An ore detection data grading authority management method and system

Abstract

The present application relates to the technical field of authority management, and particularly relates to a kind of ore detection data hierarchical authority management method and system, comprising: obtaining the source authorization condition associated with single user, source authorization condition includes ore grade, geographic coordinate and exploration time constraint;Based on the preset knowledge graph, all source authorization conditions are uniformly parsed into a set of permission vectors, the knowledge graph maps geographic coordinates and time stamp into three-dimensional space-time bounding volume, and maps grade continuous numerical attribute into numerical feature interval.The present application generates a unified cluster-level access permission policy by performing minimum circumscribed hyperrectangle and minimum outer interval operation on the vectors in the cluster, which simplifies the redundant permission rules, reduces the storage occupancy and computational complexity of the policy set, and improves the execution efficiency and accuracy of the ore detection data access request permission determination.

Description

Technical Field

[0001] This invention belongs to the field of access control technology, and in particular relates to a method and system for hierarchical access control of ore detection data. Background Technology

[0002] Ore testing data requires collaborative access across departments or enterprises. Access control methods typically employ static role assignment or simple logical rule matching. When faced with fragmented authorization requests involving three-dimensional spatial distribution, time spans, and continuous grade ranges, fine-grained policies need to be manually configured. This leads to an exponential expansion and redundancy of the permission policy library, resulting in low matching efficiency during permission adjudication and security risks such as unauthorized data access or data leakage due to policy conflicts and human configuration oversights. This paper proposes an authorization condition semantic merging technique, which is then integrated into the permission management system. Existing merging schemes typically attempt to use knowledge graphs and clustering algorithms to convert implicit authorization conditions into structured vector representations. By evaluating the similarity between permissions, fragmented rules are clustered and merged, reducing the size of the policy set and improving the efficiency of permission determination.

[0003] In related technologies, for example, Chinese patent application CN122065326A discloses a multi-level unified access control system based on directed graphs and set operations. This application can accurately identify and adjust out-of-bounds portions without affecting normal authorization, avoiding business interruptions caused by traditional management methods. By intelligently optimizing access control expressions, it significantly simplifies management complexity, freeing up managers' time and energy from tedious authorization work, allowing them to focus on strategic-level security planning.

[0004] However, existing algorithms do not have a mechanism to uniformly map geographic coordinates and timestamps into a three-dimensional spatiotemporal bounding volume. When processing continuous numerical attributes of ore grade, they use rigid discretization, which cannot measure the spatiotemporal overlap of multidimensional spatial conditions and is prone to semantic distortion in the merging process. When calculating semantic similarity, existing technologies omit the inherent statistical characteristics of all numerical attributes and lack a scientific evaluation system based on global prior probability models and interval cumulative probabilities. This leads to deviations in the results of clustering and range merging, and makes it impossible to achieve secure cluster-level access permission policy adjudication. Summary of the Invention

[0005] This invention provides a hierarchical access control method and system for ore detection data, aiming to solve the problem in related technologies where the lack of multi-dimensional spatiotemporal bounding volume mapping and continuous numerical evaluation mechanism based on global prior probability leads to semantic distortion in the access control merging process, making it impossible to achieve secure and accurate cluster-level access policy adjudication.

[0006] According to one aspect of the present invention, a method for hierarchical access control of ore testing data is provided, comprising the following steps: S1: obtaining source authorization conditions associated with a single user, the source authorization conditions including ore grade, geographic coordinates, and exploration time constraints; based on a pre-set knowledge graph, uniformly parsing all source authorization conditions into a set of permission vectors, the knowledge graph mapping geographic coordinates and timestamps into a three-dimensional spatiotemporal bounding volume, and mapping continuous numerical attributes of grade into numerical feature intervals; based on the statistical characteristics of all continuous numerical attributes in the permission vectors, constructing a global prior probability model representing the distribution of user permissions; S2: according to the degree of overlap of the three-dimensional spatiotemporal bounding volume in the knowledge graph and the probability intersection of feature intervals under the global prior probability model. First, calculate the semantic similarity between each pair of permission vectors. Based on the semantic similarity, use a clustering algorithm to group the permission vectors into several permission clusters. The semantic similarity between vectors within each permission cluster is higher than a preset intra-cluster aggregation threshold. Second, merge the permission vectors within each permission cluster to generate a cluster-level access permission policy. The merging operation includes performing a minimum bounding rectangle operation on the three-dimensional spatiotemporal bounding volume corresponding to all vectors to generate a unified initial screening range, and performing a minimum bounding interval operation on the numerical feature interval corresponding to all vectors to generate a unified initial screening interval. Combine all the generated cluster-level access permission policies into an access permission policy set, and use the access permission policy set to make permission decisions on ore detection data access requests. By mapping multidimensional authorization conditions to a permission vector composed of a three-dimensional spatiotemporal bounding volume and numerical feature intervals, and introducing a global prior probability model for similarity clustering and policy merging, this invention abandons the traditional rigid and discrete permission rule comparison method. In practical application scenarios, it effectively avoids semantic distortion in the merging process and significantly reduces the storage footprint and computational complexity of the policy set. Specific implementation data shows that, compared with the traditional baseline scheme of linear cyclic comparison of single rules, this invention significantly reduces memory usage from 4500MB to 150MB, while not only reducing the permission adjudication response time by nearly 30 times to 12ms, but also, by comprehensively considering spatiotemporal overlap based on global probability, it patches the security vulnerability caused by illegal merging, improving the unauthorized interception accuracy to 99.8%, achieving a dual breakthrough in system operating efficiency and security of collaborative access to ore detection data.

[0007] Furthermore, the source authorization conditions associated with a single user are obtained. These conditions include ore grade, geographic coordinates, and exploration time constraints. This involves: a data request probe component deployed through the communication gateway port monitoring and intercepting authorization log information associated with user account permission allocation instructions; using a pre-defined regular expression scanning strategy, extracting temporal and spatial boundary text fragments representing geographic coordinates and start / end times, as well as numerical attribute text fragments representing the upper and lower limits of ore grade percentages, from the intercepted authorization log information strings; transcoding and concatenating the extracted text fragments to generate a standardized set of single constant records, which are then stored in the database as the source authorization conditions for parsing. By deploying a probe component at the communication gateway port and combining it with regular expressions for seamless log interception and extraction parsing, real-time capture and standardized transcoding and concatenation of authorization behavior information between underlying heterogeneous systems are achieved. In actual business scenarios, this not only eliminates security risks caused by human configuration oversights but also ensures the uniformity of the source data format and the timeliness of processing used for subsequent permission feature parsing.

[0008] Furthermore, all source authorization conditions are uniformly parsed into a set of permission vectors, including: extracting two-dimensional coordinate data representing geographical boundaries and start and end timestamp data representing time boundaries from the source authorization conditions, concatenating them into a three-dimensional spatiotemporal boundary constant, which serves as the spatial dimension component of the permission vector; extracting ore grade numerical range parameters containing upper and lower limits from the source authorization conditions, which serve as the numerical dimension component of the feature vector; arranging the spatial and numerical dimension components according to a preset sequence, concatenating them to generate a multi-dimensional structured object, and saving it as the permission vector. By accurately extracting the spatiotemporal boundary constant and continuous grade range parameters and performing cross-dimensional concatenation of a preset sequence, the originally heterogeneous and implicit multi-dimensional permission constraints are uniformly transformed into a high-dimensional structured permission vector at the underlying data structure level. This lays a seamless feature engineering foundation for subsequent high-precision permission semantic similarity measurement and low-latency clustering calculation.

[0009] Furthermore, a global prior probability model representing the distribution of user permissions is constructed, including: reading the global value range of the numerical feature intervals of all permission vectors; dividing the global value range into multiple continuous numerical frequency band intervals with a fixed step size; statistically analyzing the coverage of the numerical feature intervals of each permission vector in each of the above numerical frequency band intervals; calculating the frequency and prior probability of occurrence in each frequency band interval; fitting a probability density model function based on the prior probability distribution of each frequency band interval; calculating the expected value and variance parameters; and generating a global prior probability model. By adopting a fixed-step-size segmented statistical analysis of global value frequencies and fitting a probability density model, the global prior probability distribution characteristics of different user groups' access permissions to grades can be accurately captured in actual ore data sharing scenarios. This ensures that subsequent permission merging is not only based on the apparent interval span but also profoundly reflects the statistical essence of the real data distribution, greatly reducing the risk of crude merging caused by improper similarity assessment.

[0010] Furthermore, the semantic similarity between pairwise permission vectors is calculated, including: calculating the ratio of the spatial intersection volume to the spatial union volume of the three-dimensional spatiotemporal bounding volumes corresponding to the two permission vectors using geometric volume, as the spatial overlap; inputting the intersection and union of the numerical feature intervals of the two permission vectors into the global prior probability model, and calculating the ratio of the cumulative probability of the intersection interval to the cumulative probability of the union interval, as the numerical attribute evaluation index; and performing a weighted summation of the spatial overlap and the numerical attribute evaluation index to obtain a comprehensive score, which serves as the semantic similarity between pairwise permission vectors. By weightedly fusing the geometric overlap of three-dimensional spatiotemporal dimensions with the ratio of cumulative probability based on prior probability density, an evaluation system that balances the breadth of spatial distribution and the depth of numerical attribute statistics is established in practical applications. This effectively fills the blind spot in underlying judgment caused by the lack of in-depth integration of numerical features, ensuring the rigor and rationality of the permission clusters generated by subsequent clustering from the algorithmic root.

[0011] Furthermore, based on semantic similarity, a clustering algorithm is used to group permission vectors into several permission clusters. This includes: initializing each permission vector as a permission cluster and assigning a basic classification label; using the average linking method to traverse and calculate the inter-cluster semantic similarity between all permission clusters; and performing similarity judgment and merging. The similarity judgment and merging process is as follows: if the largest inter-cluster semantic similarity is greater than a preset intra-cluster aggregation threshold, the corresponding two permission clusters are merged into a new permission cluster and the cluster range is updated. This similarity judgment and merging process is iteratively executed until the inter-cluster semantic similarity between all remaining permission clusters is no greater than the intra-cluster aggregation threshold, and the permission cluster grouping result is output. By introducing the average linking method and agglomerative hierarchical clustering algorithm and setting an adaptive intra-cluster aggregation threshold, bottom-up dynamic iterative merging can be achieved based on the semantic similarity distance matrix of the actual permission requests. In the daily management scenario of massive and scattered permissions, redundant rules can be automatically simplified. Under the premise of ensuring high consistency of rules within the same cluster, the complex policy set can be intelligently condensed into a limited number of core permission clusters, greatly relieving the maintenance pressure on security administrators.

[0012] Furthermore, a unified initial screening range is generated, including: obtaining the three-dimensional spatiotemporal bounding volume parameter matrix of all permission vectors within the same permission cluster; performing extreme value searches in the three dimensions of longitude, latitude, and time to obtain the minimum lower edge extreme value and the maximum upper edge extreme value in each dimension; and combining the minimum lower edge extreme value and the maximum upper edge extreme value in the three dimensions into a new boundary parameter matrix, which serves as the unified initial screening range of the minimum bounding hyperrectangle of the cluster core spatiotemporal permissions. By performing precise global extreme value searches on the three-dimensional spatiotemporal coordinate set of longitude, latitude, and time to generate a unified minimum bounding hyperrectangle initial screening range, this spatial dimensionality reduction envelope mechanism allows the system to perform a one-time fast filtering judgment on a few abstracted and broadened cluster core boundaries, replacing the original requirement of a large number of original three-dimensional coordinate polling comparisons, greatly improving the execution efficiency of spatiotemporal retrieval.

[0013] Furthermore, access permission policies are used to adjudicate access requests for ore testing data. This includes: extracting the target geographic location boundary, target time period, and target ore grade query requirements from the ore testing data access request; determining whether the target geographic location boundary and target time period of the access request completely fall within the unified initial screening range of any cluster-level access permission policy, and whether the target ore grade query requirements fall within the unified initial screening range of the corresponding policy. If both are satisfied, the access is deemed legitimate and the data query operation is executed; if not completely covered, it is deemed unauthorized access, triggering an interception command to terminate the operation and reject the access request. This method can trigger interception before illegal requests fall into the initial screening security zone, which not only significantly reduces the recall response delay of legitimate requests, but also achieves millisecond-level blocking and isolation in the face of malicious unauthorized attempts, balancing the continuity of business queries with the security of permission boundaries.

[0014] Furthermore, fitting the probability density model function includes: fitting the prior probability distribution using a Gaussian kernel density estimation function based on a Gaussian kernel, and solving for the mathematical expectation parameter and variance parameter in the normal probability density function through maximum likelihood estimation to generate a global prior probability density model function with continuous differentiability.

[0015] According to another aspect of the present invention, a graded access control system for ore testing data is provided, comprising a processor and a memory, wherein the memory stores a computer program, and the processor executes the computer program to implement the graded access control method for ore testing data as described above.

[0016] Beneficial effects: First, by uniformly parsing ore grade, geographical coordinates, and exploration time authorization conditions into permission vectors of three-dimensional spatiotemporal bounding volumes and numerical feature intervals based on the knowledge graph, and constructing a global prior probability model, it can represent multi-dimensional permission features and conform to the actual data distribution pattern. Second, by integrating spatial overlap degree and cumulative probability calculation under the probability model to generate permission clusters, the semantic association between conditions is explored, making permission grouping reasonable and rigorous. Third, by performing minimum bounding hyperrectangle and minimum bounding interval operations on the vectors within the cluster to generate a unified cluster-level access permission policy, this merging mechanism simplifies redundant permission rules, reduces the storage occupation and computational complexity of the policy set, and improves the execution efficiency and accuracy of ore detection data access request permission adjudication. Attached Figure Description

[0017] Figure 1 This is a flowchart of the permission management method in an embodiment of the present invention;

[0018] Figure 2 This is a graph showing the prior probability distribution of ore grade and the Gaussian density fitting in an embodiment of the present invention. Figure 3This is a schematic diagram of the hierarchical clustering iterative convergence curve in an embodiment of the present invention; Figure 4 A bar chart comparing the performance of different solutions. Detailed Implementation

[0019] This invention proposes a hierarchical access control method for ore testing data, such as... Figure 1 As shown, it includes: S1. Obtain the source authorization conditions associated with a single user. The source authorization conditions include ore grade, geographic coordinates, and exploration time constraints. Based on a pre-set knowledge graph, all source authorization conditions are uniformly parsed into a set of permission vectors. The knowledge graph maps geographic coordinates and timestamps into a three-dimensional spatiotemporal bounding volume and maps continuous numerical attributes of grade into numerical feature intervals. Based on the statistical characteristics of all continuous numerical attributes in the permission vectors, a global prior probability model representing the distribution of user permissions is constructed.

[0020] By executing structured query language commands through the database interface, the user role policy table in the storage system is read, and the upper and lower limits of ore grade, longitude, latitude and elevation coordinates, and start and end timestamps corresponding to the user identification code are extracted as source authorization conditions. Using the cryptographic query language in the graph database software Neo4j, the pre-set ore spatiotemporal domain knowledge graph is queried. Through node entities and relationship reasoning in the knowledge graph, the longitude, latitude and elevation and start and end timestamps are mapped into a hypercube data structure containing three-dimensional spatial coordinate span and one-dimensional time axis span, i.e., a three-dimensional spatiotemporal bounding volume.

[0021] Simultaneously, the floating-point continuous values ​​of ore grade are converted into numerical feature intervals with closed boundaries. The multi-dimensional features after the above conversion are concatenated to obtain a multi-dimensional array-form permission vector. The numerical feature intervals of ore grade in all permission vectors are collected, and the mean and variance of the interval center point and interval length are calculated. The Gaussian kernel density estimation function based on Gaussian kernel in the SciPy library of the Python programming language is used to fit the above numerical features, and the probability density function of continuous attribute data is calculated, thereby establishing a global prior probability model representing the spatial distribution law of user permissions.

[0022] In an optional embodiment, source authorization conditions associated with a single user are obtained, including ore grade, geographic coordinates, and exploration time constraints, including: The data request probe component deployed through the communication gateway port listens for and intercepts authorization log information associated with user account permission allocation instructions. Using a pre-defined regular expression scanning strategy, it extracts text fragments representing the time and space boundaries of geographic coordinates and start and end times, as well as text fragments representing the upper and lower limits of ore grade percentages, from the intercepted authorization log information strings. The extracted text fragments are then formatted and concatenated to generate a standardized set of single constant records, which are stored in the database as the source authorization conditions for parsing.

[0023] The communication gateway port can be configured as a specific network listening port. Data request probe components based on network packet filtering technology or network detection libraries can be deployed here to perform traffic mirroring and deep packet inspection at the OSI network layer or application layer, and to intercept the authorization log information strings associated with the transmitted user account permission allocation instructions in real time.

[0024] For the intercepted authorization logs, a regular expression scanning strategy containing multiple sets of matching rules is loaded. For example, regular expression matching is used to extract the target latitude and longitude floating-point numerical boundaries, the start and end time strings are extracted using standard time format, and numerical attribute fragments representing the ore grade percentage are stripped using expressions.

[0025] All detected plain text fragments are extracted and subjected to a unified transcoding operation. Geographic coordinates and grades are converted into double-precision floating-point data, and time strings are converted into 10-digit integer timestamps. The converted variables are then concatenated according to a fixed key-value pair pattern to form a standard single constant record set. This set is then written to the underlying relational database using a database connection pool in a batch transaction commit manner to obtain secure and isolated source authorization conditions.

[0026] In an optional embodiment, all source authorization conditions are uniformly parsed into a set of permission vectors, including: Two-dimensional coordinate data representing geographical boundaries and start and end timestamp data representing time boundaries are extracted from the source authorization conditions and concatenated into a three-dimensional spatiotemporal boundary constant, which serves as the spatial dimension component of the permission vector. The ore grade numerical range parameters containing upper and lower limits are extracted from the source authorization conditions and used as the numerical dimension component of the feature vector. The spatial dimension component and the numerical dimension component are arranged in a preset sequence and concatenated to generate a multi-dimensional structured object, which is then saved as the permission vector.

[0027] The field mapping engine extracts two-dimensional coordinate data of longitude and latitude intervals from the source authorization conditions, and combines them with start and end timestamp integer data to construct a one-dimensional hybrid array of length 6 through sequential concatenation. This hybrid array defines the specific three-dimensional spatiotemporal bound constants of the user's permitted operations in three-dimensional space, and uses this as a whole as a 6-dimensional spatial component to serve as the spatial dimension component of the permission vector.

[0028] Simultaneously, the lower and upper bound threshold parameters of the corresponding ore element grades are read in parallel and encapsulated into a feature vector numerical dimension component array of length 2. During the synthesis stage, the vector generation module, based on a preset fixed topological sequence, horizontally merges the 6-dimensional spatial components with the 2-dimensional numerical components through array merging operations, thereby generating a one-dimensional continuous floating-point array of constant length 8. A serialization algorithm is then used to map and transform this one-dimensional continuous floating-point array into a standard multi-dimensional array data structure, which serves as the permission vector required for high-dimensional computation and is persistently stored in an in-memory vector database.

[0029] In an optional embodiment, a global prior probability model representing the distribution of user permissions is constructed based on the statistical properties of all continuous numerical attributes in the permission vector, including: Read the global value range of the numerical feature intervals of all permission vectors, divide the global value range into multiple continuous numerical frequency band intervals with a fixed step size, count the coverage of the numerical feature intervals of each permission vector in each of the above numerical frequency band intervals, calculate the frequency and prior probability of each frequency band interval, fit the probability density model function according to the prior probability distribution of each frequency band interval, calculate the expected value and variance parameters, and generate a global prior probability model.

[0030] The probability and statistics module uses a maximum / minimum search algorithm to fully traverse the range of ore grade values ​​recorded by N permission vectors in memory, for example, N=10000, to find and lock the global minimum value, such as 10.0%, and the global maximum value, such as 90.0%, thereby establishing a global value range in the form of [10.0, 90.0].

[0031] Using a fixed step size , set as The global value range is divided into 40 non-overlapping and contiguous numerical frequency bands using a binning algorithm, for example... , Until Iterate through each user's individual numerical feature range. For example, if a user's permissions are [45.0, 50.0], and this range overlaps with any numerical frequency range, then accumulate the hit frequency variable of the numerical frequency range. Increase by 1.

[0032] After the traversal is complete, the prior probability corresponding to each numerical frequency band interval is calculated by dividing by the sum of all frequencies. For example, the prior probability of the 20th numerical frequency band interval is calculated. The total hit frequency is 1500, and the total frequency is 20000, resulting in a prior probability distribution value of 0.075. Based on this, kernel density estimation or Gaussian mixture model algorithm is used to perform mathematical fitting on the discrete one-dimensional prior probability histogram data. The core operation uses maximum likelihood estimation to solve for the mathematical expectation parameter in the normal probability density function. ,For example and variance parameters ,For example Generate a global prior probability density model function expression with continuous differentiability. Furthermore, its model structure and weight parameters are persistently encapsulated to generate a global prior probability model capable of outputting the cumulative probability of integrals for any grade range. The fitting results of the prior probability distribution of ore grade are as follows: Figure 2 As shown, the bars are the prior probability histograms obtained from discrete binning statistics, and the curves are the continuous probability density models obtained by fitting based on Gaussian kernel density estimation.

[0033] S2. Based on the degree of overlap of the three-dimensional spatiotemporal bounding volume in the knowledge graph and the probability intersection-union ratio of the feature interval under the global prior probability model, calculate the semantic similarity between each pair of permission vectors. Based on the semantic similarity, use a clustering algorithm to group the permission vectors into several permission clusters. The semantic similarity between vectors in each permission cluster is higher than the preset intra-cluster aggregation threshold.

[0034] For any two permission vectors, their 3D spatiotemporal bounding volumes are extracted, and the ratio of the spatial-temporal overlap volume to the total volume is calculated using the intersection-union algorithm, which serves as the spatial overlap degree. Simultaneously, the intersection and union of their numerical feature intervals are extracted. For the probability density function corresponding to the global prior probability model, definite integrals are performed on the intersection and union intervals to obtain their respective cumulative probabilities. The probability ratio between the two is then calculated. A weighted summation algorithm is used to fuse the spatial overlap degree and the probability ratio to obtain a normalized semantic similarity score.

[0035] The calculated semantic similarity scores between all pairs are used to construct a similarity matrix. This similarity matrix is ​​then converted into a distance matrix and input into the agglomerative hierarchical clustering algorithm model in the Scikit-learn machine learning library. The distance threshold of the clustering algorithm is set to the reciprocal of the preset intra-cluster aggregation threshold. The nearest samples are continuously merged through a bottom-up merging strategy until the distance threshold condition is met, thereby dividing all permission vectors into multiple permission clusters and ensuring that the similarity between any two permission vectors within each permission cluster meets the threshold requirement.

[0036] In an optional embodiment, the semantic similarity between pairs of permission vectors is calculated based on the degree of overlap of the 3D spatiotemporal bounding volume in the knowledge graph and the probability intersection-union ratio of feature intervals under the global prior probability model, including: The spatial overlap is calculated by using geometric volume to determine the ratio of the spatial intersection volume to the spatial union volume of the three-dimensional spatiotemporal bounding volumes corresponding to two permission vectors. The intersection and union of the numerical feature intervals of the two permission vectors are then input into a global prior probability model to calculate the ratio of the cumulative probability of the intersection interval to the cumulative probability of the union interval, which serves as a numerical attribute evaluation index. The spatial overlap and the numerical attribute evaluation index are weighted and summed to obtain a comprehensive score, which serves as the semantic similarity between the pairwise permission vectors.

[0037] Extract the spatiotemporal boundary coordinates contained in both, eliminate the differences in dimensions, and normalize latitude, longitude, and time to the dimensionless interval [0,1]. Then, perform a geometric bounding box volume calculation. Specifically, by comparing the minimum and maximum values ​​of the intersection boundary, calculate the lengths of the three sides of the intersection hexahedron and multiply them to obtain the spatial intersection volume. The spatial union volume of the joint enclosing space is calculated using the principle of inclusion and exclusion. , and Let the volumes of the three-dimensional spatiotemporal bounding volumes corresponding to the two permission vectors be represented respectively, and the three-dimensional intersection-union ratio formula be used. Calculate the spatial overlap between 0.0 and 1.0.

[0038] The numerical feature intervals stored within two permission vectors are given. For example, the numerical feature interval of permission vector A is [40.0, 50.0], and the numerical feature interval of permission vector B is [45.0, 55.0]. Their intersection interval is [45.0, 50.0], and their union interval is [40.0, 55.0], determined by comparing the number line boundaries. These intersection values ​​are then used as the lower bound *a* and upper bound *b* for the definite integral operation. These values ​​are substituted into the fitted global prior probability density function *f(x)*, and the definite integral is calculated using the numerical integration rule. Similarly, calculate the definite integral over the union interval. Calculate the probability ratio of the two. The probability ratio calculated using this method is used as the similarity measure of the feature intervals, for example, the probability ratio. =0.18, thus obtaining the numerical attribute evaluation index.

[0039] Set the weighted parameters for normalization, such as the weight coefficient for spatial overlap. =0.6 and the weight coefficient of numerical attribute evaluation index =0.4, which satisfies The weighted summation yields a comprehensive score of 0.462. This comprehensive score of 0.462 is used as the semantic similarity of the pair of permission vectors and recorded in the global adjacency matrix data structure obtained by combining all vectors.

[0040] In an optional embodiment, based on semantic similarity, a clustering algorithm is used to group the permission vectors into several permission clusters, including: Each permission vector is initialized and assigned to a permission cluster, and a basic classification identifier is assigned. The average linking method is used to traverse and calculate the inter-cluster semantic similarity between all permission clusters. Similarity judgment and merging are performed. The similarity judgment and merging process is as follows: if the largest inter-cluster semantic similarity is greater than the preset intra-cluster aggregation threshold, the corresponding two permission clusters are merged into a new permission cluster and the cluster range is updated. The above semantic similarity judgment and merging process is iteratively executed until the inter-cluster semantic similarity between all remaining permission clusters is not greater than the intra-cluster aggregation threshold, and the permission cluster grouping result is output.

[0041] The N original permission vectors contained in the set are regarded as N initial permission clusters containing only a single element, and a basic classification identifier is generated for each of the N smallest units by a hash algorithm and stored in the clustering hash table.

[0042] After entering the loop iteration, the average linking method is used to traverse all existing clusters and pair them up. By calculating the arithmetic mean of the semantic similarity of all permission vectors belonging to different clusters, a reduced inter-cluster semantic similarity matrix is ​​constructed, and the maximum value variable in the inter-cluster semantic similarity matrix is ​​detected. ,Will Same as the preset intra-cluster aggregation threshold For example, if the value is 0.75, if it is detected... Then, for the corresponding permission cluster node that triggered this maximum value... and Trigger the set union operation to merge them into a new cluster, and attach all the contained permission vector lists to the new cluster to complete the cluster range update operation. At the same time, delete the original cluster and reconstruct the similarity matrix size.

[0043] Repeat the above scanning, judgment, and merging process until the maximum value in the global similarity matrix is ​​not greater than the preset intra-cluster aggregation threshold. It should be noted that the iterative convergence process of hierarchical clustering is as follows: Figure 3 As shown, as the number of iterations increases, the number of remaining clusters decreases exponentially, while the maximum semantic similarity between clusters gradually decreases. At the end of the iteration, the initial N vectors are merged and converged into K discrete sets. For example, N=1000 are clustered into K=12 clusters, and the permission cluster grouping results are output.

[0044] S3. Merge the permission vectors within each permission cluster to generate a cluster-level access permission policy. The merging operation includes performing a minimum bounding hyperrectangle operation on the three-dimensional spatiotemporal bounding volume corresponding to all permission vectors to generate a unified initial screening range, and performing a minimum bounding interval operation on the numerical feature intervals corresponding to all permission vectors to generate a unified initial screening interval. Combine all generated cluster-level access permission policies into an access permission policy set, and use the access permission policy set to make permission decisions on ore detection data access requests. The permission decision includes fast filtering based on the unified initial screening range and precise verification based on the original permission vectors.

[0045] For each defined permission cluster, extract the coordinate extrema of each dimension of the three-dimensional spatiotemporal bounding volume of all permission vectors within the cluster. Call the minimum and maximum value functions in the numerical computing library NumPy to obtain the global minimum and global maximum values ​​of all three-dimensional spatiotemporal bounding volumes in terms of longitude, latitude, elevation, and time axis, respectively. Construct a new minimum bounding hyperrectangle based on the global extrema as a unified access space and time initial screening range.

[0046] Simultaneously extract the numerical feature intervals of all permission vectors within a cluster. Similarly, take the minimum value of the lower limit and the maximum value of the upper limit of all numerical feature intervals, and concatenate them into a unified minimum bounding feature initial screening interval. Encapsulate the generated minimum bounding hyperrectangle and minimum bounding feature initial screening interval into a cluster-level access permission policy stored in a key-value pair structure. After traversing all permission clusters, generate a list of access permission policy sets. When a query request carrying the spatiotemporal coordinates and grade attributes of target ore detection data is received, load the access permission policy set into memory and construct a spatial index tree based on the R-tree algorithm. Check whether the target attribute parameter in the query request falls within the unified initial screening range and unified initial screening interval corresponding to any cluster-level access permission policy in the spatial index tree. If the inclusion condition is met, further traverse the original permission vectors contained in the cluster for precise verification. If the target attribute parameter completely falls within at least one original three-dimensional spatiotemporal bounding volume and numerical feature interval in the cluster, return an access permission instruction and allow the data reading process; otherwise, return an access denial exception and block the data request.

[0047] In an optional embodiment, a minimum bounding rectangle operation is performed on the three-dimensional spatiotemporal bounding volumes corresponding to all vectors to generate a unified initial screening range, including: Obtain the three-dimensional spatiotemporal bounding volume parameter matrix of all permission vectors within the same permission cluster, respectively at longitude. ,latitude ,time Extreme value search is performed in three dimensions to obtain the minimum lower edge extreme value and the maximum upper edge extreme value of each dimension; the minimum lower edge extreme value and the maximum upper edge extreme value of the three dimensions are combined into a new boundary parameter matrix, which serves as the minimum bounding hyperrectangle unified screening range of the cluster core spatiotemporal authority.

[0048] For any target permission cluster output by clustering, traverse all Q permission vectors it contains (e.g., Q=45), and arrange the spatial dimension components contained in the Q vectors row by row to construct a three-dimensional spatiotemporal bounding volume parameter matrix of size Q×6. In this three-dimensional spatiotemporal bounding volume parameter matrix, each column is fixed to represent six coordinate attribute boundaries, according to the first column. Column 2 Third column Column 4 Fifth column Column 6 Arrangement.

[0049] The extreme value search algorithm performs extreme value comparison operations along the column dimensions of the three-dimensional spatiotemporal bounding volume parameter matrix: extreme value search is performed sequentially on columns 1, 3, and 5 to detect the global lower bound minimum value of each spatial dimension, for example, to obtain the longitude lower bound. Lower latitude and the minimum lower bound of the start time As the minimum lower boundary extreme value; simultaneously perform extreme value search on columns 2, 4, and 6 to lock the global upper bound maximum value that encompasses all operational boundaries, such as obtaining the longitude upper bound. Upper latitude boundary and the upper bound of the end time As the maximum upper edge extremum.

[0050] Following the inherent splicing sequence of the original three-dimensional six-boundary system, the solved set of minimum lower edge extrema and maximum upper edge extrema constants are spliced ​​into a row vector boundary parameter matrix with only 1×6 dimensions: [116.10,116.50,39.85,40.05,1670000000,1678000000]. This cuboid envelope data volume, which includes the characteristics of the action boundary and is obtained through boundary widening operations, will be set as the minimum bounding hyperrectangle of the spatiotemporal permissions of the cluster core corresponding to this permission cluster for unified initial screening.

[0051] In an optional embodiment, permission determination is performed on ore detection data access requests using a set of access permission policies, including: Extract the target geographic location boundary, target time period, and target ore grade query requirements from the ore testing data access request. Determine whether the target geographic location boundary and target time period of the access request completely fall within the unified initial screening range of any cluster-level access permission policy, and whether the target ore grade query requirements fall within the unified initial screening range of the corresponding policy. If both are satisfied, the access is deemed legitimate and the data query operation is executed. If not completely covered, the access is deemed unauthorized, an interception command is triggered to terminate the operation, and the access request is rejected.

[0052] When an external access query message is sent, the request interception module of the permission adjudication gateway layer uses data parsing tools to extract the user's query constraint variables from the communication message. The extracted query constraint variables are converted into structured data, mainly including target geographic location boundary parameters, such as the set of coordinates that constitute the rectangular search box. Target time period boundary parameters, such as limiting the query timestamp to... And the target ore grade query requirements and constraints, such as filtering for ore with iron grades greater than or equal to the lower limit. and less than or equal to the upper limit The result set.

[0053] Multiple cluster-level access control policies are loaded in a round-robin fashion, and a security rule verification mechanism based on subset inclusion logic is executed one by one to verify three logical conditions: checking whether the requested longitude range constitutes the unified longitude range set by the current round-robin policy. , The set of [] is a subset of the requested dimensional range, and the current unified dimensional range includes the requested dimensional range, and the target time period is entirely within the unified time range, ensuring that the requested 3D spatial query completely falls within and is wrapped within the unified initial screening range of the smallest bounding hyperrectangle of the permission cluster. Under the premise of successful spatiotemporal verification, check whether the input ore grade parameters fall within and constitute the unified initial screening range of the currently associated cluster-level strategy values.

[0054] After initial screening based on the minimum bounding hyperrectangle and the bounding interval, the engine triggers a precise verification mechanism. It iteratively compares each original permission vector encapsulated within the cluster to confirm whether the three-dimensional boundaries and quality parameters of the request completely constitute a subset of a certain original permission vector. During the round-robin matching process, once an original permission vector that meets the range conditions is matched, the permission system marks the status as legal access and releases the query request to the underlying database to initiate query recall. However, if after traversing the set of access permission policies, there is still a boundary condition that is not fully covered, the current query will be determined to be an unauthorized access, triggering an interception command to throw an access denial exception, cutting off the request link, terminating the current operation process, and refusing to respond to external queries.

[0055] This experiment uses a server with a 16-core processor and 64GB of memory to build a test environment. The test dataset consists of 100 real source access logs and 1000 simulated random concurrent data access requests. Three control groups were set up: the first group was a basic control group using traditional single-rule linear cyclic comparison; the second group was an ablation control group that removed the global prior probability model and relied solely on spatiotemporal intersection-union comparison for clustering; and the third group was the experimental group of this application, which included prior probability model joint similarity calculation and hierarchical clustering boundary fusion.

[0056] The first group, the baseline control group, had an average privilege escalation response time of 320ms, an unauthorized access interception accuracy of 98.2%, and a memory usage as high as 4500MB. The second group, the ablation control group, had an average privilege escalation response time of 45ms, with memory usage reduced to 680MB, but the unauthorized access interception accuracy dropped to 83.5%. The third group, the experimental group of this application, had an average privilege escalation response time of only 12ms, memory usage as low as 150MB, and an unauthorized access interception accuracy of 99.8%. The comparison results of the three groups in terms of response time, unauthorized access interception accuracy, and memory usage are as follows: Figure 4 As shown.

[0057] Compared to the first group, the experimental group in this application reduced the response time by nearly 30 times, demonstrating that using hierarchical clustering algorithms to merge massive amounts of scattered permissions into cluster core spatiotemporal permissions reduces the computational load for comparison. The accuracy advantage of the experimental group compared to the second group demonstrates that using a global prior probability model to evaluate the numerical attributes of ore grade and weighting the sum with spatiotemporal overlap can represent multidimensional feature semantic similarity, reducing illegal merging and unauthorized access vulnerabilities caused by a lack of numerical combination.

[0058] The present invention also provides a graded access control system for ore testing data. The system includes a processor and a memory. The memory stores computer program instructions. When the computer program instructions are executed by the processor, a graded access control method for ore testing data according to the first aspect of the present invention is implemented.

[0059] The system also includes other components well known to those skilled in the art, such as communication buses and communication interfaces, the settings and functions of which are known in the art and will not be described in detail here.

Claims

1. A method for hierarchical access control of ore testing data, characterized in that, Includes the following steps: S1: Obtain the source authorization conditions associated with a single user. The source authorization conditions include ore grade, geographic coordinates, and exploration time constraints. Based on a pre-set knowledge graph, all source authorization conditions are uniformly parsed into a set of permission vectors. The knowledge graph maps geographic coordinates and timestamps into a three-dimensional spatiotemporal bounding volume and maps continuous numerical attributes of grade into numerical feature intervals. Based on the statistical properties of all continuous numerical attributes in the permission vector, a global prior probability model representing the distribution of user permissions is constructed; the global prior probability model representing the distribution of user permissions includes: Read the global value range of the numerical feature intervals of all permission vectors, divide the global value range into multiple consecutive numerical frequency band intervals with a fixed step size, count the coverage of the numerical feature intervals of each permission vector in each of the above numerical frequency band intervals, calculate the frequency and prior probability of each frequency band interval, fit the probability density model function according to the prior probability distribution of each frequency band interval, calculate the expected value and variance parameters, and generate a global prior probability model. S2: Based on the degree of overlap of the three-dimensional spatiotemporal bounding volume in the knowledge graph and the probability intersection-union ratio of the feature interval under the global prior probability model, calculate the semantic similarity between each pair of permission vectors; based on the semantic similarity, use a clustering algorithm to group the permission vectors into several permission clusters, and the semantic similarity between vectors in each permission cluster is higher than the preset intra-cluster aggregation threshold. S3: Merge the permission vectors within each permission cluster to generate a cluster-level access permission policy. The merging operation includes performing a minimum bounding hyperrectangle operation on the three-dimensional spatiotemporal bounding volume corresponding to all vectors to generate a unified initial screening range, and performing a minimum bounding interval operation on the numerical feature intervals corresponding to all vectors to generate a unified initial screening interval; combine all generated cluster-level access permission policies into an access permission policy set, and use the access permission policy set to adjudicate access requests for ore detection data.

2. The method for hierarchical access control of ore testing data according to claim 1, characterized in that, Obtain the source authorization conditions associated with a single user. These conditions include ore grade, geographic coordinates, and exploration time constraints, including: The data request probe component deployed through the communication gateway port listens for and intercepts authorization log information associated with user account permission allocation instructions. Using a pre-set regular expression scanning strategy, it extracts text fragments representing the time and space boundaries of geographic coordinates and start and end times, as well as text fragments representing the upper and lower limits of ore grade percentages, from the intercepted authorization log information strings. The extracted text fragments are then formatted and concatenated to generate a standardized set of single constant records, which are stored in the database as the source authorization conditions for parsing.

3. The method for hierarchical access control of ore testing data according to claim 1, characterized in that, All source authorization conditions are parsed into a single permission vector, including: Extract two-dimensional coordinate data representing geographic boundaries and start and end timestamp data representing time boundaries from the source authorization conditions, and concatenate them into a three-dimensional spatiotemporal boundary constant, which serves as the spatial dimension component of the permission vector. Extract the ore grade numerical range parameters containing upper and lower limits from the source authorization conditions, and use them as the numerical dimension components of the feature vector. Arrange the spatial dimension components and the numerical dimension components according to a preset sequence, and concatenate them to generate a multidimensional structured object, which is then saved as an authorization vector.

4. The method for hierarchical access control of ore testing data according to claim 1, characterized in that, Calculate the semantic similarity between each pair of permission vectors, including: The ratio of the spatial intersection volume to the spatial union volume of the three-dimensional spatiotemporal bounding volumes corresponding to two permission vectors is calculated using geometric volume and used as the spatial overlap. The intersection and union of the numerical feature intervals of the two permission vectors are input into the global prior probability model, and the ratio of the cumulative probability of the intersection interval to the cumulative probability of the union interval is calculated as the numerical attribute evaluation index. We calculate a comprehensive score by weighting and summing the spatial overlap and numerical attribute evaluation indicators, which serves as the semantic similarity between pairs of permission vectors.

5. The method for hierarchical access control of ore testing data according to claim 1, characterized in that, Based on semantic similarity, a clustering algorithm is used to group the permission vectors into several permission clusters, including: Each permission vector is initialized and assigned to a permission cluster, and a basic classification identifier is assigned. The average linking method is used to traverse and calculate the inter-cluster semantic similarity between all permission clusters. Similarity judgment and merging are performed. The similarity judgment and merging process is as follows: if the largest inter-cluster semantic similarity is greater than the preset intra-cluster aggregation threshold, the corresponding two permission clusters are merged into a new permission cluster and the cluster range is updated. The similarity judgment and merging process is iteratively executed until the inter-cluster semantic similarity between all remaining permission clusters is not greater than the intra-cluster aggregation threshold. The permission cluster grouping result is then output.

6. The method for hierarchical access control of ore testing data according to claim 1, characterized in that, Generate a unified initial screening range, including: Obtain the three-dimensional spatiotemporal bounding volume parameter matrix of all permission vectors within the same permission cluster. Perform extreme value search in the three dimensions of longitude, latitude, and time to obtain the minimum lower edge extreme value and the maximum upper edge extreme value of each dimension. Combine the minimum lower edge extreme value and the maximum upper edge extreme value of the three dimensions into a new boundary parameter matrix, which serves as the initial screening range of the minimum bounding hyperrectangle of the cluster core spatiotemporal permissions.

7. The method for hierarchical access control of ore testing data according to claim 1 or 6, characterized in that, Access permissions for ore testing data access requests are determined using a set of access permission policies, including: Extract the target geographic location boundary, target time period, and target ore grade query requirements from the ore testing data access request. Determine whether the target geographic location boundary and target time period of the access request completely fall within the unified initial screening range of any cluster-level access permission policy, and whether the target ore grade query requirements fall within the unified initial screening range of the corresponding policy. If both are satisfied, the access is deemed legitimate and the data query operation is executed; otherwise, it is deemed an unauthorized access, triggering an interception command to terminate the operation and reject the access request.

8. The method for hierarchical access control of ore testing data according to claim 1, characterized in that, Fitting the probability density model function includes: fitting the prior probability distribution using a Gaussian kernel density estimation function based on a Gaussian kernel, and solving for the mathematical expectation parameter and variance parameter in the normal probability density function through maximum likelihood estimation to generate a global prior probability density model function with continuous differentiability.

9. A graded access control system for ore detection data, comprising a processor and a memory, characterized in that, The memory stores a computer program, and the processor executes the computer program to implement the ore detection data hierarchical access control method as described in any one of claims 1-8.

Images