Multi-subject identity authentication and permission management method and system based on trusted data space

Abstract

The application discloses a multi-subject identity authentication permission management method and system based on a trusted data space, and relates to the technical field of data security and permission management. The method comprises the following steps: obtaining input data of a user, including operation request data, historical behavior data, current context data and environment risk data; performing intention perception and reasoning based on the input data, obtaining a user intention vector and calculating intention credibility; performing permission demand pre-judgment based on the user intention vector and the intention credibility, and obtaining a pre-authorization suggestion list; performing multi-factor risk assessment and authorization decision based on the user intention vector, the pre-authorization suggestion list and the intention credibility, and obtaining an authorization decision result. The application solves the technical problem that the existing permission management method does not perform dynamic permission pre-judgment and authorization decision based on user operation intention and credibility by performing authorization decision through intention perception and reasoning combined with multi-factor risk assessment.

Description

Technical Field

[0001] This invention relates to the field of data security and access control technology, specifically to a multi-subject identity authentication and access control method and system based on a trusted data space. Background Technology

[0002] In a trusted data space, multiple entities need to share and collaborate on data. Existing access control methods are typically role-based or attribute-based. When a user initiates an operation request, a static match is performed according to a pre-defined permission policy to determine whether to grant access. The main shortcomings of these methods are: First, they do not perceive or infer the user's operational intent, but only match permissions based on the literal content of the operation request. When the user's actual intent is inconsistent with the description of the operation request, misjudgments of permissions are likely to occur. Second, they do not incorporate the credibility of the user's operational intent into the authorization decision, and lack quantitative assessment methods for operation requests with ambiguous or abnormal intent. Third, they lack a multi-factor comprehensive authorization assessment based on the user's historical behavior, current context, and environmental risks. The accuracy of the authorization decision is limited by the result of a single-dimensional permission policy match. Summary of the Invention

[0003] This invention provides a multi-subject identity authentication and permission management method and system based on trusted data space, which solves the technical problem that existing permission management methods do not perform dynamic permission prediction and authorization decisions based on user operation intent and credibility.

[0004] In a first aspect, the present invention provides a multi-subject identity authentication and access control method based on a trusted data space, the method comprising:

[0005] Obtain user input data, which includes operation request data, historical behavior data, current context data, and environmental risk data;

[0006] Based on the input data, intent perception and reasoning are performed to obtain a user intent vector, and the intent credibility of the user intent vector is calculated based on the historical behavior data and the current context data.

[0007] Based on the user intent vector and the intent confidence, the permission requirement is predicted to obtain a pre-authorization suggestion list. The pre-authorization suggestion list includes at least one permission identifier and a corresponding requirement confidence. When the intent confidence is lower than a preset confidence threshold, the requirement confidence is calculated using a penalty coefficient for weighting.

[0008] Based on the user intent vector, the pre-authorization suggestion list, and the intent credibility, a multi-factor risk assessment and authorization decision are performed to obtain the authorization decision result. The authorization decision result includes full authorization, restricted authorization, manual approval required, or access denied. The intent credibility is used as an independent weighting factor in the multi-factor risk assessment.

[0009] Secondly, the present invention also provides a multi-subject identity authentication and access control system based on a trusted data space, the system comprising:

[0010] The data acquisition module is used to acquire user input data, which includes operation request data, historical behavior data, current context data, and environmental risk data.

[0011] The intent perception module is used to perform intent perception and reasoning based on the input data, obtain the user intent vector, and calculate the intent credibility of the user intent vector based on the historical behavior data and the current context data.

[0012] The permission prediction module is used to perform permission request prediction based on the user intent vector and the intent confidence level to obtain a pre-authorization suggestion list. The pre-authorization suggestion list includes at least one permission identifier and a corresponding request confidence level. When the intent confidence level is lower than a preset confidence level threshold, the request confidence level is calculated using a penalty coefficient for weighting.

[0013] The authorization decision module is used to perform multi-factor risk assessment and authorization decision based on the user intent vector, the pre-authorization suggestion list and the intent credibility, and obtain the authorization decision result. The authorization decision result includes full authorization, restricted authorization, manual approval required or access denied, wherein the intent credibility is used as an independent weighting factor in the multi-factor risk assessment.

[0014] One or more technical solutions provided in this invention have at least the following technical effects or advantages:

[0015] First, this invention extracts initial intent elements by performing semantic parsing on operation request data, and constructs an initial intent vector by fusing it with current context data. It calculates the credibility of intent based on historical behavior data. Compared with existing methods that only match permissions based on the literal content of operation requests, this invention can perceive the user's actual operation intent and quantify the reliability of the intent.

[0016] Second, by loading a historical intent-permission association knowledge graph, this invention calculates the similarity between the user intent vector and historical intent nodes, extracts co-occurring candidate permission identifiers, and adjusts the confidence of basic requirements by weighting or penalizing based on intent credibility. Compared with existing methods that rely on preset static permission policies, this invention can dynamically generate a list of pre-authorization suggestions that match the user's current intent.

[0017] Third, this invention integrates the intent rationality score, the permission necessity score, the environmental risk score, and the intent credibility score as four independent weighting factors to obtain a comprehensive authorization score, which is then mapped to the hierarchical authorization decision result. Compared with existing methods that rely only on the permission policy matching result of a single dimension, this invention achieves refined authorization decision under multi-dimensional comprehensive evaluation. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart illustrating the multi-subject identity authentication and access control method based on a trusted data space provided in an embodiment of the present invention.

[0020] Figure 2 This is a schematic diagram of the scheme for the multi-subject identity authentication and access control method based on trusted data space provided in the embodiments of the present invention;

[0021] Figure 3 This is a structural diagram of the multi-subject identity authentication and access control system based on trusted data space provided in this embodiment of the invention;

[0022] The diagram shows the following modules: Data Acquisition Module 11, Intent Awareness Module 12, Permission Prediction Module 13, and Authorization Decision Module 14. Detailed Implementation

[0023] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.

[0024] Example 1, as Figure 1 As shown, this invention provides a flowchart illustrating a multi-subject identity authentication and access control method based on a trusted data space; as... Figure 2 As shown, this invention provides a logical diagram of a multi-subject identity authentication and access control method based on a trusted data space. The method includes:

[0025] S100: Obtain user input data, which includes operation request data, historical behavior data, current context data, and environmental risk data;

[0026] In a trusted data space, every user-initiated operation request occurs within a specific context, and the user's behavioral patterns and historical access records reveal regularities in their permission requirements. Matching permissions solely based on the literal content of the operation request ignores factors such as the user's current project stage, collaborators, device environment, and the overall security posture of the data space, easily leading to misjudgments. Operation request data represents the user's explicitly expressed access needs; historical behavior data reflects the user's long-term behavioral patterns; current context data provides specific scenario information about the user's operation; and environmental risk data reflects the current overall security status of the data space. These four types of data provide information support for subsequent intent perception, permission requirement prediction, and authorization decisions from different dimensions, and none can be omitted. This step uniformly collects these four types of input data to provide a complete user behavior profile and scenario context for subsequent steps.

[0027] Step S100 provided in this embodiment of the invention includes:

[0028] Collect the user's natural language query text or structured operation request as the operation request data;

[0029] Load the user's historical access logs and extract the access time, access frequency, operation type, and accessed data object identifier as the historical behavior data;

[0030] Load the user's current session information, and extract the current project stage identifier, collaboration object identifier, device environment identifier, and geographical location information as the current context data;

[0031] Load the security status information of the user's current data space, extract the current risk level and abnormal event identifier, and use them as the environmental risk data.

[0032] The specific implementation method is as follows:

[0033] The system collects users' natural language query text or structured operation requests as operation request data. Operation request data is a direct expression of the user's access needs to the data space, originating from the data space's user interface or API call interface. Natural language query text represents the user's data access needs described in natural language, while structured operation requests are structured parameters submitted through a preset operation template. Operation request data includes the target data object the user wishes to access, the type of operation to be performed, and the expected output format. After text parsing and entity recognition, the operation request data is extracted into structured fields. For example, if a user inputs the natural language query text "Query the last week's update records for data table Y in project X," after parsing, the target resource identifier is extracted as data table Y, the expected operation type is identified as "read," and the time sensitivity level is "real-time."

[0034] Load the user's historical access logs and extract the access time, access frequency, operation type, and accessed data object identifier as historical behavior data. Historical access logs are recorded in the audit log system of the data space. Each log entry includes the user identifier, access time, operation type, accessed data object identifier, and operation result. Extract all access logs of the user within a preset historical time window and arrange them in chronological order. The length of the preset historical time window is determined based on the stable period of the user's behavior pattern.

[0035] The method for determining the preset historical time window is as follows: obtain the average time interval between two consecutive similar operations performed by the user in the data space, and take a preset multiple of the average time interval as the length of the time window. The preset multiple is 10, so that the window contains enough operation records for statistical analysis of behavior patterns. For example, if the average time interval between two consecutive similar operations performed by the user is 9 days, the preset historical time window = 9 × 10 = 90 days.

[0036] Calculate the user's access frequency within a historical time window. Access frequency = total number of operations within the historical time window ÷ number of days in the historical time window. Extract all operation types involved by the user within the historical time window, as well as a list of accessed data object identifiers. For example, if a user accessed data table Y 15 times in the past 90 days, the access frequency = 15 ÷ 90 ≈ 0.167 times / day, the operation type was read operations (15 times), and the accessed data object was identified as data table Y.

[0037] The system loads the user's current session information and extracts the current project stage identifier, collaboration object identifier, device environment identifier, and geolocation information as the current context data. The current session information is obtained from the session management module in the data space and includes the session state information maintained since the user's current login. The project stage identifier indicates the user's current project stage, such as development, testing, or production, used to determine the rationality of permission requests. The collaboration object identifier indicates the team or external entity the user is currently collaborating with, used to assess permission boundaries in cross-domain collaboration scenarios. The device environment identifier indicates the type and security status of the device the user is using, such as a company terminal or mobile device, used to assess device trustworthiness. The geolocation information indicates the user's physical location at the time of access, used to detect abnormal access.

[0038] The system loads the security posture information of the user's current data space, extracting the current risk level and abnormal event identifiers as environmental risk data. The security posture information is obtained from the data space's security monitoring module, reflecting the overall security status of the data space. The current risk level is a value determined by the security monitoring module based on the number and severity of recent security incidents, ranging from low, medium, or high risk. The abnormal event identifier indicates whether there are any ongoing suspicious activities or violation alerts, with a value of 0 or 1, where 0 indicates no abnormal events and 1 indicates the presence of abnormal events. Environmental risk data is used to determine the trustworthiness of the current environment during authorization decisions. When the data space is in a high-risk state or abnormal events are present, permissions should be dynamically tightened to prevent the spread of security incidents.

[0039] For example, Table 1 is a user input data table of the multi-subject identity authentication permission management method based on trusted data space provided in this embodiment of the invention. It shows the operation request data, historical behavior data, current context data, and environmental risk data when a user initiates an operation request. After semantic parsing, the operation request data extracts the target resource identifier, expected operation type identifier, expected output format identifier, and time sensitivity level; the historical behavior data reflects the user's recent access patterns and habits; the current context data reflects the user's project stage and collaborative environment; and the environmental risk data characterizes the current overall security status of the data space.

[0040] Table 1: User Input Data Table

[0041]

[0042] The following technical effects were achieved through this step:

[0043] Four types of input data are collected uniformly, covering users' explicitly expressed operational needs, long-term behavioral patterns, current session context, and the overall security status of the data space. This provides a multi-dimensional information foundation for subsequent intent perception, permission requirement prediction, and authorization decisions. The length of the historical time window is dynamically determined by the average time interval between two consecutive similar operations in the historical access logs, so that the scope of historical behavioral data collection adapts to the individual behavioral rhythm of users.

[0044] S200: Perform intent perception and reasoning based on the input data to obtain a user intent vector, and calculate the intent credibility of the user intent vector based on the historical behavior data and the current context data;

[0045] This step performs intent perception and reasoning, parsing the operation request data into an initial intent vector, evaluating the credibility of the intent by combining historical behavior data, triggering the intent confirmation process when the intent confidence is insufficient, and finally outputting the user intent vector and intent credibility, providing quantitative input at the intent level for subsequent permission requirement prediction and authorization decision-making.

[0046] Step S200 provided in this embodiment of the invention includes:

[0047] Semantic parsing is performed on the operation request data to extract initial intent elements, which include target resource identifier, expected operation type identifier, expected output format identifier, and time sensitivity level.

[0048] The initial intent elements are fused with the current context data to construct an initial intent vector;

[0049] Based on the historical behavioral data, the initial intent vector is scored with confidence to obtain the intent confidence.

[0050] When the confidence level of the intent is greater than or equal to the preset confidence threshold, the initial intent vector is set as the user intent vector;

[0051] When the confidence level of the intent is less than the preset confidence threshold, an intent confirmation request is sent to the user and the confirmation intent information is received. The initial intent vector is updated based on the confirmation intent information to obtain the user intent vector.

[0052] Load the historical operation records that match the user's intent vector from the user's historical behavior data, count the number of matching operations and the success rate of matching operations, and perform a weighted calculation based on the intent confidence to obtain the intent credibility.

[0053] The specific implementation method is as follows:

[0054] First, semantic parsing is performed on the operation request data to extract initial intent elements. The operation request data is collected in step S100 and includes natural language query text or structured operation requests. Semantic parsing employs an intent-aware model, which is a machine learning model trained based on historical operation requests and labeled intent vectors. This model is used to perform semantic parsing and intent recognition on the user's current operation request data, outputting a structured user intent vector.

[0055] The initial intent elements include four items: target resource identifier, representing a unique identifier of the data resource the user intends to access, such as a database table, file, or API interface; expected operation type identifier, representing the operation the user hopes to perform on the target resource, such as reading, writing, calculating, or exporting; expected output format identifier, representing the data format the user expects to return, such as raw data, statistical analysis results, anonymized views, or visualizations; and time sensitivity level, representing the user's required response timeliness, such as real-time, near real-time, or batch processing, used to determine whether delays are permissible or priority scheduling is required. For example, after performing semantic parsing on the operation request data "Query the last week's update records of data table Y in project X," the initial intent elements are extracted as: target resource identifier = data table Y, expected operation type identifier = read, expected output format identifier = anonymized view, and time sensitivity level = real-time.

[0056] Then, the initial intent elements are fused with the current context data to construct an initial intent vector. The current context data, collected in step S100, includes the current project stage identifier, collaborating object identifier, device environment identifier, and geographic location information. Fusion refers to associating and integrating the semantically parsed user intent elements with the user's current actual scene information. The initial intent vector is constructed by encoding the four fields of the initial intent elements and the four fields of the current context data into numerical features, concatenating them into an eight-dimensional feature vector. One-hot encoding or embedded continuous encoding is used.

[0057] For example, the target resource identifier = data table Y is encoded as a data object code [0,0,1,0,...,0], the expected operation type identifier = read is encoded as an operation type code [1,0,0,0], the expected output format identifier = de-identified view is encoded as an output format code [0,1,0,0], the time sensitivity level = real-time is encoded as [1,0,0], the current project stage identifier = development stage is encoded as [0,1,0,0], the collaboration object identifier = team T1 is encoded as [0,1,0,...,0], the device environment identifier = company terminal is encoded as [1,0,0], and the geographical location information = Beijing headquarters office area is encoded as [0,1,0,...,0]. All encoded fields are concatenated in order to form the initial intent vector.

[0058] Next, a confidence score is calculated on the initial intent vector based on historical behavioral data to obtain the intent confidence score. The confidence score is based on the user's historical behavioral data, such as whether past actions are consistent with the current intent. Figure 1 To further quantify the credibility of the inferred intent, the intent-aware model outputs an initial intent vector along with a score based on its confidence level. The confidence score uses the maximum value of the normalized exponential function probability value from the intent-aware model's output layer. The intent confidence value ranges from 0 to 1, with values ​​closer to 1 indicating greater confidence in the intent recognition result. For example, if the maximum value of the normalized exponential function probability value from the intent-aware model's output layer for this semantic parsing is 0.76, the intent confidence level is 0.76.

[0059] Furthermore, the intent confidence score is compared with a preset reliability threshold. The preset reliability threshold is used to determine whether the intent recognition result is reliable enough without requiring user confirmation. The preset reliability threshold is determined as follows: obtain the lowest confidence score among the samples where the intent-aware model correctly recognized the intent on the historical test dataset, and take the 10th percentile of the confidence scores of all correctly recognized samples as the preset reliability threshold. The 10th percentile indicates that approximately 90% of the correctly recognized samples have a confidence score higher than this value; intent recognition results below this value are less reliable and require user confirmation. For example, the intent-aware model has 5000 correctly recognized samples on the historical test dataset, the 10th percentile of the confidence score is 0.72, and the preset reliability threshold is 0.72.

[0060] When the intent confidence level is greater than or equal to a preset confidence threshold, the intent recognition result is considered reliable, and the initial intent vector is set as the user intent vector. When the intent confidence level is less than the preset confidence threshold, the intent recognition result is considered less reliable, and an intent confirmation request is sent to the user, along with confirmation intent information. The intent confirmation request is displayed to the user in the form of a dialog box or interactive message, listing the initial intent elements identified by the intent-aware model for the user to check and correct. After the user submits the confirmation intent information, the corresponding fields in the initial intent vector are updated based on the confirmation intent information to obtain the user intent vector. For example, if the intent confidence level is 0.76 and the preset confidence threshold is 0.72, the intent confidence level is greater than the preset confidence threshold, and the initial intent vector is set as the user intent vector.

[0061] Furthermore, historical operation records matching the user's intent vector are loaded from the user's historical behavior data. Matching means that the target resource identifier and operation type identifier in the user's historical operation record are consistent with the corresponding fields in the user intent vector. The number of matching operations and the success rate of matching operations are then calculated. The success rate of matching operations = the number of successful matching operations ÷ the total number of matching operations. The number of matching operations reflects the user's familiarity with this type of operation, while the success rate reflects the reliability of the user's execution of this type of operation.

[0062] For example, in the user intent vector, the target resource is identified as data table Y, and the expected operation type is identified as read. The query shows that the user performed 12 read operations on data table Y in the past 90 days, of which 11 were successful and 1 failed due to insufficient permissions. The number of matching operations = 12, and the success rate of the matching operations = 11 ÷ 12 ≈ 0.917.

[0063] Finally, the intent credibility is calculated by weighting the intent confidence score. Intent credibility is a comprehensive quantitative assessment of the overall credibility of a user's current operational intent. Intent credibility = Intent confidence score × (w1 × Normalized value of matching operation count + w2 × Matching operation success rate), where the normalized value is the number of matching operations divided by the maximum number of single-type operations in all the user's historical operations, and w1 and w2 are weighting coefficients. w1 and w2 are determined as follows: The matching operation count and matching operation success rate of each sample in the historical user sample are obtained. With whether the user has violated permissions as the dependent variable and the matching operation count and matching operation success rate as the independent variables, logistic regression is used for fitting. Alternatively, with whether the user has violated permissions as the dependent variable (1 for violation, 0 for no violation) and the matching operation count and matching operation success rate as the independent variables, logistic regression is used for fitting. The ratio of the absolute value of the standardized regression coefficient to the sum of the absolute values ​​of the two standardized regression coefficients is used as the weighting coefficient.

[0064] For example, after calculation, w1 is 0.4, w2 is 0.6, and the maximum number of single-type operations in the user's total historical operations is 25. The normalized value of the number of matching operations = 12 ÷ 25 = 0.48. The success rate of the matching operation is 0.917. The credibility of the intent = 0.76 × (0.4 × 0.48 + 0.6 × 0.917) = 0.76 × (0.192 + 0.550) = 0.76 × 0.742 ≈ 0.564. For example, Figure 3 This is a user input data example table diagram of the multi-subject identity authentication and permission management method based on trusted data space provided in the embodiments of the present invention. It shows the operation request data, historical behavior data, current context data and environmental risk data when a user initiates an operation request.

[0065] The following technical effects were achieved through this step:

[0066] First, semantic parsing is performed on the operation request data to extract initial intent elements and fuse them with the current context to construct an intent vector. This transforms the user's operation request from literal text into a structured intent feature representation, providing calculable intent input for subsequent permission prediction and authorization decisions.

[0067] Second, the determination of whether to trigger the intent confirmation step is based on the confidence score of the intent-aware model and a pre-set confidence threshold. When the reliability of the intent-aware model is low, the intent is corrected through human-computer interaction to ensure the accuracy of the intent vector. The intent credibility is obtained by weighting the number of historical matching operations and the success rate, so that the final credibility assessment not only depends on the output of the intent-aware model, but is also verified by objective data of the user's historical behavior.

[0068] S300: Based on the user intent vector and the intent confidence, perform permission requirement prediction to obtain a pre-authorization suggestion list. The pre-authorization suggestion list includes at least one permission identifier and a corresponding requirement confidence. When the intent confidence is lower than a preset confidence threshold, the requirement confidence is calculated using a penalty coefficient for weighting.

[0069] This step loads the historical intent-permission association knowledge graph, calculates the similarity between the user intent vector and historical intent nodes, extracts candidate permission identifiers that co-occur with similar historical intents, calculates the basic requirement confidence based on the co-occurrence frequency, and determines whether to apply a penalty coefficient adjustment based on whether the intent confidence reaches a threshold. Finally, it generates a pre-authorization suggestion list that matches the current user intent, providing pre-judgment input at the permission level for subsequent multi-factor risk assessment and authorization decisions.

[0070] Step S300 provided in this embodiment of the invention includes:

[0071] Load the historical intent-permission association knowledge graph, which uses historical intent vectors and historical permission identifiers as nodes and historical co-occurrence relationships and temporal association relationships as edges;

[0072] Calculate the similarity between the user intent vector and each historical intent node, and extract the target historical intent nodes whose similarity is greater than or equal to a preset similarity threshold;

[0073] Obtain the set of candidate permission identifiers that have co-occurrence association with the target historical intent node and the co-occurrence frequency of each candidate permission identifier;

[0074] Calculate the basic requirement confidence level of each candidate permission identifier based on the co-occurrence frequency;

[0075] When the credibility of the intent is greater than or equal to the preset credibility threshold, the basic requirement confidence is set as the requirement confidence of each candidate permission identifier;

[0076] When the credibility of the intent is lower than the preset credibility threshold, the basic requirement confidence is weighted using the penalty coefficient to obtain the requirement confidence of each candidate permission identifier;

[0077] Extract candidate permission identifiers whose demand confidence level is greater than or equal to a preset demand confidence level threshold, and add them to the pre-authorization suggestion list.

[0078] The specific implementation method is as follows:

[0079] First, the historical intent-permission association knowledge graph is loaded. This knowledge graph is a graph structure built using user intent vectors and historical permission identifiers from historical authorization records as nodes, and the relationships between them as edges. The graph contains two types of nodes: historical intent nodes, which store the user intent vectors obtained from step S200 in each historical authorization record; and historical permission identifier nodes, which store the permission identifiers granted in each historical authorization record. Edges include two types: co-occurrence edges, connecting intent vector nodes and permission identifier nodes that appear simultaneously in the same historical authorization record, with the edge weight being the cumulative number of times this co-occurrence relationship occurs (i.e., co-occurrence frequency); and temporal association edges, connecting intent vector nodes that appear in two adjacent authorization records for the same user at different time points, with the edge weight being the cumulative number of times the temporal association occurs.

[0080] The knowledge graph is continuously updated during system operation. After each authorization is completed, the user intent vector and the actual granted permission identifier are added to the knowledge graph as new nodes or edges, so that the knowledge graph is continuously enriched as the system runs, and the accuracy of pre-authorization suggestions gradually improves with the number of uses.

[0081] Calculate the similarity between the user intent vector and each historical intent node. The user intent vector is output from step S200 and is an encoded multidimensional feature vector. The similarity is calculated using cosine similarity, which is calculated as: Cosine similarity = (Dot product of user intent vector and historical intent vector) ÷ (Magnitude of user intent vector × Magnitude of historical intent vector). The cosine similarity value ranges from -1 to 1, with values ​​closer to 1 indicating greater similarity between the two intent vectors.

[0082] Then, all historical intent nodes in the knowledge graph are traversed, and the cosine similarity between each historical intent node and the user intent vector is calculated sequentially to obtain a similarity sequence. Target historical intent nodes with similarity greater than or equal to a preset similarity threshold are extracted. The preset similarity threshold is used to filter out historical intents that are sufficiently similar to the current user intent, avoiding the introduction of weakly related historical data to interfere with the prediction results. The preset similarity threshold is determined as follows: obtain the cosine similarity between all pairs of historical intent nodes in the knowledge graph, calculate the arithmetic mean and standard deviation of all cosine similarities, and the preset similarity threshold = arithmetic mean + one standard deviation. The arithmetic mean plus one standard deviation indicates a statistically significant similarity level higher than approximately 84% of random pairwise similarities, ensuring that there is a significant similarity between the extracted target historical intent nodes and the user intent vector.

[0083] For example, the knowledge graph contains 1200 historical intent nodes. The arithmetic mean of the cosine similarity between any two nodes is approximately 0.42, and the standard deviation is approximately 0.15. The preset similarity threshold is 0.42 + 0.15 = 0.57. The cosine similarity between the user intent vector and each historical intent node ranges from 0.12 to 0.89, with 38 target historical intent nodes having a similarity greater than or equal to 0.57.

[0084] Next, the set of candidate permission identifiers that have co-occurrence relationships with the target historical intent node and the co-occurrence frequency of each candidate permission identifier are obtained. For each target historical intent node, the directly connected historical permission identifier nodes are found along the co-occurrence relationship edges; all connected permission identifier nodes constitute the candidate permission identifier set. The number of co-occurrence relationship edges between each candidate permission identifier node and all target historical intent nodes is counted, and this number is taken as the co-occurrence frequency of that candidate permission identifier. The co-occurrence frequency represents the cumulative number of times that permission identifier co-occurs with intents similar to the current user intent in the historical authorization records. The higher the co-occurrence frequency, the stronger the association between the permission identifier and the current user intent.

[0085] For example, 38 target historical intent nodes are associated with 12 candidate permission identifiers. Among them, the co-occurrence frequency of candidate permission identifier P1 with the target historical intent node is 85 times, the co-occurrence frequency of candidate permission identifier P2 is 62 times, the co-occurrence frequency of candidate permission identifier P3 is 31 times, and the co-occurrence frequency of the remaining candidate permission identifiers is between 5 and 28 times.

[0086] Furthermore, the basic demand confidence score for each candidate permission identifier is calculated based on its co-occurrence frequency. Basic demand confidence score = co-occurrence frequency of the candidate permission identifier ÷ maximum co-occurrence frequency among all candidate permission identifiers. The basic demand confidence score ranges from 0 to 1, with the candidate permission identifier having the highest co-occurrence frequency having a basic demand confidence score of 1; the lower the frequency, the lower the confidence score. Normalization by dividing by the maximum value ensures that the basic demand confidence score reflects the demand intensity of each candidate permission identifier relative to its most closely associated permission. For example, the maximum co-occurrence frequency among all candidate permission identifiers is 85, corresponding to candidate permission identifier P1. The basic demand confidence score for P1 = 85 ÷ 85 = 1.0, the basic demand confidence score for P2 = 62 ÷ 85 ≈ 0.729, and the basic demand confidence score for P3 = 31 ÷ 85 ≈ 0.365.

[0087] When the intent credibility is greater than or equal to the preset credibility threshold, the basic requirement confidence is set to the requirement confidence of each candidate permission identifier. The intent credibility is output by step S200, and the preset credibility threshold is used to determine whether the overall credibility of the user's current operation intent is high enough. The preset credibility threshold is determined by obtaining the intent credibility of each authorization in the historical authorization records and taking the median of all historical intent credibility data as the preset credibility threshold. The median indicates that the intent credibility in approximately half of the historical authorizations is higher than this value, and intent credibility higher than this value is within the normal credibility range. For example, the median of intent credibility in all historical authorization records is 0.52, and the preset credibility threshold = 0.52. Step S200 calculates the intent credibility to be 0.564, which is greater than the preset credibility threshold of 0.52, and sets the basic requirement confidence to the requirement confidence of each candidate permission identifier.

[0088] When the intent credibility is lower than a preset credibility threshold, a penalty coefficient is used to weight the basic requirement confidence to obtain the requirement confidence for each candidate permission identifier. The penalty coefficient is used to lower the requirement confidence when intent credibility is insufficient, reducing the strength of the pre-authorization suggestion to control authorization risk. Penalty coefficient = Intent credibility ÷ (Intent credibility + P0), where P0 is a preset constant, set to 0.5. This formula makes the penalty coefficient decrease as the graph credibility decreases; the lower the intent credibility, the smaller the penalty coefficient, and the greater the reduction in basic requirement confidence. Requirement confidence = Basic requirement confidence × Penalty coefficient.

[0089] For example, if the intent credibility is 0.45, which is lower than the preset credibility threshold of 0.52, the penalty coefficient = 0.45 ÷ (0.45 + 0.5) = 0.45 ÷ 0.95 ≈ 0.474. The demand confidence of candidate permission identifier P1 = 1.0 × 0.474 ≈ 0.474, which is significantly lower than 1.0 when there is no penalty. When the intent credibility is zero, the penalty coefficient is 0, and the demand confidence is completely cleared; when the intent credibility is 0.5, the penalty coefficient = 0.5 ÷ (0.5 + 0.5) = 0.5, that is, the confidence is halved; when the intent credibility is close to 1.0, the penalty coefficient ≈ 0.667, and the penalty is relatively light.

[0090] Finally, candidate permission identifiers with a demand confidence level greater than or equal to a preset demand confidence threshold are extracted and added to the pre-authorization suggestion list. The preset demand confidence threshold is used to filter candidate permission identifiers with a demand confidence level that reaches a certain level, excluding permissions with excessively low demand intensity. The preset demand confidence threshold is determined as follows: obtain the demand confidence level of the permission identifiers actually granted in historical authorization records, and take the 25th percentile of the demand confidence level of all actual authorization records as the preset demand confidence threshold. The 25th percentile indicates that approximately 75% of actual authorizations have a demand confidence level higher than this value, and permissions with a demand confidence level lower than this value are less likely to occur in actual authorizations.

[0091] For example, the 25th percentile of the actual authorization request confidence level in all historical authorization records is 0.28, and the preset authorization request confidence level threshold is 0.28. The authorization request confidence levels for candidate authorization identifiers P1, P2, and P3 are 1.0, 0.729, and 0.365, respectively, all greater than 0.28. All three candidate authorization identifiers are added to the pre-authorization recommendation list. The authorization request confidence levels for the remaining candidate authorization identifiers are below 0.28 and are not included in the pre-authorization recommendation list.

[0092] The pre-authorization recommendation list contains each candidate permission identifier and its corresponding requirement confidence level. The structure of the pre-authorization recommendation list is as follows: each record contains a permission identifier field and a requirement confidence level field, sorted from highest to lowest requirement confidence level. As one of the inputs to step S400, the pre-authorization recommendation list provides a preliminary reference for permission requirement levels in multi-factor risk assessment and authorization decisions.

[0093] The following technical effects were achieved through this step:

[0094] By loading a knowledge graph of historical intent and permissions, and using cosine similarity to match the current user intent with historical intent nodes, and extracting co-occurring candidate permission identifiers, personalized pre-authorization suggestions can be dynamically generated based on the user's current specific intent.

[0095] S400: Perform multi-factor risk assessment and authorization decision based on the user intent vector, the pre-authorization suggestion list and the intent credibility, and obtain authorization decision results. The authorization decision results include full authorization, restricted authorization, manual approval required or access denied, wherein the intent credibility is used as an independent weighting factor in the multi-factor risk assessment.

[0096] This step uses the rationality of intent, necessity of permission, environmental risk, and credibility of intent as four independent weighting factors to perform a multi-factor risk assessment. The comprehensive weighting is used to obtain a comprehensive authorization score, and the score is mapped to four decision results according to the preset three-level scoring threshold: full authorization, restricted authorization, manual approval required, or access denied, so as to achieve refined and multi-dimensional hierarchical authorization decision-making.

[0097] Step S400 provided in this embodiment of the invention includes:

[0098] Based on the user intent vector and the current context data, an intent rationality assessment is performed to obtain an intent rationality score;

[0099] Based on each permission identifier in the pre-authorization suggestion list, a permission necessity assessment is performed to obtain a permission necessity score;

[0100] An environmental risk assessment is performed based on the environmental risk data to obtain an environmental risk score.

[0101] The intent credibility is used as the fourth evaluation factor to obtain the intent credibility score;

[0102] A weighted summation is performed on the intent rationality score, the permission necessity score, the environmental risk score, and the intent credibility score to obtain a comprehensive authorization score;

[0103] When the comprehensive authorization score is greater than or equal to the first score threshold, the full authorization is output;

[0104] When the overall authorization score is greater than or equal to the second scoring threshold and less than the first scoring threshold, the restrictive authorization is output;

[0105] When the overall authorization score is greater than or equal to the third score threshold and less than the second score threshold, the message "manual approval is required" is output.

[0106] When the overall authorization score is less than the third score threshold, the access is denied.

[0107] The first scoring threshold, the second scoring threshold, and the third scoring threshold decrease sequentially.

[0108] The specific implementation method is as follows:

[0109] An intent rationality assessment is performed based on the user intent vector and current context data to obtain an intent rationality score. The intent rationality assessment determines whether the user's current operational intent is reasonable within its actual context. The assessment method involves extracting the target resource identifier, expected operation type identifier, and time sensitivity level from the user intent vector, and extracting the current project stage identifier, collaborating object identifier, device environment identifier, and geographical location information from the current context data. These fields are then combined and input into a pre-defined intent rationality rule base for matching. This rule base is pre-compiled by domain security experts based on the business scenarios and compliance requirements of the data space. Each rule defines a reasonable intent pattern for a specific scenario. The number of successfully matched rules divided by the total number of rules in the rule base relevant to the current scenario is used as the intent rationality score. The intent rationality score ranges from 0 to 1, with a value closer to 1 indicating a better match between the user's current intent and the context environment.

[0110] For example, the user intent vector includes the target resource identifier as data table Y, the expected operation type identifier as read, and the project stage identifier in the current context data as development stage. There are 8 rules related to the development stage and data read in the intent rationality rule base. The current intent successfully matches 7 of them, and the intent rationality score = 7 ÷ 8 = 0.875.

[0111] A necessity assessment is performed on each permission identifier in the pre-authorization suggestion list to obtain a necessity score. This assessment measures the urgency of the user's actual need for the recommended permissions. The assessment method is as follows: extract the demand confidence scores of all candidate permission identifiers in the pre-authorization suggestion list, and take the median of all demand confidence scores as the necessity score. The median reflects the overall level of demand confidence for each permission in the pre-authorization suggestion list; a higher median indicates a stronger overall demand for the candidate permissions associated with the current intent, and a greater necessity for granting the permissions. For example, if the pre-authorization suggestion list contains three candidate permission identifiers with demand confidence scores of 1.0, 0.729, and 0.365, respectively, and a median of 0.729, the necessity score would be 0.729.

[0112] An environmental risk assessment is performed based on environmental risk data to obtain an environmental risk score. Environmental risk data is collected in step S100 and includes the current risk level and anomaly event identifiers. The environmental risk assessment converts the environmental risk data into a risk score that can participate in weighted calculations. The assessment method is as follows: the environmental risk score is 0.2 for low risk, 0.5 for medium risk, and 0.8 for high risk. When the anomaly event identifier is 1, 0.15 is added to the risk level score; if the score exceeds 1 after the addition, it is set to 1. The environmental risk score ranges from 0 to 1, with values ​​closer to 1 indicating higher environmental risk. For example, if the current risk level is low risk, the base value of the environmental risk score is 0.2. If the anomaly event identifier is 0, no additional addition is made. The environmental risk score is 0.2.

[0113] Intent credibility is used as the fourth evaluation factor to obtain an intent credibility score. The intent credibility is calculated in step S200 and directly used as the value of the intent credibility score. For example, step S200 calculates an intent credibility of 0.564, and the intent credibility score is 0.564.

[0114] A weighted sum is applied to the intention rationality score, authority necessity score, environmental risk score, and intention credibility score to obtain a comprehensive authorization score. The weight coefficients of the four evaluation factors are determined based on the degree of influence of each factor on authorization security. The method for determining the weight coefficients is as follows: obtain the correlation coefficients between each score in the historical authorization records and the actual authorization results, and take the proportion of the absolute value of each correlation coefficient to the sum of the absolute values ​​of the four correlation coefficients as the weight coefficient.

[0115] For example, the absolute values ​​of the correlation coefficients of the four evaluation factors in historical authorization records are: Reasonableness of Intent (0.72), Necessity of Authority (0.45), Environmental Risk (0.58), and Credibility of Intent (0.63), with a total of 0.72 + 0.45 + 0.58 + 0.63 = 2.38. The weights for Reasonableness of Intent and Necessity of Authority are approximately 0.303, 0.45 ÷ 2.38 ≈ 0.189, 0.58 ÷ 2.38 ≈ 0.244, and 0.63 ÷ 2.38 ≈ 0.264. The overall authorization score is calculated as follows: 0.303 × 0.875 + 0.189 × 0.729 + 0.244 × 0.2 + 0.264 × 0.564 = 0.265 + 0.138 + 0.049 + 0.149 = 0.601.

[0116] The overall authorization score is compared with the first, second, and third scoring thresholds to determine the authorization decision. The first, second, and third scoring thresholds are determined as follows: The overall authorization scores of samples from historical authorization records that were successfully authorized without security incidents are used to construct a security authorization score sequence; the overall authorization scores of samples from historical authorization records that resulted in security incidents are used to construct a risk authorization score sequence. The 10th percentile of the security authorization score sequence is taken as the first scoring threshold, the median of the security authorization score sequence is taken as the second scoring threshold, and the 75th percentile of the risk authorization score sequence is taken as the third scoring threshold.

[0117] For example, the 10th percentile of the security authorization scoring sequence is 0.82, and the first scoring threshold is 0.82; the median of the security authorization scoring sequence is 0.58, and the second scoring threshold is 0.58; the 75th percentile of the risk authorization scoring sequence is 0.35, and the third scoring threshold is 0.35. The first scoring threshold of 0.82, the second scoring threshold of 0.58, and the third scoring threshold of 0.35 decrease sequentially.

[0118] The overall authorization score is 0.601, which is greater than or equal to the second scoring threshold of 0.58 and less than the first scoring threshold of 0.82, resulting in a restrictive authorization. Restrictive authorization grants the user access rights, but imposes restrictions on the scope of operation, data access volume, or effective time window.

[0119] If the overall authorization score is greater than or equal to the first scoring threshold, it indicates that all evaluation factors are at an excellent level, and full authorization is output, granting the user all requested permissions. If the overall authorization score is greater than or equal to the third scoring threshold but less than the second scoring threshold, it indicates that there is some risk but it is still acceptable, and manual approval is required, transferring the authorization request to the security administrator for manual review. If the overall authorization score is less than the third scoring threshold, it indicates that the risk is high, and access is denied, granting no permissions.

[0120] The following technical effects were achieved through this step:

[0121] The weights are determined by the correlation coefficients between the scores in historical authorization records and the actual authorization results, ensuring that the weight allocation of the comprehensive authorization score objectively reflects the contribution of each factor to authorization security. The three-level scoring thresholds are dynamically determined based on the statistical percentiles of safe and risky authorization samples, aligning the boundaries of tiered authorization decisions with historical security experience, and balancing authorization flexibility with security assurance.

[0122] This invention also provides closed-loop management of permission policies and continuous model optimization functions, including:

[0123] Based on the authorization decision results, the permission policy is issued and user behavior is continuously monitored to obtain behavior monitoring data.

[0124] When the behavior monitoring data represents a deviation from the user intent vector, the execution permission is dynamically revoked or downgraded.

[0125] The authorization decision results, the behavior monitoring data, and the execution results of dynamic recycling or degradation are stored as feedback data in the feedback dataset;

[0126] Incremental learning is performed on the intent-aware model and the permission requirement prediction model based on the feedback dataset to obtain updated intent-aware model and updated permission requirement prediction model. The intent-aware model is used to perform semantic parsing and intent recognition on the operation request data to extract initial intent elements, and the permission requirement prediction model is used to generate the pre-authorization suggestion list by matching the user intent vector with the historical intent-permission association knowledge graph.

[0127] Specifically, the process of issuing permission policies and continuously monitoring user behavior based on the authorization decision results to obtain behavior monitoring data includes:

[0128] The authorization decision result is converted into an authorization policy, which includes an authorization subject identifier, an authorization target resource identifier, a set of authorization operation types, an authorization effective time window, and authorization constraints.

[0129] The permission policy is distributed to the policy execution point in the data space;

[0130] During the period when the permission policy is in effect, the user's actual operation record is collected in real time. The actual operation record includes the actual operation time, the actual operation object identifier, the actual operation type, and the actual data access volume.

[0131] Wherein, when the behavior monitoring data representing the actual behavior deviates from the user intent vector, the dynamic revocation or downgrading of execution permissions includes:

[0132] When the deviation of the behavior is greater than or equal to a preset deviation threshold, a permission adjustment instruction is generated;

[0133] Based on the permission adjustment instruction, a permission revocation command or a permission downgrade command is sent to the policy execution point. The permission revocation command is used to revoke all access permissions of the user to the authorized target resource identifier, and the permission downgrade command is used to restrict the authorized operation type set to read-only operations.

[0134] An abnormal behavior alarm message is sent to the security administrator terminal. The abnormal behavior alarm message includes a user identifier, the behavior deviation degree, and the actual operation record. The behavior deviation degree is calculated by comparing the actual operation record with the user intent vector, and is used as the behavior monitoring data.

[0135] Specifically, the authorization decision result, the behavior monitoring data, and the execution result of dynamic recycling or degradation are stored as feedback data in a feedback dataset, including:

[0136] When the authorization decision result is full authorization and the behavior monitoring data represents that the actual behavior is consistent with the user intent vector, the user intent vector and the pre-authorization suggestion list are added to the feedback dataset as positive samples.

[0137] When the authorization decision result is to deny access and no attempt by the user to access the same target resource is detected within a subsequent preset time window, the user intent vector and the pre-authorization suggestion list are added as negative samples to the feedback dataset.

[0138] When the deviation of the behavior is greater than or equal to the preset deviation threshold, the user intent vector, the pre-authorized suggestion list, and the actual operation record are added to the feedback dataset as abnormal samples.

[0139] The specific implementation method is as follows:

[0140] After the authorization decision result is output in step S400, it is converted into a permission policy and issued for execution, while the user's actual operation behavior is continuously monitored. The authorization decision result is converted into a permission policy, which includes the authorization subject identifier, the authorization target resource identifier, the set of authorized operation types, the authorization effective time window, and authorization constraints. Authorization constraints are additional restrictions on the use of permissions, such as the maximum amount of data accessed at one time and the range of accessible data columns. The permission policy is issued to the policy execution point in the data space. The policy execution point is located at the data access entry point and is responsible for intercepting user operations and deciding whether to allow them based on the permission policy.

[0141] During the period when the permission policy is in effect, the user's actual operation records are collected in real time. These records include the actual operation time, the identifier of the actual operation object, the type of the actual operation, and the amount of data accessed. Based on the actual operation records and the user's intent vector, a behavior deviation is calculated as behavior monitoring data. Behavior deviation = (Number of times the actual operation object identifier does not match the intended target resource identifier + Number of times the actual operation type does not match the intended expected operation type identifier) ​​÷ Total number of operations within the preset monitoring window. The preset monitoring window length is one-fifth of the effective authorization time window length, ensuring sufficiently fine monitoring granularity and timely detection of abnormal behavior. For example, the effective authorization time window length is 60 minutes, and the preset monitoring window length is 12 minutes.

[0142] When the behavioral deviation is greater than or equal to a preset deviation threshold, a permission adjustment instruction is generated. The preset deviation threshold is determined as follows: The actual operation records of sample users who were normally authorized and did not generate security events are obtained from historical authorization records. The behavioral deviation of each sample user during the period the permission was in effect is calculated, and the 95th percentile of the behavioral deviation of all normal samples is taken as the preset deviation threshold. The 95th percentile indicates that approximately 95% of normal behavioral deviations are below this value; deviations exceeding this value are considered low-probability abnormal events. For example, the 95th percentile of the behavioral deviation of normal samples is 0.18, and the preset deviation threshold is 0.18.

[0143] Based on the permission adjustment command, a permission revoke command or permission downgrade command is sent to the policy enforcement point. The permission revoke command is used to revoke all access permissions of a user to the authorized target resource identifier, suitable for situations where the behavior deviation is severe. The permission downgrade command is used to restrict the authorized operation type set to read-only operations, suitable for situations where the behavior deviation is minor. The applicable scenarios for both are distinguished by the extent to which the behavior deviation exceeds a preset deviation threshold: Exceedance = Behavior Deviation - Preset Deviation Threshold. When the exceedance is greater than 0.3, permission revoke is executed; when the exceedance is less than or equal to 0.3, permission downgrade is executed. Simultaneously, an abnormal behavior alarm message is sent to the security administrator terminal. The abnormal behavior alarm message includes the user identifier, behavior deviation, and actual operation records.

[0144] The authorization decision result, behavior monitoring data, and dynamic recycling or downgrading execution results are stored as feedback data in the feedback dataset. The feedback dataset is constructed according to the following rules: When the authorization decision result is full authorization and the behavior monitoring data indicates that the actual behavior is consistent with the user's intent vector, the user intent vector and the pre-authorization suggestion list are added to the feedback dataset as positive samples. When the authorization decision result is access denied and no user access attempts to the same target resource are detected within a subsequent preset time window, the user intent vector and the pre-authorization suggestion list are added to the feedback dataset as negative samples. The preset time window length is three times the length of the effective authorization time window to ensure sufficient observation time to confirm that the user has not attempted unauthorized access. When the behavior deviation is greater than or equal to a preset deviation threshold, the user intent vector, the pre-authorization suggestion list, and the actual operation record are added to the feedback dataset as abnormal samples.

[0145] Incremental learning is performed on the intent-aware model and the permission request prediction model based on the feedback dataset. The structures of the intent-aware model and the permission request prediction model are described below:

[0146] The intent-aware model performs semantic parsing and intent recognition on operation request data to extract initial intent elements. The input to the intent-aware model is the user's natural language query text or structured operation request. A text embedding layer converts the input text into a fixed-dimensional sequence of word embedding vectors. Following the text embedding layer is a bidirectional long short-term memory (LSTM) network, which encodes the word embedding vector sequence into contextual semantic feature vectors. The LSTM network has 128 hidden layer nodes and an output dimension of 256. Following the LSTM network is a fully connected classification layer with 256 input nodes. The number of output nodes equals the sum of the encoding dimensions of the four fields of the initial intent element. The fully connected classification layer is followed by four parallel output sub-layers. The four output sub-layers output the codes for the target resource identifier, the expected operation type identifier, the expected output format identifier, and the time sensitivity level, respectively. Each output sub-layer is followed by a normalized exponential function layer that outputs the probability distribution of each category. The maximum probability of the normalized exponential function is taken as the model output confidence of the intent element, and the minimum confidence of the four output sub-layers is taken as the intent confidence.

[0147] The permission requirement prediction model is used to generate a pre-authorization suggestion list by matching the user intent vector with the historical intent-permission association knowledge graph. The input to the permission requirement prediction model is the user intent vector output in step S200 and the historical intent-permission association knowledge graph loaded in step S300. The permission requirement prediction model includes an intent matching submodule and a permission ranking submodule. The intent matching submodule calculates the cosine similarity between the user intent vector and each historical intent node in the knowledge graph, outputting a set of target historical intent nodes with a similarity greater than or equal to a preset similarity threshold. The permission ranking submodule takes the target historical intent node set as input, extracts candidate permission identifiers and their co-occurrence frequencies along the co-occurrence relationship edges of the knowledge graph, sorts them in descending order of co-occurrence frequency, and outputs the sorted list of candidate permission identifiers. The ranking submodule uses a heap sort algorithm, completing the sorting with linear logarithmic complexity when the number of candidate permission identifiers is large, outputting the ranked list and the co-occurrence frequency corresponding to each candidate permission identifier.

[0148] Incremental learning employs an online batch update approach. When the cumulative number of new samples in the feedback dataset reaches a preset batch size, an update of the intent-aware model and the permission requirement prediction model is triggered. The preset batch size is determined based on the convergence stability of the parameters of the intent-aware model and the permission requirement prediction model, and is set to a preset proportion of the total number of samples in the current training set, typically 5%. During the update, an adaptive moment estimation optimizer is used, employing the new samples in the feedback dataset as training data and the parameters of the intent-aware model and the permission requirement prediction model obtained from the previous training round as initial values ​​for incremental training. The learning rate for incremental training is one-tenth of the initial training learning rate of the intent-aware model and the permission requirement prediction model to avoid excessive perturbation of their parameters by new samples. After the update is complete, the trained feedback samples are removed from the feedback dataset, and the remaining samples are retained to await the next batch update.

[0149] For example, the current training set contains 8000 samples, and the preset batch size is 8000 × 5% = 400 samples. When the cumulative number of new samples in the feedback dataset reaches 400, incremental training is performed on the intent-aware model and the permission requirement prediction model. After the update, the trained samples are cleared, and the update is triggered again when the cumulative number reaches 400. The initial training learning rate of the intent-aware model is 0.001, and the incremental learning rate is 0.0001. The initial training learning rate of the permission requirement prediction model is 0.002, and the incremental learning rate is 0.0002.

[0150] Example 2, as Figure 3 As shown, based on the same inventive concept provided in Embodiment 1, this embodiment of the invention also provides that the system includes:

[0151] Data acquisition module 11 is used to acquire user input data, which includes operation request data, historical behavior data, current context data, and environmental risk data;

[0152] The intent perception module 12 is used to perform intent perception and reasoning based on the input data, obtain a user intent vector, and calculate the intent credibility of the user intent vector based on the historical behavior data and the current context data.

[0153] The permission prediction module 13 is used to perform permission requirement prediction based on the user intent vector and the intent confidence level to obtain a pre-authorization suggestion list. The pre-authorization suggestion list includes at least one permission identifier and a corresponding requirement confidence level. When the intent confidence level is lower than a preset confidence level threshold, the requirement confidence level is calculated using a penalty coefficient for weighting.

[0154] The authorization decision module 14 is used to perform multi-factor risk assessment and authorization decision based on the user intent vector, the pre-authorization suggestion list and the intent credibility, and obtain the authorization decision result. The authorization decision result includes full authorization, restricted authorization, manual approval required or access denied, wherein the intent credibility is used as an independent weighting factor of the multi-factor risk assessment.

[0155] In one embodiment, the data acquisition module 11 is further configured to collect the user's natural language query text or structured operation request as the operation request data;

[0156] Load the user's historical access logs and extract the access time, access frequency, operation type, and accessed data object identifier as the historical behavior data;

[0157] Load the user's current session information, and extract the current project stage identifier, collaboration object identifier, device environment identifier, and geographical location information as the current context data;

[0158] Load the security status information of the user's current data space, extract the current risk level and abnormal event identifier, and use them as the environmental risk data.

[0159] In one embodiment, the intent-aware module 12 is further configured to perform semantic parsing on the operation request data and extract initial intent elements, the initial intent elements including target resource identifier, expected operation type identifier, expected output format identifier and time sensitivity level;

[0160] The initial intent elements are fused with the current context data to construct an initial intent vector;

[0161] Based on the historical behavioral data, the initial intent vector is scored with confidence to obtain the intent confidence.

[0162] When the confidence level of the intent is greater than or equal to the preset confidence threshold, the initial intent vector is set as the user intent vector;

[0163] When the confidence level of the intent is less than the preset confidence threshold, an intent confirmation request is sent to the user and the confirmation intent information is received. The initial intent vector is updated based on the confirmation intent information to obtain the user intent vector.

[0164] Load the historical operation records that match the user's intent vector from the user's historical behavior data, count the number of matching operations and the success rate of matching operations, and perform a weighted calculation based on the intent confidence to obtain the intent credibility.

[0165] In one embodiment, the permission prediction module 13 is further configured to load a historical intent-permission association knowledge graph, wherein the historical intent-permission association knowledge graph uses historical intent vectors and historical permission identifiers as nodes, and historical co-occurrence relationships and temporal association relationships as edges;

[0166] Calculate the similarity between the user intent vector and each historical intent node, and extract the target historical intent nodes whose similarity is greater than or equal to a preset similarity threshold;

[0167] Obtain the set of candidate permission identifiers that have co-occurrence association with the target historical intent node and the co-occurrence frequency of each candidate permission identifier;

[0168] Calculate the basic requirement confidence level of each candidate permission identifier based on the co-occurrence frequency;

[0169] When the credibility of the intent is greater than or equal to the preset credibility threshold, the basic requirement confidence is set as the requirement confidence of each candidate permission identifier;

[0170] When the credibility of the intent is lower than the preset credibility threshold, the basic requirement confidence is weighted using the penalty coefficient to obtain the requirement confidence of each candidate permission identifier;

[0171] Extract candidate permission identifiers whose demand confidence level is greater than or equal to a preset demand confidence level threshold, and add them to the pre-authorization suggestion list.

[0172] In one embodiment, the authorization decision module 14 is further configured to perform an intent rationality assessment based on the user intent vector and the current context data to obtain an intent rationality score;

[0173] Based on each permission identifier in the pre-authorization suggestion list, a permission necessity assessment is performed to obtain a permission necessity score;

[0174] An environmental risk assessment is performed based on the environmental risk data to obtain an environmental risk score.

[0175] The intent credibility is used as the fourth evaluation factor to obtain the intent credibility score;

[0176] A weighted summation is performed on the intent rationality score, the permission necessity score, the environmental risk score, and the intent credibility score to obtain a comprehensive authorization score;

[0177] When the comprehensive authorization score is greater than or equal to the first score threshold, the full authorization is output;

[0178] When the overall authorization score is greater than or equal to the second scoring threshold and less than the first scoring threshold, the restrictive authorization is output;

[0179] When the overall authorization score is greater than or equal to the third score threshold and less than the second score threshold, the message "manual approval is required" is output.

[0180] When the overall authorization score is less than the third score threshold, the access is denied.

[0181] The first scoring threshold, the second scoring threshold, and the third scoring threshold decrease sequentially.

Claims

1. A multi-subject identity authentication and access control method based on a trusted data space, characterized in that: include: Obtain user input data, which includes operation request data, historical behavior data, current context data, and environmental risk data; Based on the input data, intent perception and reasoning are performed to obtain a user intent vector, and the intent credibility of the user intent vector is calculated based on the historical behavior data and the current context data. Based on the user intent vector and the intent confidence, the permission requirement is predicted to obtain a pre-authorization suggestion list. The pre-authorization suggestion list includes at least one permission identifier and a corresponding requirement confidence. When the intent confidence is lower than a preset confidence threshold, the requirement confidence is calculated using a penalty coefficient for weighting. Based on the user intent vector, the pre-authorization suggestion list, and the intent credibility, a multi-factor risk assessment and authorization decision are performed to obtain the authorization decision result. The authorization decision result includes full authorization, restricted authorization, manual approval required, or access denied. The intent credibility is used as an independent weighting factor in the multi-factor risk assessment.

2. The multi-subject identity authentication and access control method based on trusted data space as described in claim 1, characterized in that, Obtain user input data, including: Collect the user's natural language query text or structured operation request as the operation request data; Load the user's historical access logs and extract the access time, access frequency, operation type, and accessed data object identifier as the historical behavior data; Load the user's current session information, and extract the current project stage identifier, collaboration object identifier, device environment identifier, and geographical location information as the current context data; Load the security status information of the user's current data space, extract the current risk level and abnormal event identifier, and use them as the environmental risk data.

3. The multi-subject identity authentication and access control method based on trusted data space as described in claim 1, characterized in that, Based on the input data, intent perception and reasoning are performed to obtain a user intent vector, and the intent credibility of the user intent vector is calculated based on the historical behavior data and the current context data, including: Semantic parsing is performed on the operation request data to extract initial intent elements, which include target resource identifier, expected operation type identifier, expected output format identifier, and time sensitivity level. The initial intent elements are fused with the current context data to construct an initial intent vector; Based on the historical behavioral data, the initial intent vector is scored with confidence to obtain the intent confidence. When the confidence level of the intent is greater than or equal to the preset confidence threshold, the initial intent vector is set as the user intent vector; When the confidence level of the intent is less than the preset confidence threshold, an intent confirmation request is sent to the user and the confirmation intent information is received. The initial intent vector is updated based on the confirmation intent information to obtain the user intent vector. Load the historical operation records that match the user's intent vector from the user's historical behavior data, count the number of matching operations and the success rate of matching operations, and perform a weighted calculation based on the intent confidence to obtain the intent credibility.

4. The multi-subject identity authentication and access control method based on trusted data space as described in claim 1, characterized in that, Based on the user intent vector and the credibility of the intent, the system performs permission request prediction and obtains a pre-authorization suggestion list, including: Load the historical intent-permission association knowledge graph, which uses historical intent vectors and historical permission identifiers as nodes and historical co-occurrence relationships and temporal association relationships as edges; Calculate the similarity between the user intent vector and each historical intent node, and extract the target historical intent nodes whose similarity is greater than or equal to a preset similarity threshold; Obtain the set of candidate permission identifiers that have co-occurrence association with the target historical intent node and the co-occurrence frequency of each candidate permission identifier; Calculate the basic requirement confidence level of each candidate permission identifier based on the co-occurrence frequency; When the credibility of the intent is greater than or equal to the preset credibility threshold, the basic requirement confidence is set as the requirement confidence of each candidate permission identifier; When the credibility of the intent is lower than the preset credibility threshold, the basic requirement confidence is weighted using the penalty coefficient to obtain the requirement confidence of each candidate permission identifier; Extract candidate permission identifiers whose demand confidence level is greater than or equal to a preset demand confidence level threshold, and add them to the pre-authorization suggestion list.

5. The multi-subject identity authentication and access control method based on trusted data space as described in claim 1, characterized in that, Based on the user intent vector, the pre-authorization suggestion list, and the intent credibility, a multi-factor risk assessment and authorization decision are performed to obtain the authorization decision result, including: Based on the user intent vector and the current context data, an intent rationality assessment is performed to obtain an intent rationality score; Based on each permission identifier in the pre-authorization suggestion list, a permission necessity assessment is performed to obtain a permission necessity score; An environmental risk assessment is performed based on the environmental risk data to obtain an environmental risk score. The intent credibility is used as the fourth evaluation factor to obtain the intent credibility score; A weighted summation is performed on the intent rationality score, the permission necessity score, the environmental risk score, and the intent credibility score to obtain a comprehensive authorization score; When the comprehensive authorization score is greater than or equal to the first score threshold, the full authorization is output; When the overall authorization score is greater than or equal to the second scoring threshold and less than the first scoring threshold, the restrictive authorization is output; When the overall authorization score is greater than or equal to the third score threshold and less than the second score threshold, the message "manual approval is required" is output. When the overall authorization score is less than the third score threshold, the access is denied. The first scoring threshold, the second scoring threshold, and the third scoring threshold decrease sequentially.

6. The multi-subject identity authentication and access control method based on trusted data space as described in claim 1, characterized in that, Also includes: Based on the authorization decision results, the permission policy is issued and user behavior is continuously monitored to obtain behavior monitoring data. When the behavior monitoring data represents a deviation from the user intent vector, the execution permission is dynamically revoked or downgraded. The authorization decision results, the behavior monitoring data, and the execution results of dynamic recycling or degradation are stored as feedback data in the feedback dataset; Incremental learning is performed on the intent-aware model and the permission requirement prediction model based on the feedback dataset to obtain updated intent-aware model and updated permission requirement prediction model. The intent-aware model is used to perform semantic parsing and intent recognition on the operation request data to extract initial intent elements, and the permission requirement prediction model is used to generate the pre-authorization suggestion list by matching the user intent vector with the historical intent-permission association knowledge graph.

7. The multi-subject identity authentication and access control method based on trusted data space as described in claim 6, characterized in that, Based on the authorization decision result, the permission policy is issued and user behavior is continuously monitored to obtain behavior monitoring data, including: The authorization decision result is converted into an authorization policy, which includes an authorization subject identifier, an authorization target resource identifier, a set of authorization operation types, an authorization effective time window, and authorization constraints. The permission policy is distributed to the policy execution point in the data space; During the period when the permission policy is in effect, the user's actual operation record is collected in real time. The actual operation record includes the actual operation time, the actual operation object identifier, the actual operation type, and the actual data access volume. The behavioral deviation is calculated based on the actual operation record and the user intent vector, and used as the behavioral monitoring data.

8. The multi-subject identity authentication and access control method based on trusted data space as described in claim 7, characterized in that, When the behavior monitoring data characterizing the actual behavior deviates from the user intent vector, the execution permission is dynamically revoked or downgraded, including: When the deviation of the behavior is greater than or equal to a preset deviation threshold, a permission adjustment instruction is generated; Based on the permission adjustment instruction, a permission revocation command or a permission downgrade command is sent to the policy execution point. The permission revocation command is used to revoke all access permissions of the user to the authorized target resource identifier, and the permission downgrade command is used to restrict the authorized operation type set to read-only operations. An abnormal behavior alarm message is sent to the security administrator terminal. The abnormal behavior alarm message includes the user identifier, the deviation of the behavior, and the actual operation record.

9. The multi-subject identity authentication and access control method based on trusted data space as described in claim 6, characterized in that, The authorization decision results, the behavior monitoring data, and the execution results of dynamic recycling or degradation are stored as feedback data in a feedback dataset, including: When the authorization decision result is full authorization and the behavior monitoring data represents that the actual behavior is consistent with the user intent vector, the user intent vector and the pre-authorization suggestion list are added to the feedback dataset as positive samples. When the authorization decision result is to deny access and no attempt by the user to access the same target resource is detected within a subsequent preset time window, the user intent vector and the pre-authorization suggestion list are added as negative samples to the feedback dataset. When the deviation of the behavior is greater than or equal to the preset deviation threshold, the user intent vector, the pre-authorized suggestion list, and the actual operation record are added to the feedback dataset as abnormal samples.

10. A multi-subject identity authentication and access control system based on a trusted data space, characterized in that: The system is used to implement the multi-subject identity authentication and access control method based on trusted data space as described in any one of claims 1 to 9, the system comprising: The data acquisition module is used to acquire user input data, which includes operation request data, historical behavior data, current context data, and environmental risk data. The intent perception module is used to perform intent perception and reasoning based on the input data, obtain the user intent vector, and calculate the intent credibility of the user intent vector based on the historical behavior data and the current context data. The permission prediction module is used to perform permission request prediction based on the user intent vector and the intent confidence level to obtain a pre-authorization suggestion list. The pre-authorization suggestion list includes at least one permission identifier and a corresponding request confidence level. When the intent confidence level is lower than a preset confidence level threshold, the request confidence level is calculated using a penalty coefficient for weighting. The authorization decision module is used to perform multi-factor risk assessment and authorization decision based on the user intent vector, the pre-authorization suggestion list and the intent credibility, and obtain the authorization decision result. The authorization decision result includes full authorization, restricted authorization, manual approval required or access denied, wherein the intent credibility is used as an independent weighting factor in the multi-factor risk assessment.

Images