A government affair data dynamic authorization method and system based on a knowledge graph

Abstract

The application relates to the technical field of data sharing and information security, in particular to a government affair data dynamic authorization method and system combined with a knowledge graph, semantic level interoperation is realized through the knowledge graph, behavior anomaly sensing is realized through an isolated forest algorithm, both are deeply fused in an authorization decision link, and fine-grained and self-adaptive dynamic access control is realized. The application aims to overcome the shortcomings of the prior art, realize paradigm transformation from static and coarse-grained authorization to dynamic and fine-grained authorization by fusing the knowledge graph technology and the zero-trust security architecture, and provide technical support for efficient sharing and value release of government affair data under the premise of safety and controllability.

Description

Technical Field

[0001] This invention relates to the fields of data sharing and information security technology, specifically a dynamic authorization method and system for government data that combines knowledge graphs. It achieves semantic-level interoperability through knowledge graphs and detects abnormal behavior through the isolated forest algorithm. The two are deeply integrated in the authorization decision-making process to achieve fine-grained, adaptive dynamic access control. Background Technology

[0002] The core challenges currently facing government data sharing include the following common technical issues: 1. "Data Silos" and System Barriers – Information systems of government departments at all levels are mostly planned independently and built in a decentralized manner, forming "data silos" with different technical architectures and inconsistent data standards. The data collaboration and sharing mechanisms across levels, regions, systems, and departments are still incomplete, which seriously restricts the effective release of data value.

[0003] 2. Semantic Heterogeneity and Understanding Barriers – Due to the lack of unified data standards and semantic specifications, different systems use different naming conventions and format definitions for the same business concepts (such as "Unified Social Credit Code" and "Legal Representative"). Even if the data is physically exchangeable, it is difficult to understand and utilize it effectively, creating a dilemma of "data that can be seen but cannot be understood."

[0004] 3. Limitations of Static Coarse-grained Authorization Models – Traditional data authorization models are mostly static, coarse-grained role-based access control (RBAC), typically granting overall authorization based on user roles or departments, failing to specify data fields, business scenarios, or intended uses. This "one-size-fits-all" authorization approach either leads to over-authorization, resulting in security risks, or under-authorization, hindering business innovation.

[0005] 4. Data Dynamism and Policy Lag – Government data is inherently dynamic; its content, sensitivity level, and relationships change over time, with evolving policies and business processes. Static authorization policies cannot adapt to this dynamic need and struggle to achieve the security goal of "the right person, at the right time, in the right way, accessing the right data."

[0006] 5. Disconnect between anomaly detection and authorization decision-making – While existing dynamic authorization systems incorporate behavioral analysis, they often rely on rule-based or simple statistical methods (such as threshold judgment and frequency statistics), making it difficult to identify complex, covert attack patterns (such as slow, low-frequency data probing and inference attacks based on cross-departmental data). The lack of deep integration between anomaly detection results and the authorization decision engine leads to a delayed "detection-decision" response, preventing the formation of a real-time protection loop. Summary of the Invention

[0007] Government data sharing is evolving from "physical aggregation" to "logical aggregation + intelligent services," from "static authorization" to "dynamic authorization," and from "data management" to "knowledge operation." There is an urgent need for a new method that can break down data barriers, understand data semantics, and implement refined and adaptive authorization based on dynamic context. The purpose of this invention is to overcome the shortcomings of existing technologies and provide a dynamic authorization method and system for government data based on knowledge graphs. By integrating knowledge graph technology with a zero-trust security architecture, it achieves a paradigm shift from static, coarse-grained authorization to dynamic, fine-grained authorization, providing technical support for the efficient sharing and value release of government data under secure and controllable conditions.

[0008] The following technical solution is adopted to solve the existing technical problems: A dynamic authorization method for government data that combines knowledge graphs includes the following steps: S101. Construct a multi-level government knowledge graph: Construct a government knowledge graph that includes an entity graph, a relation graph, and a rule graph. The rule graph is used to store computable authorization policies in the form of RDF triples. S102. Registering Data Resources and Access Subjects: Registering government data resources to the knowledge graph at the field level and marking them with static sensitivity levels; establishing multi-dimensional profiles of access subjects; S103. Receive data access request: Receive a data access request containing business intent and context; S104. Semantic parsing, reasoning and dynamic evaluation: Use NLP technology to parse business intent and locate data resources in the graph; collect subject behavior, object attributes and environmental attributes, construct a 7-dimensional feature vector including access time interval, hourly access frequency, number of query fields, business path deviation, departmental relevance, data lineage depth and cross-domain query breadth, and input it into the isolated forest model to calculate the anomaly score; S105. Execute dynamic authorization decision: Adjust the effective sensitivity level of the data based on the abnormal score, perform strategy reasoning in combination with the rule graph, and generate a decision result of allow, deny, downgrade or require approval; S106. Proxy Access and Security Audit: Perform field-level data masking and access control through the proxy gateway, and record the complete decision-making reasoning path to the audit graph.

[0009] A dynamic authorization system for government data that incorporates knowledge graphs includes: The knowledge graph construction module is used to construct and maintain the entity graph, relation graph, and rule graph. The resource registration management module is used to manage the registration information of data resources and access subjects; The semantic parsing and anomaly detection module is used to parse business intent, construct feature vectors, and run the isolated forest model. A dynamic authorization decision engine is used to evaluate attribute confidence, inference strategies, and generate authorization tokens; Access proxy gateways are used to perform fine-grained access control and data anonymization; The security audit center is used to record audit logs and build audit knowledge subgraphs.

[0010] The beneficial effects of this invention, by combining knowledge graphs with dynamic authorization, are as follows compared to existing technologies: (1) Break down semantic barriers and realize intelligent data discovery. By using knowledge graphs to achieve semantic-level association of cross-system data, the problem of "data can be seen but cannot be understood" can be solved. Data users can use natural language to describe business needs, and the system can automatically locate relevant data resources, which greatly reduces the threshold for data discovery.

[0011] Ontology alignment algorithms are used to map heterogeneous fields from different departments to a unified ontology concept; graph traversal algorithms (such as BFS / DFS) are used to automatically discover implicit related data. After the user inputs natural language, the system converts it into Cypher / Gremlin query statements, performs multi-hop queries in the graph, and directly returns the related dataset, rather than a simple list of keyword matches.

[0012] (2) Precise authorization control, balancing security and efficiency. Based on the dynamic authorization model of multi-dimensional attributes, it ensures that "the right person, in the right scenario, in the right way, accesses the right data", realizing fine-grained permission control at the field level and scenario level, which not only prevents the risk of over-authorization, but also avoids the business being hindered by insufficient authorization.

[0013] The system calculates confidence score vectors for the subject, object, and environment in real time and inputs them into the policy solver. It dynamically generates SQL rewrite instructions containing row filtering conditions and column masking rules, which are then sent to the proxy gateway for execution. This process ensures that permissions are accurate to the field level and adjusted within milliseconds as the environment changes.

[0014] (3) Empower business collaboration and improve service efficiency. Through business-level penetration, complex cross-departmental business needs are automatically transformed into precise data authorization instructions. Taking "one-stop business establishment" as an example, the system automatically identifies the data dependencies between departments such as market supervision, public security, taxation, and human resources and social security, and realizes "one-time application, intelligent authorization, and parallel approval".

[0015] The system pre-defines "business scenario templates" (such as business establishment) within the graph, defining the minimum dataset subgraph required for each scenario. When a request matches this scenario, the system automatically activates access permissions for all nodes in the subgraph, eliminating the need for individual requests. Through a subgraph matching algorithm, the system automatically identifies and retrieves cross-departmental dependent data, achieving "one-time application, full transparency."

[0016] (4) Dynamic security protection, adapting to complex environments, continuous trust assessment and strategy governance mechanism, able to adapt to dynamic changes in government data and operating environment, real-time perception and response to abnormal access behavior, providing proactive and adaptive security protection capabilities.

[0017] Deploy streaming computing engines (such as Flink) to monitor environmental attribute streams in real time. Once a risk indicator (such as login from a different location or outside of working hours) exceeds the threshold, immediately trigger policy recalculation, dynamically downgrade token permissions, or enforce secondary authentication. Combined with dynamic data masking operators, ensure that data is "usable but not visible" in high-risk environments.

[0018] (5) Full traceability and compliance requirements: A complete knowledge traceability audit mechanism records the reasoning logic of authorization decisions and the knowledge link of data access, providing traceable and auditable technical guarantees for the security and compliance of government data sharing.

[0019] The reasoning path, rule nodes hit, and attribute snapshots used for each authorization decision are serialized and written into the audit graph. Supervisors can then use graph query language to trace the complete lifecycle of any data record and the decision-making basis of all visitors, achieving causal-level compliance auditing. Attached Figure Description

[0020] Figure 1 This is a flowchart illustrating the dynamic authorization method for government data based on knowledge graphs according to the present invention. Detailed Implementation

[0021] The technical solution of this case will be further explained with reference to the accompanying drawings: A dynamic authorization method for government data that combines knowledge graphs includes the following steps: S101. Constructing a multi-layered government knowledge graph: Construct a government knowledge graph that includes an entity graph, a relationship graph, and a rule graph. The rule graph is used to store computable authorization policies in the form of RDF triples. S102. Registered Data Resources and Access Subjects: Register government data resources to the knowledge graph at the field level and label them with static sensitivity levels; establish multi-dimensional profiles of access subjects; S103. Receive data access request: Receive data access requests that include business intent and context. S104. Semantic parsing, reasoning, and dynamic evaluation: NLP technology is used to analyze business intent and locate data resources in the graph; subject behavior, object attributes and environmental attributes are collected to construct a 7-dimensional feature vector including access time interval, hourly access frequency, number of query fields, business path deviation, departmental correlation, data lineage depth and cross-domain query breadth, and input into the isolated forest model to calculate the anomaly score; S105. Implement dynamic authorization decisions: Adjust the effective sensitivity level of the data based on the abnormal scores, and perform strategy reasoning in conjunction with the rule graph to generate decision results such as allow, deny, downgrade, or require approval. S106. Proxy Access and Security Audit: The proxy gateway performs field-level data masking and access control, and records the complete decision-making reasoning path to the audit graph.

[0022] The rule graph mentioned in step S101 is divided into a strategy ontology, rule encoding, and conflict detection. The strategy ontology is divided into defined strategy classes, condition classes, action classes, subject constraint classes, object constraint classes, and environment constraint classes. A hierarchical inheritance structure of the strategy is established, and through the predefined strategy ontology, the natural language authorization strategy is encoded into a machine-reasonable triple structure, and it supports semantic query and automatic policy conflict detection based on SPARQL.

[0023] The business path deviation, departmental correlation, and data lineage depth mentioned in step S104 are calculated by querying the relationship graph.

[0024] The isolated forest model described in step S104 adopts a streaming update mechanism and maps the detected abnormal events and feature vectors to the knowledge graph in real time, storing and associating them as new graph nodes.

[0025] In step S104, the abnormal events and feature vectors are mapped to the knowledge graph in real time. An entity linking algorithm is used to map the identified abnormal events and feature vectors to standard nodes in the knowledge graph. Score link (e text ,v kg )=α⋅Sim vector (e text ,v kg )+β⋅Sim string (e text ,v kg )+γ⋅Sim context (e text,v kg ) Entities are either abnormal events or feature vectors e. text Knowledge graph candidate node v kg Vector similarity weight α, string similarity weight β, context similarity weight γ, α+β+γ=1, vector similarity is also semantic similarity Sim. vector (e text ,v kg ), string similarity is also known as literal similarity (Sim). string (e text ,v kg ), Contextual similarity, also known as Sentence Similarity (Sim) context (e text ,v kg Sim vector (e text ,v kg Sim string (e text ,v kg Sim context (e text ,v kg The value range is [0,1]; based on the linked entity nodes, a graph traversal algorithm is used to generate a query subgraph.

[0026] The specific calculation formula for adjusting the effective sensitivity level of the data in step S104 is: L effective =L static ×F scene ×F subject ×F time ×F anomaly L effective For effective sensitivity levels, L static For static sensitivity level, F scene F is the scene adjustment factor. subject As the main trust factor, F time F is the timeliness adjustment factor. anomaly The dynamic adjustment factor is calculated based on the anomaly score; the input is the isolated forest model, which calculates the anomaly score, and the anomaly score is correlated with the dynamic adjustment factor F. anomaly The value association is as follows: the specific value logic is: when the anomaly score is... IF When F <0.3 anomaly If the value is 1.0, the sensitivity level is normally not adjusted; when 0.3 ≤ Anomaly IF <0.6 F anomaly Taking 1.2 increases the sensitivity level by 20%; when 0.6 ≤ Anomaly IF <0.8 F anomalyTaking 1.5 increases the sensitivity level by 50%; when Anomaly IF F ≥0.8 anomaly Take infinity to trigger direct rejection.

[0027] Step S104 also includes calculating the overall confidence level. For the Sigmoid function, W sub As the main weight, W obj For object weight, W env For environmental weights, W ano For abnormal weights, W sub +W obj +W env +W ano =1; i The network environment, spatiotemporal rationality, equipment compliance, and geographical location are scored, with scores ranging from [0,1]. i The four indicators—network environment, spatiotemporal rationality, equipment compliance, and geographical location—are weighted, and the sum of the weighted values ​​of the four indicators is 1. S sub =w1·Auth MFA + w2·(1-Anomaly beℎ )+ w3·sim MFA Auth MFA Anomaly provides a multi-factor authentication strength score for identity verification. beℎ For users, the outlier score of the Isolation Forest algorithm, sim MFA Cosine similarity of job data; w 1、 w2 and w3 are weighted values, w 1+ w 2+ w 3=1。

[0028] In step S6, the proxy gateway dynamically rewrites the original SQL query by parsing the permission mask in the security token, returning only the authorized data rows and columns, and applying different de-identification operators according to the real-time risk level.

[0029] A dynamic authorization system for government data that incorporates knowledge graphs includes: The knowledge graph construction module is used to construct and maintain the entity graph, relation graph, and rule graph. The resource registration management module is used to manage the registration information of data resources and access subjects; The semantic parsing and anomaly detection module is used to parse business intent, construct feature vectors, and run the isolated forest model. A dynamic authorization decision engine is used to evaluate attribute confidence, inference strategies, and generate authorization tokens; Access proxy gateways are used to perform fine-grained access control and data anonymization; The security audit center is used to record audit logs and build audit knowledge subgraphs. The knowledge graph construction module, resource registration management module, semantic parsing and anomaly detection module, and dynamic authorization decision engine are connected to the security audit center through the access proxy gateway network. The security audit center implements data and log recording for the database.

[0030] The dynamic authorization decision engine adopts a streaming computing architecture, processes attribute streams in real time through Apache Flink, and interacts with the graph database to achieve millisecond-level decisions; the access proxy gateway is deployed in Sidecar mode, with a built-in SQL parser, which can dynamically rewrite query statements and inject row-level filtering conditions according to token permissions.

[0031] The existing technology analysis CN202111179865.5 (Precise Authorization Method for Privacy Data in Government Data Sharing) proposes a precise authorization mechanism based on digital passes and CA authentication, which realizes single-use, genuine authorization for the use of personal privacy data through the SM2 / SM3 / SM4 national cryptographic algorithms. The advantages of this method are: (1) ensuring genuine authorization from the user for each use of data; and (2) ensuring data security during the transfer process based on cryptographic technology.

[0032] Differences and innovations from this case: (1) Differences in application scenarios: Existing technologies focus on single-time authorization scenarios initiated by users for personal privacy data, which are passive and reactive authorizations; this case, on the other hand, targets proactive and predictive authorization in cross-departmental government collaboration, solving the problem of automated authorization in complex business scenarios. This case introduces a dual-engine mechanism of "Isolation Forest Algorithm + Graph Reasoning", which not only relies on credential verification, but also calculates the semantic distance between the subject and the object in real time through the knowledge graph, while using the isolation forest to detect behavioral anomalies, realizing a paradigm shift from "credential verification" to "contextual reasoning + anomaly perception".

[0033] (2) Differences in technical architecture: Existing technologies adopt a centralized trust model of "digital pass + CA authentication", which relies on pre-established trust relationships; this case adopts a zero-trust architecture, which continuously monitors the deviation of behavioral baseline through isolated forests and combines knowledge graphs to achieve continuous verification and dynamic evaluation without the need to pre-establish long-term trust relationships.

[0034] (3) Differences in decision-making mechanisms: Existing technologies rely on rigid authorization based on cryptographic verification (either allow or deny), lacking an understanding of business semantics; this case introduces joint decision-making based on knowledge graph reasoning and isolated forest anomaly scoring to achieve intelligent authorization decision-making based on business intent and behavioral credibility, supporting flexible strategies such as conditional authorization, downgraded authorization, and dynamic blocking.

[0035] (4) Dynamic differences: Existing technology's authorization credentials (digital passes) have a fixed validity period and cannot be adjusted in real time according to environmental changes; this case realizes dynamic lifecycle management of authorization tokens, and the abnormal scores output by the isolated forest in real time directly drive the dynamic adjustment or revocation of permissions. "Government Data Sharing Model Based on Knowledge Graph Information Penetration" (Ye Nanjun, 2025) This study proposes a knowledge graph-driven government data sharing framework, which realizes semantic interoperability through multi-level information penetration at the field level, system level, and business level, and constructs a three-layer architecture of "data-graph-service".

[0036] The differences and innovations of this case: (1) Differences in functional positioning: Existing technologies focus on data discovery and sharing models to solve the problem of "finding data"; this case focuses on the authorization decision mechanism to solve the core security problems of "whether data can be accessed" and "how to access it", upgrades the knowledge graph from a data catalog to an infrastructure for authorization decision, and introduces the isolated forest algorithm to enhance the ability to detect abnormal behavior.

[0037] (2) Differences in security integration: Existing technologies lack deep integration with zero-trust security architecture and have not formed a security closed loop of "never trusting and continuous verification"; This case deeply integrates knowledge graph with ABAC (attribute-based access control) model and innovatively embeds isolated forest anomaly detection into the attribute evaluation process to achieve the synergy of knowledge-based expression, reasoning and anomaly perception of security policies.

[0038] (3) Differences in authorization granularity: Existing technologies are limited to data resource-level shared control and do not achieve fine-grained authorization at the field and scenario levels; this case achieves precise authorization at the data item level through rule graphs, and the isolated forest supports fine-grained behavioral feature analysis (such as field-level access sequence anomalies) and supports dynamic permission combinations based on business scenarios.

[0039] (4) Differences in technical implementation: Existing knowledge graphs are mainly used for metadata management and semantic mapping, and belong to static knowledge bases; the rule graph in this case supports computable policy rules, and the parameters of the isolated forest model and the detection results are dynamically integrated into the graph in real time as knowledge, realizing automatic reasoning, anomaly detection and dynamic matching of policies. "Data Dynamic Authorization System Based on Zero Trust" (Zhang Zezhou, 2022) This study proposed a dynamic authorization approach under the zero trust architecture, emphasizing "trustworthy subject identity, dynamic compliance of business access, security protection of object resources, and continuous trust assessment".

[0040] Differences and innovations from this case: (1) Domain-specific differences: Existing technologies focus on enterprise data security scenarios and access control for internal employees and external partners, lacking consideration for the special characteristics of the government data domain (such as cross-departmental collaboration, statutory responsibilities, data sovereignty, etc.); This case is specifically designed for government data sharing scenarios, introducing government business knowledge modeling and statutory authorization rules, and the isolated forest algorithm optimizes feature engineering for government scenarios (such as departmental collaboration network features and business process timing features).

[0041] (2) Semantic understanding differences: Existing dynamic authorization technologies are based on network layer and system layer attributes (identity, device, location, etc.), lacking understanding of business semantics; This case realizes semantic parsing of business intent through knowledge graph, and Isolation Forest performs anomaly detection on semantic subgraph (such as detecting data access paths that do not match the business scenario), transforming the business requirements described in natural language into precise data authorization instructions.

[0042] (3) Differences in knowledge integration: Existing technologies are not combined with knowledge graph technology, and cannot realize reasoning authorization based on data lineage and business association; This case uses relationship graphs to support data lineage tracing and impact analysis, and Isolation Forest uses graph topology features to enhance detection capabilities (such as identifying cross-departmental abnormal association queries), realizing intelligent authorization of "knowledge-driven + algorithm perception".

[0043] (4) Differences in policy expression: Existing technologies use traditional policy rule expressions, which are difficult to handle complex authorization conditions in the government domain; This case uses an ontological rule graph to realize the structured and reasonable expression of policies, and the output of the isolated forest is used as dynamic policy conditions (such as triggering downgrade authorization when Anomaly_Score>0.7), which supports policy inheritance, conflict detection and consistency verification.

[0044] Limitations of Isolation Forest Algorithm in Access Control The Isolation Forest algorithm, proposed by Liu et al. in 2008, detects outliers by randomly partitioning the feature space. It boasts advantages such as linear time complexity O(n log psi), no need for labeled data, and robustness to high-dimensional data, and is widely used in fields such as financial fraud detection and network intrusion detection. However, existing applications have the following limitations: (1) Feature engineering is disconnected from business semantics: Traditional isolated forests only rely on statistical features (such as access frequency and data volume) for detection, lacking an understanding of government business semantics, making it difficult to identify "legal but abnormal" business behaviors (such as market regulators querying social security data that is unrelated to their business).

[0045] (2) Separation of detection results from authorization decision: The existing solution treats isolated forest as an independent module, and the detection results are only used for alarms. It is not deeply integrated with the authorization engine and cannot achieve real-time response of "detection is decision".

[0046] (3) Lagging model updates and knowledge accumulation: Isolation forest models are usually trained offline, making it difficult to adapt to the dynamic changes in the government environment, and the detection experience cannot be accumulated into reusable knowledge.

[0047] This case innovates by deeply integrating the Isolation Forest algorithm with a knowledge graph to construct a graph-enhanced Isolation Forest with a dual-engine approach of "algorithm perception and knowledge reasoning": It leverages the knowledge graph to provide business semantic features (such as business path length and departmental relevance) to improve the accuracy of anomaly detection; it employs algorithm-driven knowledge updates: the Isolation Forest detection results (abnormal patterns, risky entities) are fed back to the knowledge graph in real time, forming a closed loop of "detection-learning-accumulation"; and it utilizes a joint decision-making mechanism: the anomaly score output by the Isolation Forest serves as the core attribute for dynamic authorization, jointly deciding with the knowledge graph reasoning results to achieve a "millisecond-level detection-decision" response.

[0048] The following is a further explanation using specific implementation examples: Step S101: Construct a multi-level government knowledge graph Through knowledge extraction, ontology modeling, and knowledge fusion techniques, a semantic hub comprising three types of sub-graphs is constructed: Entity Map: Describes the core entities in the government affairs field, including people (natural persons, legal persons), places (administrative divisions, geographical locations), things (licenses, assets), organizations (government departments, enterprises and institutions), and events (business matters, processing procedures), etc. Relationship graph: Reveals the complex relationships between entities and data, including business associations (precedence and subsequent relationships, dependencies), data lineage (data source, flow path, processing process), semantic mapping (synonymous fields, equivalent concepts), etc. Rule Graph: Stores and manages computable data hierarchical classification standards, sharing attributes, authorization conditions, security policies, compliance requirements, and other rule knowledge. Unlike static rule bases in conventional technologies, the rule graph in this case adopts an ontology-based design, expressing authorization policies as a reasonable knowledge graph structure: Strategy ontology design: Define ontology concepts such as Policy, Condition, Action, SubjectConstraint, ObjectConstraint, and EnvironmentConstraint, and establish a hierarchical inheritance structure for strategies; Rule encoding method: Natural language policies (such as "In the scenario of starting a business, staff of the market supervision bureau can obtain the tax credit rating of the tax bureau, but cannot obtain the specific amount of tax paid") are encoded into RDF triples to support automatic reasoning based on SPARQL. Conflict detection mechanism: Utilizing the semantic consistency verification capability of the graph, it automatically detects logical conflicts between policy rules (such as a data item being simultaneously marked as "unconditionally shared" and "not shared"), and provides conflict resolution suggestions.

[0049] The innovation of this step does not lie in the formulation of universal classification standards, such as the Data Security Law which stipulates the construction of a fine-grained classification model based on a three-dimensional vector of "business scenario - data sensitivity - risk level".

[0050] Limitations of existing technology: It typically performs static classification based solely on the data content itself (e.g., "ID number = level 4"), ignoring the context.

[0051] The innovative detail of this step is that a dynamic weight vector is defined for each data node in the rule graph. in, For the inherent sense of content, For scenario-sensitive coefficients (e.g., in the "disease prevention and control" scenario, the sensitivity of trajectory data is reduced to facilitate sharing), This is the real-time risk value.

[0052] Technical advantages: This fine-grained classification detail enables the system to distinguish "different security levels of the same field in different scenarios", achieving more accurate context-aware classification than existing technologies, rather than rigid static labels.

[0053] Step S102: Register data resources and access subjects Each data provider (government department) registers its data resources in the form of metadata with the knowledge graph platform, including: (1) Data Resource Catalog Data name, summary, data item structure (accurate to the field level), update frequency, quality status, and data ownership (clearly defining data ownership and management responsibilities).

[0054] (2) Classification and grading labels In accordance with the Data Security Law and industry standards, data sensitivity levels (1-4) are labeled, and a link is established between these levels and the rule graph. The innovation of this case lies in not only labeling static levels but also defining dynamic leveling rules—the same data item may have different effective sensitivity levels in different business scenarios, time periods, and access subjects. For example, "corporate tax payment amount" is level 4 (not shared) in a normal scenario, level 2 (conditionally shared) in a tax audit scenario, and may be temporarily adjusted to level 3 (shared after approval) in an emergency.

[0055] (3) Sharing strategy rules The criteria for unconditional sharing, conditional sharing, and non-sharing are structured and bound to the corresponding nodes in the rule graph. This case adopts a registration model of strategy templates + instantiation parameters: common strategy templates are predefined (such as "mutual recognition template between peer departments", "transfer template between superiors and subordinates", and "cross-domain collaboration template"). Specific data resources only need to reference the template and fill in the parameters (such as the list of applicable departments, effective time period, and special restrictions), which greatly reduces the complexity of strategy configuration while ensuring the consistency and maintainability of strategy expression.

[0056] (4) Registration of subject portrait Establish multi-dimensional profiles for all potential data users, including: static attributes: department attributes, job responsibilities, security level, and legal scope of responsibilities; dynamic attributes: historical behavior patterns, credit scores, current workload, and skill certification status; and related attributes: organizational structure, collaborative relationship network, and historical data usage records.

[0057] The main profile is stored in the form of graph nodes and is associated with organizational entities and personnel entities in the entity graph. It supports authorization reasoning based on organizational relationships and social networks (such as "a user's department leader has been approved to access certain data, and the user can apply for temporary authorization due to business collaboration needs").

[0058] This step is not a simple directory registration, but rather a mapping of traditional relational database metadata to graph ontology instances.

[0059] The essence of the innovation: Existing technologies mostly use flat tagging systems for classification, which can only perform exact matches during queries. This case registers data resources as "nodes" in a graph, and shared policies as "directed edges" between nodes, assigning edge attributes (e.g., hasAccessCondition, requiresApprovalLevel). This graph-structured policy storage method allows subsequent steps to instantly calculate complex authorization paths across multiple levels and departments using graph traversal algorithms, solving the problems of low query efficiency and weak logical expression capabilities of traditional tagging systems under complex nested rules. The innovation here lies in the graph-structured isomorphic storage of data and policies, rather than the classification rules themselves.

[0060] Step S103: Receive data access request When data users need cross-departmental data to complete a business task, they submit a request through the unified service portal. The request information includes: a description of the business intent: using natural language to describe the required data and its purpose; and contextual information: visitor identity, device fingerprint, geolocation, current business scenario, timestamp, etc. Step S104: Semantic parsing, isolated forest anomaly detection and dynamic evaluation Upon receiving the request, the authorization decision center performs the following processing: Semantic parsing and graph query: Utilize NLP technology to parse business intent, identify key entities and relationships, perform queries and reasoning in the knowledge graph, and accurately locate all relevant data resources and their lineages that meet the requirements.

[0061] a) Semantic parsing and graph query: By leveraging NLP technology to analyze business intent, identify key entities and relationships, and perform queries and reasoning within a knowledge graph, we can accurately locate all relevant data resources and their lineages that meet the requirements.

[0062] Natural Language Preprocessing and Entity Recognition 1. Text preprocessing module Input: User request text (e.g., "Query the comprehensive credit information of a newly established enterprise for use in the parallel approval process for enterprise establishment") Processing: Use the Jieba word segmentation tool to segment Chinese words, remove stop words, and perform part-of-speech tagging. Output: Word segmentation sequence ["query", "newly established enterprise", "comprehensive credit information", "enterprise establishment", "parallel approval"] 2. Entity Recognition (Implementation using BERT-BiLSTM-CRF Model) Model architecture implementation details: BERT encoding layer: Employs a BERT-based-Chinese pre-trained model to encode the input text into a 768-dimensional vector; BiLSTM feature extraction: A bidirectional long short-term memory network with 256 hidden layers extracts contextual features; CRF decoding layer: Conditional random field constrains label transfer, outputting a standard BIO labeled sequence. Output example: Entity "Newly Established Company" → Type: Corporate Entity (ENT-COMPANY) Entity "Comprehensive Credit Status" → Type: Data Requirement (DATA-CREDIT) Entity "Business Establishment" → Type: Business Scenario (SCENE-REGISTRATION).

[0063] Entity Links and Graph Mapping Technical Implementation: Entity Linking Algorithm The identified entities are mapped to standard nodes in the knowledge graph using an entity linking algorithm: Threshold determination and operation: like >0.85: Automatically link to the corresponding graph node; If 0.70 ≤ ≤0.85: Push the candidate list for manual confirmation; like <0.70: Marked as a new entity, triggering the knowledge graph update process; Subgraph query generation and execution Technical Implementation: Query Subgraph Generation Based on linked entity nodes, a query subgraph is generated using a graph traversal algorithm: Multi-hop relationship lookup (using Neo4j Cypher as an example): Query result processing: Return a collection of data nodes Return the set of relational paths Construct query subgraph ; b) Anomaly detection and real-time assessment of multidimensional attributes in isolated forests: The system collects and calculates confidence scores for three types of dynamic attributes (subject attributes, object attributes, and environmental attributes) as input variables for authorization decisions. Subject attributes: Identity Authenticity: Based on the results of Multi-Factor Authentication (MFA), the value ranges from 0 to 1 (e.g., password only = 0.6, password + biometrics = 0.95).

[0064] Behavioral baseline deviation: Compare the user's historical access patterns (time, frequency, data volume) to calculate the anomaly score of the current request. If the deviation exceeds the threshold T1, the subject's credibility score is reduced.

[0065] Job permission coverage: Calculate the cosine similarity between the requested data field and the job description vector.

[0066] Object attributes: Dynamic sensitivity level calculation: In addition to reading static sensitivity labels, it also calculates the dynamic validity level based on the current business scenario, access subject attributes, and data timeliness. The calculation formula is: Where L effective For static grading, F scene F is the scenario adjustment factor (e.g., 0.5 in an emergency). subject The main trust factor (0.8 for high-credit subjects), F time This is a timeliness adjustment factor (overdue data will be downgraded). Business Domain: Determine whether the target data belongs to the relevant domain of the current business scenario. Calculate the business distance (shortest path length) through the relationship graph. The greater the distance, the stricter the authorization. Data Tag Matching: Check the matching between the special protection tags of the data (such as "personal privacy", "trade secret", "national security") and the subject's permission tags. Special Protection Status: Check whether the data is under special protection (such as during audit or case investigation). Under such status, the data is rejected by default or requires special approval.

[0067] Environment attributes: Network environment rating: Internal dedicated line = 1.0, VPDN = 0.8, Public Internet = 0.3 (High-sensitivity data is directly rejected).

[0068] Spatiotemporal rationality: Verify the distance between the access location's GPS and the user's administrative region, and verify whether the access time falls within legal working hours or approved overtime hours.

[0069] Device fingerprint compliance: Detects whether the terminal has EDR installed and whether it is jailbroken / rooted, and outputs a binary compliance flag. Computation (Isolation Forest Algorithm Implementation): After obtaining basic information about the user's request, the system initiates the isolated forest anomaly detection process, calculates the degree of anomaly in the user's behavior in real time, and combines it with the business semantic features provided by the knowledge graph to achieve accurate anomaly perception.

[0070] Isolation Forest Algorithm Principle Isolation Forest is an unsupervised anomaly detection algorithm based on random partitioning. Its core idea is that anomalous data points are sparse in the feature space, making them easier to isolate by random partitioning.

[0071] Algorithm implementation: Construct multiple random binary trees (iTree), each constructed in the following manner: 1. Randomly select a feature dimension; 2. Randomly select a split value between the minimum and maximum values ​​of this feature; 3. Divide the data into left and right subtrees, and recursively process until a data point is isolated or the tree height limit is reached.

[0072] For data point x, its outlier score is defined as: in: x is the average path length across all iTrees. Subsampling size (typically 256) Given The average path length at that time is calculated using the following formula: in As the harmonic number, it can be estimated as .

[0073] Interpretation of outlier scores: : Anomalies (short path length) Normal point (long path length) Unable to make a clear judgment Knowledge Graph Enhanced Isolated Forest Feature Engineering (Core Innovation of this Case) Traditional isolated forests rely solely on statistical features (access frequency, data volume) for detection, making it difficult to identify "legitimate but abnormal" behaviors in government service scenarios (such as abnormal data access within authorized limits). This case innovatively utilizes knowledge graphs to provide business semantic features, constructing a 7-dimensional feature vector specifically for government service scenarios: Real-time evaluation of multidimensional attributes Based on the anomaly scores of the isolated forest, the system calculates the confidence scores for four types of dynamic attributes: Subject attribute assessment Calculation formula that can be implemented: Feasibility details of each item's calculation: Object attributes : Key innovations: (Abnormal risk adjustment factor), based on Dynamic adjustment: Environmental attributes : The evaluation criteria include four indicators: network environment (0.30), spatiotemporal rationality (0.25), equipment compliance (0.25), and geographical location (0.20).

[0074] Overall confidence level calculation: in For the Sigmoid function, .

[0075] Feasible collection and calculation of environmental indicators: S104 Step Output: Real-time evaluation pipeline architecture Technical Implementation: Streaming computing architecture, employing the following technology stack to ensure real-time performance: Data processing flow: 1. Request access → Kafka Topic(access.requests) 2. Parallel processing of Flink jobs: Window 1 (0-50ms): Semantic parsing and entity recognition; Window 2 (50-100ms): Attribute acquisition and score calculation; Window 3 (100-150ms): Decision input assembly and output. 3. Output to the decision engine (step S105) Step S105: Execute dynamic authorization decision The attribute-based access control (ABAC) engine performs matching reasoning between the above evaluation results and the policies in the rule graph: Example of policy rule: "In the 'One-Stop Business Registration' scenario, market supervision bureau staff can obtain a company's tax credit rating (not detailed data) from the tax bureau, but cannot obtain the specific tax amount; access is allowed during working hours, within the intranet environment, and on compliant equipment; otherwise, it will be denied or downgraded." Decision generation: Based on the matching results, make decisions such as "allow," "deny," "downgrade," and "requires approval," and generate a temporary security token that includes specific access scope (limited to the field level), validity period, and usage constraints. This step, based on the multidimensional attribute evaluation results output from step S104, especially the isolated forest anomaly score, performs matching reasoning with the policies in the rule graph to achieve dynamic authorization decision driven by the anomaly score.

[0076] Strategy primitive definition The system has a pre-built atomic rule base that supports conditional judgments for merging abnormal scores: Abnormal score-driven policy adjustment mechanism Security token generation Step S106: Proxy Access and Security Audit Data users access the data access proxy gateway using a security token: Fine-grained access control: The proxy gateway parses the permission scope in the token to ensure that users can only access the specific data fields that are authorized.

[0077] Technical Implementation: The proxy gateway has a built-in SQL parser (such as Calcite or Druid) that intercepts raw SQL requests. Based on the permission mask in the token, the SQL statement is dynamically rewritten.

[0078] Superior to conventional methods: Traditional gateways can only perform table-level interception. This solution enables dynamic injection at the 'SELECT name, masked_id_card FROM table WHERE region='X' level, ensuring that the underlying database only returns authorized rows and columns, thus preventing unauthorized access at the source.

[0079] Dynamic data anonymization: Based on data sensitivity levels and user permissions, the returned data is anonymized in real time (e.g., ID number masking, amount range filtering, etc.). Technical Implementation: A streaming data processing pipeline is used. Based on the Desensitization_Rule_ID carried in the token, the corresponding desensitization operator (such as hashing, truncation, generalization, and differential privacy noise addition) is invoked.

[0080] Superior to conventional methods: Conventional techniques use static anonymization (anonymization occurs immediately upon data entry), leading to a loss of data usability. This case determines the anonymization strength based on the requester's real-time role and scenario (e.g., doctors see the patient's full name, researchers see the anonymized ID), achieving "one data, multiple uses."

[0081] Full-process audit logs: Record the authorization decision-making process (reasoning path, decision basis), data access behavior (visitor, access content, access time), and graph query logs, forming a complete knowledge traceability chain. Technical implementation: Utilize blockchain or tamper-proof log technology to record Request_Context + Graph_Traversal_Path (graph inference path) + Decision_Log.

[0082] Superior to conventional methods: Traditional audits only record "who checked what". This case additionally records "why the check was allowed" (i.e., the specific reasoning path and rule node IDs matched in the graph), supporting the ability to quickly locate policy vulnerabilities or the root cause of violations by reversing the graph after the fact.

[0083] This invention also provides a knowledge graph-based dynamic authorization system for government data, comprising the following core modules: Knowledge graph construction module: responsible for extracting metadata and business rules from various departmental business systems, extracting, cleaning, disambiguating, and aligning knowledge through ETL tools, API interfaces, etc., and building and maintaining entity graphs, relationship graphs, and rule graphs.

[0084] Resource registration and management module: Provides functions such as data resource catalog registration, classification and hierarchical labeling, sharing strategy configuration, subject identity registration, and attribute tag management.

[0085] Semantic parsing engine: Based on NLP technology, it realizes business intent understanding, entity recognition, and relation extraction, and supports the conversion from natural language query to graph query.

[0086] Dynamic authorization decision engine: The core ABAC engine enables multi-dimensional attribute collection, policy rule matching, trust assessment calculation, and security token generation.

[0087] Access proxy gateway: performs fine-grained access control, data masking, traffic monitoring, and anomaly detection.

[0088] Security Audit Center: Records full-process operation logs and provides capabilities for knowledge tracing, compliance auditing, risk analysis, and post-event accountability.

[0089] The core innovation of this system lies in the deep coupling architecture between the "graph inference engine" and the "zero-trust evaluation engine," rather than a simple stacking of modules: Knowledge graph construction module (data foundation): Employs an incremental graph update algorithm, monitors the Binlog of each business system, and synchronizes metadata changes to the graph database (such as Neo4j / Nebula Graph) in real time, ensuring consistency between the graph and the live network data with latency of less than seconds.

[0090] Semantic parsing engine (NLP+KG): Innovatively introduces graph embedding (such as TransE / RotatE) technology to map business terms into vector space, solve the problem of natural language ambiguity, and improve the accuracy of intent recognition.

[0091] Dynamic authorization decision engine (core brain): Combinational Logic: This engine integrates CEP (Complex Event Processing) and a graph inference engine. CEP is responsible for real-time monitoring of environmental attribute flows, while the graph inference engine is responsible for calculating data association paths.

[0092] Algorithm Integration: A graph neural network-based anomaly detection algorithm (GNN-Anomaly) is adopted to analyze the topological characteristics of access requests in the graph in real time during the decision-making process, and automatically identify potential covert attack paths (such as inference attacks through low-frequency correlation data).

[0093] Access Proxy Gateway (Execution Arm): Deployed based on Sidecar mode, it intercepts traffic non-intrusively. It has a built-in lightweight rule interpreter that directly parses the encrypted policy tokens issued by the decision engine, achieving policy activation within milliseconds.

[0094] Security Audit Center (Memory): Constructs an audit knowledge subgraph, instantiating each access behavior as a new node and edge in the graph, forming a queryable and reasonable chain of behavioral trajectories.

[0095] Key technological innovations Innovation Point 1: Deep Integration of Knowledge Graph and Dynamic Authorization. Unlike existing technologies that use knowledge graphs only for data discovery, this invention uses knowledge graphs as the core infrastructure for dynamic authorization decisions. It stores computable authorization strategies through a rule graph and supports data lineage tracing and impact analysis through a relationship graph, achieving "knowledge-driven" intelligent authorization.

[0096] Innovation Point 2: Semantic understanding-based business-level authorization breaks through the traditional authorization granularity based on data tables / fields. By parsing business intent through NLP, it automatically identifies the data resource combinations required for cross-departmental business scenarios (such as "business start-up" and "engineering construction project approval"), and achieves scenario-based batch and accurate authorization.

[0097] Innovation Point 3: Continuous Trust Assessment and Dynamic Tokens introduce the zero-trust concept of "never trusting, continuous verification," with security tokens possessing time-sensitive and context-bound characteristics. The authorization decision engine continuously monitors changes in the attributes of the subject, object, and environment, dynamically adjusting or revoking permissions to achieve adaptive security protection.

[0098] Innovation Point 4: Knowledge Traceability and Compliance Audit. The chain structure of the graph records the complete authorization decision reasoning path and data access knowledge link, supporting the reverse tracing from the data usage results to the original authorization basis, decision logic and responsible entity, thus meeting the compliance audit requirements of government data sharing.

[0099] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0100] Example 1: A Dynamic Authorization Method for Government Data Based on Knowledge Graphs Step S101: Construct a multi-level government knowledge graph Led by the data governance department and in collaboration with experts from various business departments, a unified ontology for the government affairs domain was jointly defined based on standards such as the "Guidelines for Classification and Grading of Government Data." Taking the "Business Establishment" business domain as an example: Entity Graph: Construct entity types such as "Enterprise", "Natural Person", "Business License", "Seal", "Tax Registration", and "Social Security Registration", and define the attributes of the entities (such as the unified social credit code, legal representative, registered capital, etc. of enterprises). Relationship graph: Establish relationships such as "enterprise-owns-business license", "enterprise-needs-tax registration", and "business license-issued by-market supervision bureau", and build a data lineage link (such as "unified social credit code" generated from the market supervision system and transferred to tax, human resources and social security and other departments). Rule graph: Defines data hierarchy (e.g., basic enterprise information is level 2, legal representative's ID number is level 4), sharing rules (e.g., tax credit rating can be shared with the market supervision bureau, but specific tax amount is not shared), and authorization policies (e.g., intranet access is allowed during working hours, while external network access requires additional approval).

[0101] Metadata, business rules, and sample data are extracted from the business systems of various departments using ETL tools. After cleaning, disambiguation, and alignment, a globally unified government knowledge graph is constructed.

[0102] Step S102: Register data resources and access subjects The market supervision bureau registered its "enterprise registration database" to the platform, labeling it with fields such as "enterprise name", "unified social credit code", "legal representative" and "registered capital", and classifying it into levels 2-4, with the sharing type being "conditional sharing"; The tax bureau registers its "tax credit database" and marks it with "tax credit rating" (level 2, which can be shared) and "annual tax amount" (level 4, which cannot be shared). A profile was created for Zhang, a staff member of the Enterprise Registration Section of the Market Supervision Bureau: Department - Market Supervision Bureau, Position - Enterprise Registration Auditor, Security Level - Level 3, Accessible Business Domains - Enterprise Establishment and Credit Verification.

[0103] Step S103: Receive data access request When Mr. Zhang was processing the "One-Stop Business Establishment" application, he submitted a request through the unified portal: "To query the comprehensive credit information of a newly established enterprise for use in the parallel approval process for business establishment." The system automatically collected the following information: Subject Attributes: Zhang's identity has been verified, and his job permissions include credit verification. The current security level is Level 3. Environmental characteristics: Working hours 9:30, intranet environment, equipment compliance. Business scenario: A company starts a business.

[0104] Step S104: Semantic parsing, reasoning, and dynamic evaluation a) Semantic parsing: The NLP engine identifies key entities such as "enterprise," "credit status," and "enterprise establishment," and associates them with the "enterprise credit evaluation" business scenario in the knowledge graph, automatically locating the required data resources: Market Supervision Bureau: Basic information of enterprises and information of legal representatives Tax Bureau: Tax Credit Rating Public Security Bureau: Seal Registration Information Human Resources and Social Security Bureau: Social Security Registration Status b) Dynamic assessment: Assess the access conditions of each data resource: Company Basic Information (Level 2): ​​Zhang (Level 3 ≥ Level 2, Access Allowed) Tax credit rating (Level 2): ​​The business scenario is reasonable, and access is permitted. Specific tax amount (Level 4): Access denied due to exceeding permissions.

[0105] a) Semantic parsing and subgraph mapping: Extracting entity E from the request using the BERT-BiLSTM-CRF model. req and Intention I reqThe entity linking algorithm is used to calculate E. req With the map ontology V onto Semantic similarity: in These are graph embedding vectors obtained through training using the TransR algorithm. If Then the natural language request is mapped to a graph query subgraph G. query .

[0106] b) Real-time evaluation of multidimensional attributes (quantitative calculation model) The system calculates three core score vectors as decision inputs: 1. Subject Trust Score Auth MFA Multifactor authentication strength (0~1).

[0107] Anomaly beh : Behavioral baseline deviation. Using the Isolation Forest algorithm, the anomaly score of the current request is calculated by comparing it with the user's historical access sequence.

[0108] Sim role : Request the cosine similarity between the data field vector and the job responsibility vector.

[0109] 2. Object dynamic sensitivity Call the model defined in step S101 to calculate the comprehensive sensitivity score (0~100) of the data at the current time. Dist biz The shortest path length between the subject and object in the business relationship graph. The longer the path (the weaker the business relationship), the higher the effective sensitivity and the more difficult the authorization.

[0110] 3. Environmental safety score Using a weighted product model, if any key environmental indicator (such as device root or remote login) fails to meet the standard ($I=0$), the total score will be 0, and the circuit breaker will be triggered directly.

[0111] Step S105: Execute dynamic authorization decision The strategy in the ABAC engine's matching rule graph is: "In the scenario of business establishment, market supervision bureau staff can obtain the tax bureau's tax credit rating, but cannot obtain the specific amount of tax paid." Decision result: Access is permitted to: basic company information, tax credit rating, seal registration status, and social security registration status. Access denied: Specific tax amount, complete ID number of the legal representative (provided after anonymization). Generate a security token: valid for 2 hours, restricts access to the above fields, and binds Zhang's identity and device fingerprint.

[0112] This case abandons hard-coded rules and uses a constraint satisfaction problem (CSP) solver to dynamically generate access control lists (ACLs).

[0113] Variable definition: Define decision variables ,in This represents the access permissions (allow / deny / de-identify) for the i-th field.

[0114] Constraint Construction: Extracting constraints related to the current scene G from the rule graph query Construct an instance set C from all connected policy edges. c1: If ,but c2: If Scene == Emergency, then c3: If ,but 3. Solution process: Call the SAT / CSP solver (such as MiniZinc or a custom backtracking algorithm) to find the solution space Xvalid that satisfies all constraints C.

[0115] 4. Token Generation: X valid Serialized into a JWT token, containing the specific SQL rewrite instructions and the de-identification operator ID.

[0116] Innovation: It proves that the system has full-scene adaptive capability and can handle infinite combinations of dynamic constraints, rather than a limited number of predefined rules.

[0117] Step S106: Proxy Access and Security Audit Mr. Zhang accesses data through a proxy gateway using a token: The proxy gateway verifies the validity of the token, parses the scope of permissions, initiates data calls to the systems of various source departments, obtains the authorization fields, de-identifies the legal representative's ID number (displaying the first 6 digits and the last 4 digits), returns the integrated enterprise credit view to Mr. Zhang, and records a complete access log: visitor, time, access content, decision basis, and reasoning path.

[0118] Example 2: Dynamic Authorization Adjustment in Emergency Situations In the event of a public health emergency, the disease control command center of a certain district needs to urgently retrieve patient visit data from medical institutions within its jurisdiction for epidemiological investigation and tracing.

[0119] Dynamic authorization adjustment process: 1. Changes in environmental attributes: The system identifies that it is currently in an "emergency state" (a status marker issued by the emergency command center) and triggers the emergency authorization policy; 2. Temporary escalation of access privileges: Li, an epidemiologist at the CDC, is normally at level 3, but is temporarily upgraded to level 4 in an emergency, allowing him to access sensitive medical data that is normally inaccessible. 3. Dynamically expanded scope: The authorized scope has been expanded from "single patient case query" to "batch regional query", supporting searches by time period, geographical location and other dimensions; 4. Strict time limit control: The validity period of the security token is shortened to 30 minutes, and it expires immediately after a single use, requiring a new application; 5. Enhanced auditing throughout the process: All accesses are synchronized in real time to the emergency command center and regulatory departments, and a data cleanup procedure is automatically triggered after the access ends.

[0120] This embodiment demonstrates the adaptability of the dynamic authorization mechanism of the present invention to special scenarios, ensuring emergency response efficiency while strengthening security control through technical means.

[0121] Example 3: Implementation using computer equipment This invention also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, such as... Figure 1 As shown, when the processor executes the computer program, it implements the steps of the above-mentioned dynamic authorization method for government data based on knowledge graphs.

[0122] The computer device can be a server, workstation, or cloud computing node, and its internal structure includes: Processor: Performs computational tasks such as knowledge graph construction, semantic parsing, and authorization decision-making; Non-volatile storage media: storing operating systems, computer programs (including knowledge graph databases, rule engines, NLP models, etc.), and audit logs; Internal memory: provides memory space for program execution; Communication interface: Exchanges data with business systems of various departments, and supports secure communication such as HTTPS and VPN; Display screen and input device: Provides a management interface for maintenance personnel to configure policies and monitor operational status.

[0123] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above.

Claims

1. A method for dynamic authorization of government data combining knowledge graphs, characterized in that, Includes the following steps: S101. Constructing a multi-layered government knowledge graph: Construct a government knowledge graph that includes an entity graph, a relationship graph, and a rule graph. The rule graph is used to store computable authorization policies in the form of RDF triples. S102. Registered Data Resources and Access Subjects: Register government data resources to the knowledge graph at the field level and label them with static sensitivity levels; establish multi-dimensional profiles of access subjects; S103. Receive data access request: Receive data access requests that include business intent and context. S104. Semantic parsing, reasoning, and dynamic evaluation: NLP technology is used to analyze business intent and locate data resources in the graph; subject behavior, object attributes and environmental attributes are collected to construct a 7-dimensional feature vector including access time interval, hourly access frequency, number of query fields, business path deviation, departmental correlation, data lineage depth and cross-domain query breadth, and input into the isolated forest model to calculate the anomaly score; S105. Implement dynamic authorization decisions: Adjust the effective sensitivity level of the data based on the abnormal scores, and perform strategy reasoning in conjunction with the rule graph to generate decision results such as allow, deny, downgrade, or require approval. S106. Proxy Access and Security Audit: The proxy gateway performs field-level data masking and access control, and records the complete decision-making reasoning path to the audit graph.

2. The method for dynamic authorization of government data combining knowledge graphs according to claim 1, characterized in that, The rule graph mentioned in step S101 is divided into a strategy ontology, rule encoding, and conflict detection. The strategy ontology is divided into defined strategy classes, condition classes, action classes, subject constraint classes, object constraint classes, and environment constraint classes. A hierarchical inheritance structure of the strategy is established, and through the predefined strategy ontology, the natural language authorization strategy is encoded into a machine-reasonable triple structure, and it supports semantic query and automatic policy conflict detection based on SPARQL.

3. The method for dynamic authorization of government data combining knowledge graphs according to claim 1, characterized in that, The business path deviation, departmental correlation, and data lineage depth mentioned in step S104 are calculated by querying the relationship graph.

4. The method for dynamic authorization of government data combining knowledge graphs according to claim 1, characterized in that, The isolated forest model described in step S104 adopts a streaming update mechanism and maps the detected abnormal events and feature vectors to the knowledge graph in real time, storing and associating them as new graph nodes.

5. The method for dynamic authorization of government data combining knowledge graphs according to claim 4, characterized in that, In step S104, the abnormal events and feature vectors are mapped to the knowledge graph in real time. An entity linking algorithm is used to map the identified abnormal events and feature vectors to standard nodes in the knowledge graph. Score link (e text ,v kg )=α⋅Sim vector (e text ,v kg )+β⋅Sim string (e text ,v kg )+γ⋅Sim context (e text ,v kg ) Entities are either abnormal events or feature vectors e. text Knowledge graph candidate node v kg Vector similarity weight α, string similarity weight β, context similarity weight γ, α+β+γ=1, vector similarity is also semantic similarity Sim. vector (e text ,v kg ), string similarity is also known as literal similarity (Sim). string (e text ,v kg ), Contextual similarity, also known as Sentence Similarity (Sim) context (e text ,v kg Sim vector (e text ,v kg Sim string (e text ,v kg Sim context (e text ,v kg The value range is [0,1]; based on the linked entity nodes, a graph traversal algorithm is used to generate a query subgraph.

6. The method for dynamic authorization of government data combining knowledge graphs according to claim 5, characterized in that, The specific calculation formula for adjusting the effective sensitivity level of the data in step S104 is: L effective =L static ×F scene ×F subject ×F time ×F anomaly L effective For effective sensitivity levels, L static For static sensitivity level, F scene F is the scene adjustment factor. subject As the main trust factor, F time F is the timeliness adjustment factor. anomaly The dynamic adjustment factor is calculated based on the anomaly score; the input is the isolated forest model, which calculates the anomaly score, and the anomaly score is correlated with the dynamic adjustment factor F. anomaly The value association is as follows: the specific value logic is: when the anomaly score is... IF When F <0.3 anomaly If the value is 1.0, the sensitivity level is normally not adjusted; when 0.3 ≤ Anomaly IF <0.6 F anomaly Taking 1.2 increases the sensitivity level by 20%; when 0.6 ≤ Anomaly IF <0.8 F anomaly Taking 1.5 increases the sensitivity level by 50%; when Anomaly IF F ≥0.8 anomaly Take infinity to trigger direct rejection.

7. The method for dynamic authorization of government data combining knowledge graphs according to claim 6, characterized in that, Step S104 also includes calculating the overall confidence level. For the Sigmoid function, W sub As the main weight, W obj For object weight, W env For environmental weights, W ano For abnormal weights, W sub +W obj +W env +W ano =1; i The network environment, spatiotemporal rationality, equipment compliance, and geographical location are scored, with scores ranging from [0,1]. i The four indicators—network environment, spatiotemporal rationality, equipment compliance, and geographical location—are weighted, and the sum of the weighted values ​​of the four indicators is 1. S sub =w1·Auth MFA + w2·(1-Anomaly beℎ )+ w3·sim MFA Auth MFA Anomaly provides a multi-factor authentication strength score for identity verification. beℎ For users, the outlier score of the Isolation Forest algorithm, sim MFA Cosine similarity of job data; w 1、 w2 and w3 are weighted values, w 1+ w 2+ w3=1.

8. The method for dynamic authorization of government data combining knowledge graphs according to claim 1, characterized in that, In step S6, the proxy gateway dynamically rewrites the original SQL query by parsing the permission mask in the security token, returning only the authorized data rows and columns, and applying different de-identification operators according to the real-time risk level.

9. A dynamic authorization system for government data combining knowledge graphs, used to implement the method described in any one of claims 1-8, characterized in that, include: The knowledge graph construction module is used to construct and maintain the entity graph, relation graph, and rule graph. The resource registration management module is used to manage the registration information of data resources and access subjects; The semantic parsing and anomaly detection module is used to parse business intent, construct feature vectors, and run the isolated forest model. A dynamic authorization decision engine is used to evaluate attribute confidence, inference strategies, and generate authorization tokens; Access proxy gateways are used to perform fine-grained access control and data anonymization; The security audit center is used to record audit logs and build audit knowledge subgraphs.

10. A dynamic authorization system for government data combining knowledge graphs according to claim 9, characterized in that, The dynamic authorization decision engine adopts a streaming computing architecture, processes attribute streams in real time through Apache Flink, and interacts with the graph database to achieve millisecond-level decisions; the access proxy gateway is deployed in Sidecar mode, with a built-in SQL parser, which can dynamically rewrite query statements and inject row-level filtering conditions according to token permissions.

Images