Method and system for managing permissions of multi-format encrypted document conversion, import and export

Abstract

This invention relates to the field of document management technology, and more particularly to a permission management method for converting, importing, and exporting multi-format encrypted documents. The method acquires a set of multi-format encrypted documents and parses them to obtain document control information; constructs a subject-object association and generates a hierarchical permission topology; upon responding to a conversion request, it analyzes the mapping relationship based on the topology and performs permission verification and access control reconstruction to obtain controlled conversion intermediate data; after conversion, it stores the data as an association and builds an index; upon responding to import / export requests, it performs permission verification based on the topology to complete the operation. This method achieves continuous transfer and precise control of permissions during multi-format document conversion, improving document security and management efficiency.

Description

Technical Field

[0001] This invention relates to the field of document management technology, and in particular to a method and system for permission management of multi-format encrypted document conversion, import and export. Background Technology

[0002] Under current technological conditions, the conversion, import, export, and permission management of multi-format encrypted documents are typically handled separately. The conventional approach is to first decrypt the encrypted document into temporary plaintext, then use a general format conversion tool to perform format transformation, and finally re-configure permissions for the converted document. Permission management is independent of the document format conversion stage, relying on a document management system or digital rights management platform to bind access control lists or encryption keys to documents of different formats. When handling heterogeneous format documents, this approach often requires manual intervention or predefined conversion rules to convert the source format's permission attributes into permission parameters recognizable by the target format using an external mapping table.

[0003] This conventional approach has significant drawbacks. First, the inheritance of permissions during document conversion is poor. The intermediate stage of conversion after decryption can easily create permission vacuums, exposing sensitive data during temporary storage or transmission. Furthermore, resetting permissions after conversion can easily overlook details of the original permissions; for example, restrictions on specific operations (such as printing and copying) may be lost due to format differences. Second, permission models for different document formats are highly heterogeneous. For example, there is a lack of a unified, standardized parsing and mapping mechanism for encryption dictionaries in PDFs, permission policies in Office documents, and metadata tags in image formats. This means existing conversion tools cannot automatically identify and migrate control information, requiring manual verification or the use of hard-coded mapping tables. This approach is inefficient and cannot cover all formats, leading to inconsistent permission configurations or over-authorization, affecting document security and compliance. Summary of the Invention

[0004] This invention provides a method and system for managing permissions for converting, importing, and exporting multi-format encrypted documents, which can solve the problems in the prior art.

[0005] A first aspect of this invention provides a permission management method for converting, importing, and exporting multi-format encrypted documents, comprising: obtaining a set of multi-format encrypted documents; traversing each document in the set of multi-format encrypted documents; parsing the format specifications and encryption control information of each document to obtain a document control information set; extracting permission subject identifiers and permission object identifiers based on the document control information set; constructing a subject-object association relationship to obtain a permission association description; performing normalization parsing and topological mapping on the original permission configurations of the heterogeneous formats according to the permission association description; generating a standardized permission topology and performing hierarchical division to obtain a hierarchical permission topology structure; and responding to a document format conversion request by, according to the hierarchical... The permission topology analysis identifies the mapping relationship of control information between the source and target formats, identifies the permission inheritance path of each data object during the conversion process, and performs permission boundary verification and access control reconstruction on the data objects during the conversion process based on the permission inheritance path to obtain controlled conversion intermediate data. A format conversion operation is then performed on the controlled conversion intermediate data to reorganize the converted data into the target format data structure, generating a target format document. The target format document is then associated with the hierarchical permission topology for storage, constructing a document topology association index. In response to import / export requests, permission verification is performed on the target format document based on the hierarchical permission topology before completing the import / export operation.

[0006] In one optional embodiment, the format specifications and encryption control information of each document are parsed to obtain a document control information set, including: reading the file header information of the multi-format encrypted documents, extracting the format identifier field and version identifier field, identifying the document format family affiliation, and obtaining a basic format description; parsing the encryption control section of the multi-format encrypted documents, extracting the access control list and encryption policy description, identifying the encryption control level, and obtaining an encryption control description; traversing the metadata area of ​​the multi-format encrypted documents, extracting document creation attributes and modification tracking attributes, determining the document lifecycle stage, and obtaining a document lifecycle description; analyzing the data partition structure of the multi-format encrypted documents, extracting data block boundary identifiers and data block type identifiers, determining the data block functional category, and obtaining a data partition description; performing consistency verification on the basic format description, the encryption control description, the document lifecycle description, and the data partition description, identifying conflicting and redundant items among the description items, and removing the conflicting and redundant items according to preset rules to obtain a verified description set; associating and fusing the description items in the verified description set, constructing a document control information index based on the association and fusion results, and obtaining a document control information set.

[0007] In one optional embodiment, the following steps are taken: First, extract the permission subject identifier and permission object identifier from the document control information set; construct a subject-object association relationship to obtain a permission association description; then, perform normalization parsing and topological mapping on the original permission configuration of the heterogeneous format based on the permission association description to generate a standardized permission topology and perform hierarchical division to obtain a layered permission topology structure. This includes: extracting the permission subject identifier and permission object identifier from the document control information set; determining the permission action direction to obtain a permission subject description and a permission object description; constructing a subject-object association relationship based on the permission subject description and the permission object description; determining the permission transmission path to obtain a permission association description; performing normalization parsing on the original permission configuration of the heterogeneous format based on the permission association description; extracting the permission operation type and permission scope; determining the permission function category to obtain a normalized permission description; constructing a node set and an edge set based on the normalized permission description; determining the connection attributes and connection weights between nodes to generate a standardized permission topology; and performing hierarchical division on the standardized permission topology, determining the hierarchical affiliation and hierarchical constraint relationship based on the permission scope and the permission operation type to obtain a layered permission topology structure.

[0008] In one optional embodiment, the standardized permission topology is hierarchically divided, and the hierarchical affiliation and constraint relationships are determined based on the permission scope and permission operation type to obtain a hierarchical permission topology structure. This includes: traversing each node in the standardized permission topology, extracting the permission scope attribute and permission operation type attribute of each node, determining the permission function category of each node based on the permission scope attribute and permission operation type attribute, and obtaining a node attribute description; calculating the permission dependency strength between each node based on the node attribute description, determining the dominance and subdominance relationships between nodes, and obtaining a node dependency relationship description; dividing each node into different levels according to the node dependency relationship description, determining the hierarchical affiliation of each node based on the dominance and subdominance relationships, and obtaining a hierarchical allocation result; identifying the permission transmission direction between adjacent levels based on the hierarchical allocation result, constructing directed connections between levels, determining the constraint strength between levels, and obtaining a hierarchical constraint relationship; integrating the hierarchical allocation result and the hierarchical constraint relationship into the standardized permission topology, verifying the completeness of the hierarchical division based on the hierarchical constraint relationship, and obtaining a hierarchical permission topology structure.

[0009] In one optional embodiment, in response to a document format conversion request, the control information mapping relationship between the source format and the target format is analyzed based on the hierarchical permission topology, the permission inheritance path of each data object during the conversion process is identified, and permission boundary verification and access control reconstruction are performed on the data objects during the conversion process based on the permission inheritance path to obtain controlled conversion intermediate data. This includes: receiving a document format conversion request, extracting source format identifiers and target format identifiers, and determining the format conversion type; querying permission nodes in the hierarchical permission topology to obtain a set of source nodes and a set of target nodes; analyzing the control information mapping relationship between the source node set and the target node set, identifying the permission inheritance path based on the control information mapping relationship, and obtaining a permission inheritance path description; determining the permission boundaries of each data object based on the permission inheritance path description, and obtaining a permission boundary description; performing boundary verification based on the permission boundary description, identifying out-of-bounds data objects and compliant data objects based on the boundary verification result, and obtaining a verification result; reconstructing access control for out-of-bounds data objects based on the verification result, and retaining the original access permissions for compliant data objects, to obtain controlled conversion intermediate data.

[0010] In one optional embodiment, boundary verification is performed based on the permission boundary description to identify out-of-bounds data objects and compliant data objects, and to obtain verification results. This includes: traversing each data object during the conversion process, extracting the data type identifier and data location identifier of each data object, determining the storage location and data type of each data object based on the data type identifier and data location identifier, and obtaining a basic description of the data object; querying the permission boundary range of each data object based on the permission boundary description, and obtaining a boundary range description based on the query results; matching the basic description of the data object with the boundary range description, determining the coverage relationship between the actual access range and the permission boundary range based on the matching results, calculating the deviation degree of each data object, and obtaining the coverage relationship; performing a consistency judgment based on the coverage relationship and the deviation degree, identifying data objects whose actual access range exceeds the permission boundary range as out-of-bounds data objects, and identifying data objects whose actual access range does not exceed the permission boundary range as compliant data objects; classifying and labeling the out-of-bounds data objects and the compliant data objects, and obtaining a verification result based on the classification and labeling results.

[0011] In one optional embodiment, a format conversion operation is performed based on the controlled conversion intermediate data to reorganize the converted data into a target format data structure, generating a target format document. The target format document is then associated with the hierarchical permission topology structure for storage, constructing a document topology association index. In response to an import / export request, permission verification is performed on the target format document according to the hierarchical permission topology structure to complete the import / export process. This includes: determining a structure mapping rule based on the controlled conversion intermediate data; obtaining a structure mapping description based on the structure mapping rule; converting the data format based on the structure mapping description; generating a target format document based on the converted data structure; extracting a unique identifier from the target format document; binding the unique identifier with the root node identifier of the hierarchical permission topology structure to obtain an association storage index; writing the association storage index into an association storage area; and completing the association storage based on the writing result. An import / export request is received, and the request subject identifier and operation type are extracted. An import / export request description is generated based on the request subject identifier and operation type. The permission range of the request subject identifier in the hierarchical permission topology structure is queried, and the request operation type is determined based on the import / export request description to determine whether it falls within the permission range. If it does, the import / export operation is performed.

[0012] A second aspect of this invention provides a permission management system for converting, importing, and exporting multi-format encrypted documents, comprising: The document parsing unit is used to obtain a multi-format encrypted document set, traverse each document in the multi-format encrypted document set, parse the format specifications and encryption control information of each document, and obtain a document control information set. The permission topology unit is used to extract the permission subject identifier and permission object identifier based on the document control information set, construct the subject-object association relationship, obtain the permission association description, perform normalization parsing and topology mapping on the original permission configuration of the heterogeneous format according to the permission association description, generate a standardized permission topology and perform hierarchical division to obtain a hierarchical permission topology structure. The permission conversion unit is used to respond to a document format conversion request, analyze the control information mapping relationship between the source format and the target format according to the hierarchical permission topology, identify the permission inheritance path of each data object in the conversion process, and perform permission boundary verification and access control reconstruction on the data objects in the conversion process based on the permission inheritance path to obtain controlled conversion intermediate data. The format conversion unit is used to perform a format conversion operation based on the controlled conversion intermediate data, reorganize the converted data into a target format data structure, and generate a target format document. The associated storage unit is used to associate the target format document with the hierarchical permission topology structure, construct a document topology association index, and in response to an import / export request, perform permission verification on the target format document according to the hierarchical permission topology structure and then complete the import / export operation.

[0013] A third aspect of the present invention provides an electronic device, comprising: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0014] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0015] This permission management method achieves seamless inheritance and dynamic reconstruction of permissions during the conversion process of multi-format encrypted documents, completely solving the problem of permission loss or disorder caused by format differences in traditional methods. By extracting subject and object identifiers and constructing a standardized permission topology, even if the source document uses heterogeneous encryption strategies (such as different industry standards or proprietary protocols), it can be uniformly normalized and parsed into a hierarchical permission model, ensuring the integrity and consistency of permission configuration. The target document after format conversion is associated and stored with the hierarchical permission topology, forming a document topology association index, which supports quick location of the global permission relationship of any document. During import and export operations, there is no need to parse the encryption control information of the source document a second time. It directly performs permission verification based on the established topology, significantly reducing real-time parsing overhead and improving response speed several times over. Through inheritance path recognition and controlled conversion mechanisms, it ensures that the permission boundaries of data objects remain clear throughout the conversion process. Whether a document is converted from an encrypted PDF to a Word document or from a proprietary format to an open format, the permission control policy can be fully mapped to the target format, avoiding errors and redundancy caused by manual secondary configuration. In summary, it fundamentally eliminates the blind spots in permission management during the conversion, import, and export of multi-format documents, integrating the originally scattered encryption control information into a unified logical architecture, which not only enhances data security protection capabilities but also simplifies the operation and maintenance process. Attached Figure Description

[0016] Figure 1 A flowchart illustrating the permission management method for converting, importing, and exporting encrypted documents in multiple formats; Figure 2 Reconstructing the flowchart for permission boundary verification and access control. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0019] Figure 1 This is a flowchart illustrating the permission management method for converting, importing, and exporting multi-format encrypted documents according to an embodiment of the present invention.

[0020] The methods for managing permissions for converting, importing, and exporting multi-format encrypted documents include: Obtain a set of encrypted documents in multiple formats, traverse each document in the set, parse the format specifications and encryption control information of each document, and obtain a set of document control information. Based on the document control information set, the permission subject identifier and permission object identifier are extracted, the subject-object association relationship is constructed, the permission association description is obtained, and the original permission configuration of the heterogeneous format is normalized and topologically mapped according to the permission association description to generate a standardized permission topology and perform hierarchical division to obtain a hierarchical permission topology structure. In response to a document format conversion request, the control information mapping relationship between the source format and the target format is analyzed based on the hierarchical permission topology, the permission inheritance path of each data object in the conversion process is identified, and permission boundary verification and access control reconstruction are performed on the data objects in the conversion process based on the permission inheritance path to obtain controlled conversion intermediate data. Perform a format conversion operation based on the controlled intermediate conversion data, reorganize the converted data into a target format data structure, and generate a target format document; The target format document is associated with the hierarchical permission topology and stored together to construct a document topology association index. In response to an import / export request, the import / export operation is completed after the permission verification of the target format document is performed according to the hierarchical permission topology.

[0021] In one optional embodiment, the format specifications and encryption control information of each document are parsed to obtain a set of document control information, including: Read the header information of multi-format encrypted documents, extract the format identifier field and version identifier field, identify the document format family, and obtain the basic format description; The encryption control section of the multi-format encrypted document is parsed to extract the access control list and encryption policy description, identify the encryption control level, and obtain the encryption control description. Traverse the metadata area of ​​the multi-format encrypted document, extract the document creation attributes and modification tracking attributes, determine the document lifecycle stage, and obtain the document lifecycle description; Analyze the data partitioning structure of the multi-format encrypted document, extract data block boundary identifiers and data block type identifiers, determine the functional category of the data block, and obtain the data partitioning description; The consistency of the format basic description, the encryption control description, the document lifecycle description and the data partition description is checked, conflicting and redundant items are identified among the description items, and the conflicting and redundant items are removed according to preset rules to obtain the verified description set. The description items in the verified description set are associated and fused, and a document control information index is constructed based on the association and fusion results to obtain the document control information set.

[0022] In one specific implementation, during the parsing of multi-format encrypted documents, the initial byte sequence of the document is first accessed via a file stream read operation. This byte sequence typically contains the magic number identifier of the document format. The document file is opened in binary mode, and the format identifier is read from the first 16 to 32 bytes of the file header. This identifier may exist in the form of a fixed byte sequence; for example, a PDF document begins with "%PDF-", and an Office Open XML document begins with "PK" byte pairs. The extracted format identifier field is then byte-converted and matched against a built-in format identifier library to determine which format family the document belongs to. Simultaneously, the version number field is read from a specific offset position in the file header. This field is typically stored as a fixed-length string or numeric value; for example, the version number for a PDF might be "1.7" or "2.0". By analyzing the combination of the format identifier and the version number, the complete format specification to which the document belongs is identified, including the format name, major version number, minor version number, and revision number. This information together constitutes the basic format description.

[0023] Extracting encryption control information requires locating the storage location of the encryption control segment according to different format specifications. For PDF format, encryption control information is stored in the `Encrypt` entry of the `Trailer` dictionary. Parsing this dictionary structure yields parameters such as encryption algorithm type, key length, and permission flags. For OOXML format, encryption information is located in the `EncryptionInfo` stream, containing encryption descriptors, key data, and hash information. During parsing, an access control list is extracted, recording permission configurations for operations such as printing, copying, editing, and commenting. The access control list is expressed using bitmasks or explicit permission entries; for example, the 4th bit of the bitmask indicates printing permission, and the 8th bit indicates content extraction permission. Simultaneously, an encryption policy description is extracted, including encryption algorithm identifiers (e.g., AES-256, RC4-128), encryption modes (e.g., CBC, ECB), initialization vector length, and other technical parameters. Based on the storage hierarchy of the encryption control information, different encryption control levels, such as document-level encryption, object-level encryption, and stream-level encryption, are identified. This hierarchical information is integrated into an encryption control description.

[0024] Extracting document metadata involves a systematic traversal of metadata regions. In PDF documents, metadata is stored in an Info dictionary or XMP metadata stream. These structures are parsed to obtain attributes such as creation time, modification time, author information, and application information. In OOXML documents, metadata resides in the core.xml and app.xml files under the docProps directory. An XML parser reads and extracts relevant attribute nodes. Document creation attributes include creation timestamps, creator identifiers, and application version information; these attributes are stored in a mix of timestamp and string formats. Modification tracking attributes record every modification operation to the document, including modification timestamps, modifier identifiers, and modification operation types; some formats also include a revision history list. By calculating the difference between the current time and the creation time, and analyzing the number of modifications and the last modification time, the document's lifecycle stage—whether it's in the initial creation stage, active editing stage, stable maintenance stage, or archiving stage—is determined. These stage determinations constitute a document lifecycle description.

[0025] Analyzing data partitioning structures requires identifying logical partitions within the document. PDF documents use an object stream organization method, determining the byte offset and object number of each object by parsing the cross-reference table. Each object contains an object identifier, an object type identifier (such as a dictionary object, stream object, or array object), and object content. Data block boundaries are determined by the starting offset and length fields, and data block types are identified by object type or stream filter name. OOXML documents use a ZIP compressed package structure, containing multiple XML and binary components. The boundary position of each component is determined by parsing the central directory record. Data block type identification is based on the component's content type attribute; for example, "application / vnd.openxmlformats-officedocument.wordprocessingml.document.main+xml" represents the main document component. Based on the content type and functional characteristics of the data blocks, they are divided into functional categories such as content data blocks, style data blocks, media data blocks, and relational data blocks. This category information forms the data partition description.

[0026] After obtaining the basic format description, encryption control description, document lifecycle description, and data partition description, a consistency check is performed. The check first checks if the version number in the basic format description matches the supported encryption features in the encryption control description. For example, PDF version 1.4 does not support the AES encryption algorithm; if a version mismatch is detected, it is marked as a conflict. Next, it checks if the modification timestamp in the document lifecycle description is later than the creation timestamp; if a timing error exists, it is marked as a conflict. Then, it checks if there are overlapping or out-of-bounds boundaries for data blocks in the data partition description; if the end of a data block exceeds the total file length, it is marked as a conflict. Finally, it identifies redundant information between description items; for example, if the creator information in the metadata is duplicated with the permission owner information in the encryption control, one of them is marked as redundant.

[0027] The removal of conflicting and redundant items follows a predefined priority rule. For conflicting items, descriptive information from the file header and core structure is retained first; for example, in conflicts involving format identifier fields, the identifier in the file header is used instead of the declaration in the metadata. For conflicts involving encryption control levels, the strictest encryption strategy is used first. For timestamp conflicts, correction is performed by checking the file system modification time as a reference. For redundant items, descriptive items with more information and more reliable sources are retained first; for example, detailed permission configurations in the encryption control section are retained while simplified permission declarations in the metadata are removed. The removal operation generates a clean set of descriptive items, in which each description is logically consistent and free of information redundancy, forming the verified descriptive set.

[0028] The association and fusion operation establishes relationships between the individual descriptive items in the verified descriptive set. A correspondence is established between the format identifier in the basic format description and the data block type in the data partition description, determining the parsing method for each data block type under a specific format. A correlation is established between the permission configuration in the encryption control description and the modification tracking in the document lifecycle description, identifying the temporal relationship between permission changes and document modifications. A mapping is established between the data block boundaries in the data partition description and the encryption objects in the encryption control description, determining which data blocks are protected by what level of encryption. By constructing an association matrix between descriptive items, the originally discrete descriptive information is integrated into structured information with inherent connections.

[0029] A document control information index is constructed based on the correlation and fusion results, employing a multi-level index structure. The first-level index uses the document identifier as the key, pointing to the basic format description entry for that document. The second-level index uses the description type as the key, including four sub-indexes: format description index, encryption description index, lifecycle description index, and partition description index. The third-level index contains specific description item indexes; for example, the encryption description index includes algorithm index, permission index, and key index. Each index entry contains a pointer to the actual description data and metadata about the description data (such as data length, data type, and update timestamp). The index structure supports fast querying and locating, enabling the target description information to be located within a constant time based on the document identifier and description type. By aggregating the index entries of all documents, a complete document control information set covering a multi-format encrypted document set is formed. This set organizes the format specifications and encryption control information of all documents in a structured and searchable manner.

[0030] In one optional embodiment, permission subject identifiers and permission object identifiers are extracted based on the document control information set, a subject-object association relationship is constructed to obtain a permission association description, and the original permission configuration in the heterogeneous format is normalized and topologically mapped according to the permission association description to generate a standardized permission topology and perform hierarchical division to obtain a hierarchical permission topology structure, including: Extract the permission subject identifier and permission object identifier from the document control information set, determine the direction of permission action, and obtain the permission subject description and permission object description; Based on the description of the permission subject and the description of the permission object, a subject-object association relationship is constructed to determine the permission transmission path and obtain the permission association description; Based on the permission association description, the original permission configuration in the heterogeneous format is normalized and parsed to extract the permission operation type and permission scope, determine the permission function category, and obtain the normalized permission description. Based on the normalized permission description, a node set and an edge set are constructed, the connection attributes and connection weights between nodes are determined, and a standardized permission topology is generated. The standardized permission topology is divided into levels, and the hierarchical affiliation and hierarchical constraint relationship are determined according to the scope of permission and the type of permission operation to obtain a hierarchical permission topology structure.

[0031] In one specific implementation, after obtaining the document control information set, it is necessary to extract the core elements related to permissions to construct a complete permission description system. Permission subject identifiers typically include information that indicates the identity of the permission holder, such as user identifiers, role identifiers, and organization identifiers, while permission object identifiers include information that indicates the object to which the permission applies, such as document identifiers, chapter identifiers, paragraph identifiers, and attachment identifiers. During the extraction process, the specific type of permission subject is identified by parsing the Access Control List (ACL), permission matrix, or Role-Based Access Control (RBAC) configuration in the document control information set. For example, when the document control information contains usernames, user group names, or role names, these are extracted as permission subject identifiers. Simultaneously, the hierarchical structure of permission objects is identified. For PDF documents, there may be multiple levels of objects, such as the entire document, specific pages, and embedded objects; for Office documents, there may be objects such as the document body, worksheets, cell ranges, and embedded charts.

[0032] After extracting the subject and object identifiers, it is necessary to determine the direction of the permission, that is, whether the subject has permission for the object, or whether the object restricts the subject's access. By analyzing the permission granting and denying records in the document control information, the positive authorization or negative restriction attribute of the permission's direction of action can be determined. For example, when the control information explicitly records "User A has read permission for document D," the direction of action is positive authorization; when it records "User B is prohibited from accessing Chapter 3 of document D," the direction of action is negative restriction. This analysis forms a permission subject description, which includes the subject's identifier, subject type (individual user, role, user group), subject hierarchy, and subject priority information; simultaneously, a permission object description is formed, which includes the object's identifier, object type (document, paragraph, object), object scope, and object sensitivity level information.

[0033] When constructing subject-object relationships based on permission subject and object descriptions, a triplet structure needs to be established. Each triplet contains three elements: subject identifier, relationship type, and object identifier. The relationship type includes not only basic operations such as read, write, execute, and delete, but also more granular extended permissions such as edit, comment, print, forward, and copy. During the construction of relationships, the inheritance and transitivity of permissions need to be handled. When user A belongs to role R, and role R has read permission for document D, user A indirectly obtains read permission for document D through the role inheritance path. When determining permission transit paths, all possible transit chains need to be identified, including direct authorization paths, paths through role inheritance, paths through user group membership relationships, and paths through permission delegation mechanisms. For each transit path, the starting point (permission source), intermediate nodes (transmission medium), and ending point (final recipient of permission) are recorded to form a complete permission relationship description.

[0034] After obtaining the permission association description, normalization parsing is required to handle heterogeneous permission configurations from documents of different formats. Different document formats use different permission representations; for example, PDFs use encrypted dictionaries and permission flags, Office documents use Information Rights Management (IRM) configurations, and CAD documents use layer access control. The goal of normalization parsing is to convert these heterogeneous permission representations into a standardized permission description model. When extracting permission operation types, an operation type mapping table needs to be established to map operation identifiers from different formats to a unified set of operation types. For example, the "AllowPrinting" flag in PDFs, the "Print" permission in Office documents, and the "PlotEnable" attribute in CAD documents can be uniformly mapped to the "Print" operation type. When extracting the scope of permission effects, it is necessary to identify the granularity of permission control, including different scopes such as document level, chapter level, paragraph level, and object level, and determine which specific data ranges each permission configuration applies to.

[0035] When determining permission function categories, permissions are classified according to their functional purpose, including data protection permissions (preventing unauthorized access), integrity protection permissions (preventing unauthorized modification), availability assurance permissions (ensuring authorized users have normal access), and audit traceability permissions (recording access behavior). This classification forms a normalized permission description, which is represented by a unified data structure and includes fields such as permission identifier, permission type, set of operation types, scope description, effective conditions, invalidation conditions, and priority. The normalized permission description allows permission configurations from different formats to be processed and analyzed within a unified framework.

[0036] When constructing a standardized permission topology based on normalized permission descriptions, the first step is to build a node set, which includes three categories: permission subject nodes, permission object nodes, and permission relationship nodes. Permission subject nodes correspond to subject entities such as users, roles, and user groups; permission object nodes correspond to object entities such as documents, chapters, paragraphs, and objects; and permission relationship nodes correspond to specific permission granting or restriction relationships. Each node carries information such as node identifier, node type, node attributes, and node status. When constructing the edge set, edges represent the connection relationships between nodes, including inheritance relationships between subjects (e.g., the membership relationship from user to role), inclusion relationships between objects (e.g., the inclusion relationship from document to chapter), and permission effect edges from subject to object (e.g., a user's read permission for a document).

[0037] When determining the connection attributes between nodes, each edge needs to be labeled with its connection type, direction, and semantic meaning. Connection types include inheritance, containment, authorization, and restriction, while the connection direction indicates the direction of the relationship's effect. The semantic meaning describes the specific role of the connection in the access control system. When determining connection weights, each edge is assigned a weight value based on the importance, priority, and intensity of the permission. For example, explicitly granted permissions have a higher weight than inherited permissions, and deny permissions have a higher weight than allow permissions. A standardized access control topology is constructed using the set of nodes and edges, which can fully express all access control elements and their relationships in multi-format encrypted documents.

[0038] When dividing a standardized permission topology into hierarchical levels, the topology is divided into multiple levels based on the scope of permission effects. These typically include document-level, chapter-level, paragraph-level, and object-level levels. The document-level level contains permission configurations applicable to the entire document; the chapter-level level contains permission configurations applicable to specific chapters; the paragraph-level level contains permission configurations applicable to specific paragraphs; and the object-level level contains permission configurations applicable to embedded objects (such as images, tables, and attachments). Based on the permission operation type, each level can be further divided into read permission sub-layers, edit permission sub-layers, and management permission sub-layers. The read permission sub-layer controls viewing and accessing data, the edit permission sub-layer controls modifying and updating data, and the management permission sub-layer controls the configuration and changes of the permissions themselves.

[0039] When determining hierarchical affiliation, each permission configuration is assigned to the corresponding level and sub-level based on its scope and operation type. When the scope of a permission configuration spans multiple levels, a reference or copy of that permission configuration is created in all relevant levels to ensure the integrity of permission control. When determining hierarchical constraints, constraint rules are established between levels, including rules for upper-level permissions over lower-level permissions, rules for lower-level permissions over upper-level permissions, and rules for resolving conflicts between permissions at the same level. For example, if a document-level layer denies a user access, the denial rule remains in effect even if the chapter-level layer grants the user access; if a document-level layer grants a user read permission, the chapter-level layer can further refine this to allow reading the first chapter but deny reading the second chapter. Through this hierarchical division and constraint relationship establishment, a complete hierarchical permission topology is formed. This structure can express the global characteristics of permission configurations while supporting fine-grained permission control for specific scopes, providing a structured permission description foundation for subsequent document format conversion and permission inheritance.

[0040] In one optional embodiment, the standardized permission topology is hierarchically divided, and the hierarchical affiliation and constraint relationships are determined based on the permission scope and the permission operation type to obtain a hierarchical permission topology structure, including: Traverse each node in the standardized permission topology, extract the permission scope attribute and permission operation type attribute of each node, determine the permission function category of each node based on the permission scope attribute and the permission operation type attribute, and obtain the node attribute description. Calculate the permission dependency strength between each node based on the node attribute description, determine the dominance and sub-dominance relationships between nodes, and obtain the node dependency relationship description; Based on the node dependency description, each node is divided into different levels, and the level affiliation of each node is determined according to the dominance relationship and the dominated relationship, thus obtaining the level allocation result; Based on the hierarchical allocation results, the direction of permission transfer between adjacent levels is identified, directed connections between levels are constructed, the constraint strength between levels is determined, and the hierarchical constraint relationship is obtained. The hierarchical allocation results and hierarchical constraints are integrated into the standardized permission topology. The integrity of the hierarchical division is verified based on the hierarchical constraints to obtain a hierarchical permission topology structure.

[0041] In one specific implementation, when hierarchically dividing a standardized permission topology, it is first necessary to perform a comprehensive traversal and attribute extraction of all nodes in the topology structure. After the system starts the traversal program, it visits each node in the standardized permission topology according to a depth-first or breadth-first strategy. During the access process, the system reads the permission scope attribute and permission operation type attribute carried by each node. The permission scope attribute typically includes scope identifiers of different granularities such as document level, chapter level, paragraph level, and field level, while the permission operation type attribute covers specific operation types such as read, edit, delete, print, copy, and export. The system extracts these attribute values ​​from the node's metadata storage area to form structured attribute data pairs.

[0042] After obtaining the permission scope and permission operation type attributes of a node, the system performs joint analysis on these attributes according to predefined permission function classification rules. For example, when a node's scope is document-level and the operation type is read, the node is classified into the "Document Access Control" category; when its scope is field-level and the operation type is edit, the node is classified into the "Fine-grained Edit Control" category. The system's built-in classification matrix maps different attribute combinations to specific permission function categories. For some composite nodes, multiple function categories may be associated simultaneously, in which case the primary function category needs to be determined based on attribute weight calculations. After classification, the system generates a node attribute description for each node. This description not only includes the function category identifier but also records the node's priority parameters, constraints, and applicable object scope.

[0043] After the node attribute descriptions are generated, the system enters the permission dependency strength calculation phase. In the permission system of multi-format encrypted documents, there are often complex dependencies between nodes. For example, "edit permission" usually depends on "read permission," and "export permission" may depend on "copy permission." The system constructs a dependency matrix between node pairs by analyzing the operation type and scope in the node attribute descriptions. For nodes... and nodes Calculate the dependency strength between them. This strength value reflects the node For nodes The system considers the necessity of implementing the function. During the calculation, the system considers the inclusion relationship of operation types, the coverage relationship of scope, and the transitivity of permission constraints. For node pairs with direct functional dependencies, the dependency strength value is high; for node pairs with only indirect associations, the dependency strength value is relatively low.

[0044] Based on the calculated dependency strength matrix, the system further determines the dominance and subordinate relationships between nodes. When a node... The dependence strength value is significantly higher than the threshold. At that time, it is considered that the node Dominant Node At this time, node The node is in a subordinate state. The establishment of a dominance relationship is based on the transitivity principle, meaning that if a node... Dominant Node ,node Dominant Node Then the node Same dominant node The system uses graph theory algorithms to determine the dominance relationships of all node pairs, constructing a directed dominance graph. Each directed edge in the graph represents the dependency direction from the dominating node to the dominated node. For sets of nodes with cyclic dependencies, the system identifies these nodes using a strongly connected component detection algorithm and treats them as belonging to the same dominance equivalence class, processing them as a whole during subsequent hierarchical partitioning. Node dependency descriptions are stored in the form of adjacency lists or adjacency matrices, recording the dominance and dominated relationships of all nodes.

[0045] Based on the node dependency description, the system initiates a hierarchical partitioning algorithm. The core principle of hierarchical partitioning is: nodes that dominate other nodes should be located at higher levels, and nodes that are dominated should be located at lower levels. The system adopts the idea of ​​topological sorting, first identifying the set of nodes that are not dominated by any node, and assigning these nodes to the highest level, labeled as the first level. Subsequently, the nodes of the first level are removed from the dependency graph, the in-degree of the remaining nodes is recalculated, a new set of nodes with no in-degree is identified, and these are assigned to the second level. Following this iterative process, the hierarchy is divided layer by layer downwards until all nodes are assigned to a specific level. For strongly connected components containing cyclic dependencies, the entire component is assigned to the same level, and further subdivided into sub-levels within that level to ensure that the relative priority relationships of internal nodes are preserved. The level assignment results are appended to the metadata of each node in the form of level labels, while also recording the list of nodes contained in each level.

[0046] After the hierarchy is assigned, the system needs to identify the direction and path of permission transfer between adjacent levels. For the hierarchy... and the next level next to the adjacent System traversal For each node in the list, check if its dominance relationship extends to... Nodes in the hierarchy. Nodes in Domination level Nodes in Then establish a hierarchy from arrive A directed connection is established, indicating that access control information can be passed from higher to lower levels. The system records all directed connections across levels and constructs a graph of inter-level transmission relationships. This graph not only describes the direction of access control information flow but also marks the constraints on each transmission path.

[0047] Based on establishing directed connections between levels, the system further calculates the constraint strength between levels. The hierarchy was quantified. hierarchical The degree of control is calculated by comprehensively considering the number of cross-level connections, the dependency strength of the connected nodes, and the necessity of permission transfer. Higher constraint strength indicates a stronger dependency of the lower level on the upper level, and a greater impact of permission changes occurring at the upper level on the lower level. The system calculates constraint strength values ​​for each pair of adjacent levels and stores these values ​​in the hierarchical constraint relationship matrix. For non-adjacent levels, although constraint strength is not directly calculated, the cross-level constraint impact can be indirectly derived through transitivity.

[0048] Once the hierarchical constraints are determined, the system integrates the hierarchical allocation results and these constraints into a standardized permission topology. This integration process involves reorganizing the topology, transforming the originally flattened node network into a multi-layered topology with a clear hierarchy. In the new topology, each node retains not only its original permission attribute information but also carries a hierarchical label and references to the constraints between levels. The system inserts hierarchical separators into the topology to clearly indicate the boundaries of each level, facilitating rapid location of the target level for subsequent permission verification and access control operations.

[0049] To ensure the correctness and completeness of the hierarchy partitioning, the system executes a verification procedure based on the hierarchical constraints. The verification procedure first checks whether all nodes have been assigned to a specific hierarchy, confirming that no nodes are unassigned. Secondly, the verification procedure verifies whether the constraints between hierarchical levels meet the transitivity and consistency requirements, for any three levels. , , ,if constraint and constraint ,but Inevitably Indirect constraints exist. The system verifies this characteristic by performing transitive closure calculations, and triggers a correction mechanism when inconsistencies are detected, adjusting the hierarchical allocation or constraint strength values.

[0050] The verification process also evaluates the logical rationality of the hierarchical division, confirming that the scope of permissions for higher-level nodes is generally greater than that for lower-level nodes, and that the operation types of higher-level nodes generally include or dominate the operation types of lower-level nodes. For a few special nodes that do not conform to this pattern, the system analyzes their attribute characteristics to determine whether they are cross-level control nodes. Such nodes may need to be effective in multiple levels simultaneously, so the system creates virtual copy nodes for them and inserts them into the relevant levels to ensure seamless coverage of permission control.

[0051] After verifying the integrity of the hierarchical division, the system generates the final representation of the hierarchical permission topology. This structure is stored in the form of a hierarchical graph model, where the vertical dimension represents the hierarchical relationship and the horizontal dimension represents the parallel relationship between nodes within the same level. Each node contains metadata such as node identifier, permission attribute description, level label, dominance relationship list, and constraint strength value. Directed connections between levels are represented as edges, with permission transfer rules and constraints attached to the edges. The system indexes this hierarchical permission topology, supporting fast retrieval by level, node attribute, and constraint strength, providing an efficient data foundation for permission inheritance path identification and access control reconstruction during subsequent format conversion.

[0052] After the hierarchical permission topology is constructed, the system associates and stores this structure with a collection of multi-format encrypted documents, ensuring that the permission control information of each document is accurately mapped to the corresponding node and level in the topology. The system also configures a version management mechanism for the hierarchical permission topology, recording historical changes and supporting permission configuration rollback and auditing. In practical applications, when a document format conversion request arrives, the system can quickly extract the permission levels corresponding to the source and target formats from the hierarchical permission topology. Based on hierarchical constraints and permission transfer rules, it accurately identifies the permission inheritance path of each data object during the conversion process, thereby achieving refined permission boundary verification and access control reconstruction, ensuring the security and consistency of permission management for multi-format encrypted documents during conversion, import, and export.

[0053] like Figure 2 The diagram shows the flowchart for permission boundary verification and access control refactoring.

[0054] In an optional embodiment, in response to a document format conversion request, the control information mapping relationship between the source and target formats is analyzed based on the hierarchical permission topology, the permission inheritance path of each data object during the conversion process is identified, and permission boundary verification and access control reconstruction are performed on the data objects during the conversion process based on the permission inheritance path to obtain controlled conversion intermediate data, including: Receive document format conversion requests, extract source format identifiers and target format identifiers, and determine the format conversion type; Query the permission nodes in the hierarchical permission topology to obtain the source node set and the target node set; Analyze the control information mapping relationship between the source node set and the target node set, identify the permission inheritance path based on the control information mapping relationship, and obtain the permission inheritance path description; Based on the permission inheritance path description, the permission boundaries of each data object are determined, and the permission boundary description is obtained; Boundary verification is performed based on the aforementioned permission boundary description. Based on the boundary verification results, out-of-boundary data objects and compliant data objects are identified to obtain the verification results. Based on the verification results, access control is reconstructed for out-of-bounds data objects, while original access permissions are retained for compliant data objects, resulting in controlled transformation intermediate data.

[0055] In one specific implementation, upon receiving a document format conversion request, the source format identifier and target format identifier are first extracted from the request parameters. The source format identifier typically includes characteristic information such as file extension, encoding method, and document structure mode, while the target format identifier contains the expected document format specification after conversion. By comparing and analyzing the source and target format identifiers, the format conversion type is determined, including same-type format conversion, cross-type format conversion, and composite format conversion. Same-type format conversion refers to the source and target formats belonging to the same format family but different versions, such as converting DOC to DOCX; cross-type format conversion refers to the source and target formats belonging to completely different format systems, such as converting PDF to DOCX; composite format conversion refers to the source document containing multiple format elements that need to be mapped to different components of the target format.

[0056] Based on the defined format conversion type, the system queries the hierarchical permission topology for permission nodes related to both the source and target formats. The query process employs a depth-first traversal strategy, starting from the top-level permission nodes and searching downwards along the hierarchical relationship to identify all permission nodes matching the source format identifier, forming a source node set. Each node in the source node set records the specific permission control requirements of the source format document, including read, modify, copy, and print permissions. Similarly, the hierarchical permission topology is traversed to identify all permission nodes matching the target format identifier, forming a target node set. The nodes in the target node set define the permission control specifications that the target format document must meet.

[0057] After obtaining the source and target node sets, the mapping relationship of control information between the two sets is analyzed. Establishing this mapping relationship requires considering the equivalence and compatibility of permission semantics. Equivalence mapping means that a permission control in the source format has exactly the same semantics as a permission control in the target format; for example, the "disable printing" permission in the source format can be directly mapped to the "disable printing" permission in the target format. Compatibility mapping means that a permission control in the source format does not have a completely corresponding semantic in the target format, but an approximate control effect can be achieved by combining multiple permissions in the target format or using stricter permission settings. When analyzing the mapping relationship, it is also necessary to identify unmappable permission control items, i.e., permission functions supported by the source format but not by the target format. These permission control items require special handling in subsequent boundary checks.

[0058] The permission inheritance path is identified based on the control information mapping relationship. The permission inheritance path describes the transfer process from the source format permission configuration to the target format permission configuration. For each node in the source node set, a path is found along the associated edges in the hierarchical permission topology to reach a node in the target node set. There may be multiple permission inheritance paths, each representing a possible permission conversion scheme. Path selection prioritizes the scheme with the least permission loss, i.e., preserving as many permission control requirements as possible from the source format during the conversion process. The permission inheritance path description includes all intermediate nodes on the path, the conversion rules between nodes, and the path's weight score, which measures the degree of permission preservation of the path.

[0059] The permission boundaries of each data object are determined based on the permission inheritance path description. Data objects include various data elements such as text content, images, tables, formulas, and metadata in a document. Each data object is controlled by specific permission nodes in the source format. The permission inheritance path determines which target format permission nodes the data object should be subject to after conversion. The permission boundary description defines the scope of operations allowed on the data object during the conversion process, including the range of data that can be read, the attribute fields that can be modified, and the granularity of data that can be transmitted. For complex data objects with nested structures, the permission boundaries of each sub-object need to be determined recursively to ensure consistency of permission control throughout the entire object tree.

[0060] During permission boundary verification, the actual access requirements of each data object are compared with the permission boundary description. The format conversion process requires access to multiple dimensions of information, such as the content, structure, and style of the source format data object. Each access operation must pass permission boundary verification. If the access operation exceeds the allowed range defined by the permission boundary description, the data object is marked as an out-of-bounds data object; if the access operation is entirely within the permission boundary, the data object is marked as a compliant data object. The verification process employs a fine-grained permission checking mechanism, verifying each attribute field and each operation type of the data object separately, generating a detailed verification result report, including a list of out-of-bounds data objects, out-of-bounds operation types, and the severity of the out-of-bounds violation.

[0061] For out-of-bounds data objects, access control needs to be refactored. Access control refactoring strategies include three methods: permission degradation, permission isolation, and permission denial. Permission degradation refers to lowering the access permission level of a data object to meet permission boundary requirements; for example, downgrading a data object with modify permissions to read-only permissions. Permission isolation refers to isolating out-of-bounds data objects from the normal conversion process and placing them in a restricted access area, accessible only to additionally authorized users. Permission denial refers to completely blocking access to out-of-bounds data objects, deleting or anonymizing the data object in the conversion results. The choice of refactoring strategy is dynamically adjusted based on the severity of the out-of-bounds violation and business needs. For data objects with minor out-of-bounds violations that do not affect the core functionality of the document, permission degradation is preferred; for sensitive data objects with severe out-of-bounds violations, permission denial is used.

[0062] For compliant data objects, retain their original access permission configurations. Original access permissions include all permission control attributes defined in the source format, which have been successfully mapped to the target format's permission control system through permission inheritance paths. When retaining original access permissions, it's crucial to ensure that the target format's permission control mechanism fully expresses the source format's permission semantics. For cases where the expressive power is insufficient, a combination of multiple target format permissions is used to achieve an equivalent effect of the source format's permission control. Simultaneously, record the mapping details during the permission retention process, including which source format permissions are fully retained, which are approximated, and which cannot be implemented due to target format limitations. These mapping details will be used for subsequent permission audits and compliance checks.

[0063] Out-of-bounds data objects restructured through access control are merged with compliant data objects that retain their original permissions to generate controlled transformation intermediate data. This controlled transformation intermediate data is organized using a unified data structure, comprising three parts: a data content area, an access control area, and a metadata area. The data content area stores the actual content information of the data objects; the access control area records the current access permission configuration and the source of each data object; and the metadata area records auxiliary information such as the data object's format attributes, transformation history, and validation results. Each data object in the controlled transformation intermediate data carries a clear permission tag, which includes the allowed operation type, allowed access subject, and permission validity period. These permission tags will continue to play an access control role in subsequent format transformation operations, ensuring that the entire transformation process remains under permission constraints.

[0064] In one optional embodiment, boundary verification is performed based on the permission boundary description to identify out-of-bounds data objects and compliant data objects, and the verification result is obtained, including: Traverse each data object in the conversion process, extract the data type identifier and data location identifier of each data object, determine the storage location and data type of each data object based on the data type identifier and data location identifier, and obtain the basic description of the data object; Based on the permission boundary description, query the permission boundary range of each data object, and obtain the boundary range description based on the query results; The basic description of the data object is matched with the boundary range description. Based on the matching result, the coverage relationship between the actual access range and the permission boundary range is determined. The deviation of each data object is calculated to obtain the coverage relationship. Based on the coverage relationship and the deviation, a consistency determination is made, and data objects whose actual access range exceeds the permission boundary are identified as out-of-bounds data objects, while data objects whose actual access range does not exceed the permission boundary are identified as compliant data objects. The out-of-bounds data objects and the compliant data objects are classified and labeled, and the verification results are obtained based on the classification and labeling results.

[0065] In one specific implementation, boundary verification of data objects is a crucial step in ensuring that the conversion operation complies with permission specifications during the permission management process for document format conversion. This step requires checking each data object one by one to ensure that it is operating within the permitted permission boundaries, thereby effectively preventing the risk of unauthorized data access or data leakage.

[0066] In practice, the first step is to traverse all data objects involved in the document format conversion process. These data objects may include various types of data entities such as text paragraphs, image resources, table data, embedded objects, style definitions, and metadata fields. During the traversal, the data type identifier and data location identifier are extracted for each data object. The data type identifier distinguishes the specific type of the object, such as "text content," "image resource," "table data," "embedded attachment," or "format style." The data location identifier records the object's specific location information within the original document structure, including the chapter number, paragraph number, hierarchy depth, and byte offset. By combining these two types of identifiers, the storage location of each data object within the document and its data type can be accurately located, thus forming a basic description of the data object. This basic description provides foundational information for subsequent permission boundary matching, enabling the system to implement differentiated permission verification strategies for data objects of different types and locations.

[0067] After obtaining the basic description of the data objects, it is necessary to query the permission boundary range corresponding to each data object based on the permission boundary description. The permission boundary description stores access restriction information for different subjects to different objects. This information is recorded in a structured form, including the allowed data range, allowed operation types, access time limits, access condition constraints, and other multi-dimensional boundary conditions. By using the type identifier and location identifier in the basic description of the data object as query conditions, the permission boundary information associated with that data object is retrieved from the permission boundary description. The query results will include the permission boundary range corresponding to that data object. For example, a data object may only allow read operations and not modification operations, or a data object may only allow access to a specific user group, or access to a data object may require meeting a specific time window limit. These query results are integrated to form a boundary range description, which clearly defines the permission constraints that each data object must adhere to during the transformation process.

[0068] Next, a matching analysis needs to be performed between the basic description of the data object and the boundary scope description to determine the coverage relationship between the actual access behavior and the permission boundary scope. During the format conversion operation, the system will perform actual access behaviors on each data object. These access behaviors may include reading data content, modifying data attributes, copying data structures, and deleting data records. By comparing the actual access scope with the permission boundary scope, it can be determined whether the current access behavior is within the permitted scope. Specifically, a set operation is performed on the set of data objects involved in the actual access scope and the set of data objects allowed to be accessed in the permission boundary scope to analyze the inclusion relationship, intersection relationship, or difference relationship between the two. If the actual access scope is completely contained within the permission boundary scope, it means that the access behavior of the data object conforms to the permission constraints; if the actual access scope partially exceeds the permission boundary scope, it is necessary to further quantify the degree of deviation.

[0069] To quantify the deviation between actual access behavior and the permission boundary, it is necessary to calculate the deviation degree of each data object. The deviation degree measures the extent to which the actual access range deviates from the permission boundary range and can be calculated using various methods. In one implementation, the permission boundary range can be defined as a multi-dimensional feature space, where each dimension represents a permission attribute, such as access operation type, access data range, access time period, access conditions, etc. In this feature space, the permission boundary range can be represented as a region, and the actual access range can be mapped to a point or region in this space. By calculating the distance or overlap between the actual access range and the permission boundary range, a quantified value of the deviation degree can be obtained. Specifically, Euclidean distance, Manhattan distance, or other distance metrics can be used for calculation. For example, the center point of the permission boundary range can be defined as... The center point of the actual access range is Then the deviation degree It can be represented as: ; in Represents norm operations. When When the access scope completely overlaps with the permission boundary, the access behavior fully complies with the permission constraints; when When the deviation is greater, it indicates that there is a certain degree of deviation, and the greater the deviation, the higher the risk of crossing the boundary.

[0070] In another implementation, the deviation can be calculated using a set theory-based method. Let the set of data objects allowed access within the permission boundary be... The actual set of data objects accessed is Then the deviation degree This can be defined as the proportion of the actual access set that exceeds the permission boundary set: ; in This represents the set difference operation, which involves data objects that are actually accessed but not in the permission boundary set. The numerator represents the number of out-of-bounds data objects, and the denominator represents the total number of data objects actually accessed. When, it means that all actually accessed data objects are within the permission boundaries; when When this occurs, it indicates that there are data objects being accessed out of bounds, and the proportion of these objects is [missing information]. .

[0071] Based on the calculation results of coverage relationships and deviations, consistency determination is performed to identify out-of-bounds data objects and compliant data objects. The core of consistency determination is to classify data objects into out-of-bounds or compliant categories according to preset determination rules. These rules can be set based on deviation thresholds, for example, setting a deviation threshold of [value missing]. When the deviation of a certain data object When the data object is deemed compliant, it is determined to be a compliant data object; when When this happens, the data object is determined to be out of bounds. Threshold The value can be adjusted according to the security requirements of the actual application scenario. For scenarios with high security requirements, the threshold can be set to a small value close to zero to strictly limit any minor out-of-bounds behavior. For scenarios with relatively relaxed security requirements, the threshold can be appropriately relaxed to allow a certain range of permission deviations.

[0072] During the judgment process, coverage relationships can also be considered for a comprehensive assessment. If the actual access scope is completely encompassed by the permission boundary, meaning all accessed data objects are within the allowed set and no prohibited data objects are involved, then the data object can be directly determined as a compliant data object without further deviation calculation. Conversely, if the actual access scope includes data objects outside the permission boundary, or if the type of operation actually performed exceeds the allowed operation type range of the permission boundary, then the data object is determined to be an out-of-bounds data object and requires appropriate handling measures, such as preventing the conversion operation of the data object, logging out-of-bounds behavior, or triggering security alerts.

[0073] After identifying out-of-bounds and compliant data objects, all data objects are categorized and labeled. The categorization label assigns a status tag to each data object, indicating its compliance status during permission verification. Compliant data objects are labeled "compliant," meaning they can continue with subsequent format conversion operations. Out-of-bounds data objects are labeled "out of bounds," indicating a risk of permission violations requiring restrictive measures or additional approval processes. The categorization results are recorded in a structured format, forming a verification result dataset. This dataset contains detailed information for each data object, including its object identifier, data type, data location, deviation value, coverage description, and compliance status label, providing a basis for subsequent permission control restructuring and format conversion decisions. Through this verification result, the system can monitor the permission status of each data object in real time during format conversion, ensuring that conversion operations are performed within permitted permissions, effectively preventing security risks such as data leakage and unauthorized access, and guaranteeing the consistency and security of permission management during multi-format conversion.

[0074] In one optional embodiment, a format conversion operation is performed based on the controlled conversion intermediate data to reorganize the converted data into a target format data structure, generating a target format document. The target format document is then associated and stored with the hierarchical permission topology structure to construct a document topology association index. In response to an import / export request, permission verification is performed on the target format document according to the hierarchical permission topology structure to complete the import / export process, including: The structure mapping rules are determined based on the controlled transformation intermediate data, and the structure mapping description is obtained based on the structure mapping rules. Based on the structure mapping description, the data format is converted, and a target format document is generated according to the converted data structure. Extract the unique identifier of the target format document, and bind the unique identifier with the root node identifier of the hierarchical permission topology to obtain the associated storage index; Write the associated storage area according to the associated storage index, and complete the associated storage based on the writing result; Receive an import / export request, extract the request subject identifier and operation type, and generate an import / export request description based on the request subject identifier and operation type; Query the permission scope of the request subject identifier in the hierarchical permission topology, and determine whether the request operation type is within the permission scope based on the import / export request description. If it is, execute the import / export operation.

[0075] In one specific implementation, after completing the aforementioned permission boundary verification and access control reconstruction, controlled conversion intermediate data is obtained, which already carries verified permission tag information. At this point, it is necessary to convert this intermediate data into the target format and ensure that the permission information is completely transmitted during the format conversion process.

[0076] For intermediate data undergoing controlled transformation, the internal data object organization structure is first analyzed to identify the hierarchical and dependency relationships between data blocks. By analyzing the differences in data structures between the source and target formats, mapping rules are established between the two. These mapping rules include field correspondences, data type conversion rules, and strategies for expanding or collapsing nested structures. For example, when the source format uses a tree structure to store chapter information, while the target format uses a flat paragraph structure, it is necessary to define how to expand the tree nodes into a sequence of paragraphs while recording the original hierarchical information of each paragraph. This mapping rule not only involves the conversion of data content but also requires the synchronous processing of additional permission tagging information to ensure that each data block still carries the corresponding permission attributes after conversion. The determination of mapping rules also needs to consider the syntactic constraints of the target format. For example, some formats have limitations on nesting depth or special encoding requirements for specific data types; these constraints need to be reflected in the mapping rules. By traversing all data objects in the intermediate data, the data structure of the source format is mapped one by one to the data structure pattern of the target format, ultimately forming a complete structural mapping description.

[0077] Based on the structural mapping description, the actual data format conversion operation is performed. The conversion process proceeds sequentially according to the access order of the data objects. For each data object, its data representation is adjusted according to the conversion rules in the mapping description. For text content, character encoding conversion may be required, such as from UTF-8 to UTF-16; for numerical data, byte order adjustment or changes to floating-point precision may be necessary; for image or multimedia content, format re-encoding or resolution adjustment may be required. Throughout the conversion process, the binding relationship between permission tags and corresponding data objects is maintained. For example, when a paragraph of text is split into multiple sub-paragraphs, the permission tags of the original paragraph need to be copied to all sub-paragraphs; when multiple data blocks are merged, the permission tags of each data block need to be considered comprehensively, usually adopting the strictest permission principle, that is, the merged data block inherits the most stringent permission restrictions among all data blocks involved in the merger. The converted data is gradually reorganized into a data structure of the target format, including constructing the file header information, metadata area, and body content area required by the target format. The file header records basic document attributes, such as creation time, modification time, and document author; the metadata area stores auxiliary information related to access control, such as encryption algorithm identifiers and access control topology references; the body content area stores the converted actual data content according to the target format's organization. By assembling these parts, a complete document conforming to the target format specification is generated.

[0078] After generating the target format document, it's necessary to establish the association between this document and the hierarchical permission topology. First, extract the unique identifier of the target format document; this identifier can be the document's hash value, UUID, or a system-assigned document ID. Simultaneously, obtain the root node identifier of the hierarchical permission topology, which represents the top-level control point of the entire permission topology. Bind the document's unique identifier to the root node identifier, establishing a one-to-one mapping relationship and forming an associated storage index. This index records information such as the document identifier, root node identifier, binding timestamp, and the entity executing the binding operation. Through this binding mechanism, the permission topology associated with a specific document can be quickly found at any subsequent time, thus enabling continuous management of document permissions. The associated storage index itself also needs to be persistently saved, typically using a dedicated index storage area. This area is independent of the document data storage area but logically linked through the index.

[0079] The target format document is written to the associated storage area based on the associated storage index. The associated storage area typically employs a hierarchical storage architecture: the bottom layer stores the actual document data, the middle layer stores the index structure, and the top layer stores the permission topology structure. During the write process, the binary content of the target format document is first written to the document data storage area to obtain storage location information, such as the file path or database record ID. Then, the associated storage index is updated, recording the document's storage location information in the index. Next, the corresponding root node record is located in the permission topology structure storage area, and a reference to the newly generated document is added to this record, forming a navigation path from the permission topology to the document data. After the write operation is complete, the integrity of the write result is verified, including checking whether the document data has been completely written, whether the index record has been correctly created, and whether the permission topology reference has been successfully updated. Only when all verification steps pass is the associated storage operation considered successfully completed.

[0080] When the system receives an import / export request, it first parses the request content to extract the request subject identifier and operation type. The request subject identifier is used to identify the user or system entity performing the operation; it may be a user account, API key, or service process identifier. The operation type distinguishes between an import and export operation. An import operation typically refers to bringing external documents into the system and including them in access control, while an export operation refers to outputting documents from within the system to an external environment. Combining the request subject identifier and operation type, an import / export request description is generated. This description includes elements such as the request subject, operation type, target document identifier, and request timestamp.

[0081] Based on the import / export request description, the hierarchical permission topology is queried to verify the request's legitimacy. The corresponding subject node is located in the permission topology using the request subject identifier; this node records all permissions granted to that subject. The permission list of the subject node is traversed to extract permission items related to the target document. For import operations, it is necessary to verify whether the subject has document creation or write permissions; for export operations, it is necessary to verify whether the subject has document read or download permissions. Constraints in the permission items are also checked, such as time constraints (operations are only allowed within a specific time period), network constraints (operations are only allowed under a specific network environment), or geographical location constraints. Combining the permission items and constraints, it is determined whether the current request operation type falls within the request subject's permission scope.

[0082] If the determination result indicates that the requested operation type is within the permission scope, then the import / export operation is authorized. For import operations, the external document to be imported is processed according to the aforementioned format conversion process, its format specifications are parsed, permission control information is extracted or constructed, a corresponding hierarchical permission topology is generated or merged into an existing topology, and finally, associated storage is completed. For export operations, the document data storage location is located based on the target document identifier, the document content is read, necessary format conversions are performed according to the format requirements of the export target, and the converted document data is transferred to the target location specified by the requesting subject. During the export process, an export log is also recorded, including export time, exporting subject, exporting target, and other information, for subsequent auditing and traceability. If the determination result indicates that the requested operation type is not within the permission scope, then the operation is refused, an insufficient permission error message is returned to the requesting subject, and the unauthorized access attempt is recorded as a potential security event for monitoring.

[0083] Through the above mechanism, a complete process from controlled conversion of intermediate data to generation of target format documents is realized, as well as the associated storage of target format documents and hierarchical permission topology. Ultimately, it supports import and export operations based on permission verification, ensuring the consistency and effectiveness of permission control during the conversion and circulation of multi-format encrypted documents.

[0084] A second aspect of this invention provides a permission management system for converting, importing, and exporting multi-format encrypted documents, comprising: The document parsing unit is used to obtain a multi-format encrypted document set, traverse each document in the multi-format encrypted document set, parse the format specifications and encryption control information of each document, and obtain a document control information set. The permission topology unit is used to extract the permission subject identifier and permission object identifier based on the document control information set, construct the subject-object association relationship, obtain the permission association description, perform normalization parsing and topology mapping on the original permission configuration of the heterogeneous format according to the permission association description, generate a standardized permission topology and perform hierarchical division to obtain a hierarchical permission topology structure. The permission conversion unit is used to respond to a document format conversion request, analyze the control information mapping relationship between the source format and the target format according to the hierarchical permission topology, identify the permission inheritance path of each data object in the conversion process, and perform permission boundary verification and access control reconstruction on the data objects in the conversion process based on the permission inheritance path to obtain controlled conversion intermediate data. The format conversion unit is used to perform a format conversion operation based on the controlled conversion intermediate data, reorganize the converted data into a target format data structure, and generate a target format document. The associated storage unit is used to associate the target format document with the hierarchical permission topology structure, construct a document topology association index, and in response to an import / export request, perform permission verification on the target format document according to the hierarchical permission topology structure and then complete the import / export operation.

[0085] A third aspect of the present invention provides an electronic device, comprising: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0086] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0087] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0088] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for managing permissions during the conversion, import, and export of multi-format encrypted documents, characterized in that: include: Obtain a set of encrypted documents in multiple formats, traverse each document in the set, parse the format specifications and encryption control information of each document, and obtain a set of document control information. Based on the document control information set, the permission subject identifier and permission object identifier are extracted, the subject-object association relationship is constructed, the permission association description is obtained, and the original permission configuration of the heterogeneous format is normalized and topologically mapped according to the permission association description to generate a standardized permission topology and perform hierarchical division to obtain a hierarchical permission topology structure. In response to a document format conversion request, the control information mapping relationship between the source format and the target format is analyzed based on the hierarchical permission topology, the permission inheritance path of each data object in the conversion process is identified, and permission boundary verification and access control reconstruction are performed on the data objects in the conversion process based on the permission inheritance path to obtain controlled conversion intermediate data. Perform a format conversion operation based on the controlled intermediate conversion data, reorganize the converted data into a target format data structure, and generate a target format document; The target format document is associated with the hierarchical permission topology and stored together to construct a document topology association index. In response to an import / export request, the import / export operation is completed after the permission verification of the target format document is performed according to the hierarchical permission topology.

2. The method according to claim 1, characterized in that, Parse the format specifications and encryption control information of each document to obtain a set of document control information, including: Read the header information of the multi-format encrypted document, extract the format identifier field and version identifier field, identify the document format family, and obtain the basic format description; parse the encryption control section of the multi-format encrypted document, extract the access control list and encryption policy description, identify the encryption control level, and obtain the encryption control description; Traverse the metadata area of ​​the multi-format encrypted document, extract document creation attributes and modification tracking attributes, determine the document lifecycle stage, and obtain a document lifecycle description; analyze the data partition structure of the multi-format encrypted document, extract data block boundary identifiers and data block type identifiers, determine the data block functional category, and obtain a data partition description; The consistency of the format basic description, the encryption control description, the document lifecycle description, and the data partition description is checked to identify conflicting and redundant items among the description items. The conflicting and redundant items are removed according to preset rules to obtain a set of verified descriptions. The description items in the set of verified descriptions are associated and fused, and a document control information index is constructed based on the association and fusion results to obtain a set of document control information.

3. The method according to claim 1, characterized in that, Based on the document control information set, the permission subject identifier and permission object identifier are extracted, a subject-object association relationship is constructed, and a permission association description is obtained. Based on the permission association description, the original permission configuration in the heterogeneous format is normalized, parsed, and topologically mapped to generate a standardized permission topology and perform hierarchical division to obtain a layered permission topology structure, including: Extract the permission subject identifier and permission object identifier from the document control information set, determine the direction of permission action, and obtain the permission subject description and permission object description; construct the subject-object association relationship based on the permission subject description and the permission object description, determine the permission transmission path, and obtain the permission association description; Based on the permission association description, the original permission configuration in the heterogeneous format is normalized and parsed to extract the permission operation type and permission scope, determine the permission function category, and obtain the normalized permission description; based on the normalized permission description, a node set and an edge set are constructed, the connection attributes and connection weights between nodes are determined, and a standardized permission topology is generated. The standardized permission topology is divided into levels, and the hierarchical affiliation and hierarchical constraint relationship are determined according to the scope of permission and the type of permission operation to obtain a hierarchical permission topology structure.

4. The method according to claim 3, characterized in that, The standardized permission topology is hierarchically divided, and the hierarchical affiliation and constraint relationships are determined based on the permission scope and permission operation type to obtain a hierarchical permission topology structure, including: Traverse each node in the standardized permission topology, extract the permission scope attribute and permission operation type attribute of each node, determine the permission function category of each node based on the permission scope attribute and the permission operation type attribute, and obtain the node attribute description. The permission dependency strength between each node is calculated based on the node attribute description, and the dominance and subordination relationships between nodes are determined to obtain the node dependency relationship description; each node is divided into different levels according to the node dependency relationship description, and the level affiliation of each node is determined according to the dominance and subordination relationships to obtain the level allocation result. Based on the hierarchical allocation results, the direction of permission transfer between adjacent levels is identified, directed connections between levels are constructed, the constraint strength between levels is determined, and hierarchical constraint relationships are obtained. The hierarchical allocation results and hierarchical constraint relationships are integrated into the standardized permission topology, and the integrity of the hierarchical division is verified according to the hierarchical constraint relationships to obtain a hierarchical permission topology structure.

5. The method according to claim 1, characterized in that, In response to a document format conversion request, the system analyzes the control information mapping relationship between the source and target formats based on the hierarchical permission topology, identifies the permission inheritance path of each data object during the conversion process, and performs permission boundary verification and access control reconstruction on the data objects during the conversion process based on the permission inheritance path to obtain controlled conversion intermediate data, including: Receive a document format conversion request, extract the source format identifier and the target format identifier, and determine the format conversion type; query the permission nodes in the hierarchical permission topology to obtain the source node set and the target node set. The control information mapping relationship between the source node set and the target node set is analyzed. Based on the control information mapping relationship, the permission inheritance path is identified to obtain a permission inheritance path description. Based on the permission inheritance path description, the permission boundaries of each data object are determined to obtain a permission boundary description. Based on the permission boundary description, boundary verification is performed, and based on the boundary verification result, out-of-bounds data objects and compliant data objects are identified to obtain a verification result. Based on the verification results, access control is reconstructed for out-of-bounds data objects, while original access permissions are retained for compliant data objects, resulting in controlled transformation intermediate data.

6. The method according to claim 5, characterized in that, Based on the aforementioned permission boundary description, boundary verification is performed to identify out-of-bounds data objects and compliant data objects, and the verification results are obtained, including: Traverse each data object in the conversion process, extract the data type identifier and data location identifier of each data object, determine the storage location and data type of each data object based on the data type identifier and data location identifier, and obtain the basic description of the data object; Based on the permission boundary description, query the permission boundary range of each data object, and obtain the boundary range description based on the query results; match the basic description of the data object with the boundary range description, determine the coverage relationship between the actual access range and the permission boundary range based on the matching results, calculate the deviation of each data object, and obtain the coverage relationship; Based on the coverage relationship and the deviation, a consistency determination is made, identifying data objects whose actual access range exceeds the permission boundary as out-of-bounds data objects, and identifying data objects whose actual access range does not exceed the permission boundary as compliant data objects; classifying and marking the out-of-bounds data objects and the compliant data objects, and obtaining the verification result based on the classification and marking results.

7. The method according to claim 1, characterized in that, Based on the controlled intermediate data, a format conversion operation is performed to reorganize the converted data into a target format data structure, generating a target format document. The target format document is then associated and stored with the hierarchical permission topology structure, constructing a document topology association index. In response to an import / export request, permission verification is performed on the target format document according to the hierarchical permission topology structure before completing the import / export process, including: Based on the controlled transformation intermediate data, a structure mapping rule is determined, and a structure mapping description is obtained based on the structure mapping rule; the data format is transformed based on the structure mapping description, and a target format document is generated based on the transformed data structure. Extract the unique identifier of the target format document, bind the unique identifier to the root node identifier of the hierarchical permission topology to obtain the associated storage index; write the associated storage area according to the associated storage index, and complete the associated storage according to the writing result; receive import / export requests, extract the request subject identifier and operation type, and generate an import / export request description according to the request subject identifier and operation type; Query the permission scope of the request subject identifier in the hierarchical permission topology, and determine whether the request operation type is within the permission scope based on the import / export request description. If it is, execute the import / export operation.

8. A permission management system for converting, importing, and exporting multi-format encrypted documents, used to implement the method as described in any one of claims 1-7, characterized in that, include: The document parsing unit is used to obtain a multi-format encrypted document set, traverse each document in the multi-format encrypted document set, parse the format specifications and encryption control information of each document, and obtain a document control information set. The permission topology unit is used to extract the permission subject identifier and permission object identifier based on the document control information set, construct the subject-object association relationship, obtain the permission association description, perform normalization parsing and topology mapping on the original permission configuration of the heterogeneous format according to the permission association description, generate a standardized permission topology and perform hierarchical division to obtain a hierarchical permission topology structure. The permission conversion unit is used to respond to a document format conversion request, analyze the control information mapping relationship between the source format and the target format according to the hierarchical permission topology, identify the permission inheritance path of each data object in the conversion process, and perform permission boundary verification and access control reconstruction on the data objects in the conversion process based on the permission inheritance path to obtain controlled conversion intermediate data. The format conversion unit is used to perform a format conversion operation based on the controlled conversion intermediate data, reorganize the converted data into a target format data structure, and generate a target format document. The associated storage unit is used to associate the target format document with the hierarchical permission topology structure, construct a document topology association index, and in response to an import / export request, perform permission verification on the target format document according to the hierarchical permission topology structure and then complete the import / export operation.

9. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 7.

Images