment is passed, the first biometric vector is generated by majority voting bit by bit, which serves as the input object for generating the unique key.

3. The file management method based on identity recognition according to claim 2, characterized in that, In step S1, when generating a unique key, a random salt value is first generated and concatenated with the first biometric vector. Then, a unique key is obtained through secure hashing. At the same time, the unique key and the random salt value are encapsulated into a key encapsulation value. A slot number associated with the second identity unique identifier is assigned, and the initial authorization ciphertext, integrity verification value, and slot number are written together into the mapping data table entry.

4. The file management method based on identity recognition according to claim 1, characterized in that, In step S2, when comparing the real-time identity features of the current operator with the second identity features, the real-time identity comparison vector and the registered identity comparison vector are first formed according to the positional rules consistent with the registration stage. Then, the real-time identity hash signature and the registered identity hash signature are generated using local sensitive hashing. Based on the comparison result of the number of identity difference bits and the identity difference threshold, it is determined whether to continue to execute the subsequent file retrieval request.

5. The file management method based on identity recognition according to claim 4, characterized in that, In step S2, after the identity verification is passed, the vertical capacitive pressure sequence of the screen before the file retrieval request is triggered is collected. After the low-frequency click part is removed by fast Fourier transform, the high-frequency pressure component is obtained. The high-frequency touch press momentum integral value is accumulated along the sampling window. At the same time, the original search terms are mapped to the preset global file knowledge graph. The retrieval semantic topology discrete entropy value is generated according to the shortest path edge distribution. Then, the two are written into the two-dimensional feature node.

6. The file management method based on identity recognition according to claim 5, characterized in that, In step S2, the two-dimensional feature nodes are input into the pre-trained isolated forest model. The isolated path evaluation coefficient is generated based on the average path depth in multiple random trees. The isolated path evaluation coefficient is compared with the abnormal cutting threshold. After the comparison is passed, the key encapsulation value is retrieved based on the slot number to restore the unique key. Then, the initial authorization ciphertext and integrity verification value are reviewed and the structured retrieval conditions are restored.

7. The file management method based on identity recognition according to claim 1, characterized in that, In step S3, the candidate row records are first determined one by one according to the matching logic between the target data table name and the row records. A target record identifier set consisting of the primary key values ​​of the matched records is generated. Then, a normalized execution expression is compiled based on the target record identifier set and the read-only access mode. The normalized execution expression is written into the underlying routing interception instruction of the structured query statement parser so that the file access request is executed according to the fixed query entry.

8. The file management method based on identity recognition according to claim 7, characterized in that, In step S3, the serialized byte length of each hit record is read according to the target record identifier set. The total byte requirement of the independent cache area is calculated by combining the memory alignment granularity, address mapping table entry length and control header length. The page load boundary is divided according to the page filling threshold. Then, the starting address space, the ending address space and the address mapping table are generated. Finally, they are written together with the normalized execution expression and the single access cancellation flag into the temporary retrieval sandbox description table.

9. The file management method based on identity recognition according to claim 1, characterized in that, After locating the session pointer attribute corresponding to the file retrieval request in step S4, the default addressing base address and maximum addressing offset are rewritten according to the starting addressing space and ending addressing space in the temporary retrieval sandbox description table, and written to the temporary retrieval sandbox binding flag. Then, the target record identifier set is read byte by byte according to the address mapping table, and the reading result is encapsulated into a read-only sequence frame according to the length field, primary key field, read-only flag field, content field and frame check field.

10. A file management method based on identity recognition according to claim 9, characterized in that, In step S4, all read-only sequence frames are concatenated in primary key order and a transmission end symbol is appended to form a read-only data stream. After the continuous monitoring results reach the transmission end confirmation threshold, zeros are written bit by bit to the independent buffer according to the total byte range corresponding to the start address space and the end address space. The mapped data table entry is deleted according to the second unique identifier code, and the corresponding key encapsulation value is cancelled according to the slot number.

Images