Information platform hierarchical access control method

Abstract

The application discloses an information platform hierarchical access control method, relates to the technical field of access control, and solves the technical problems that the knowledge graph lacks system construction, the accuracy of entity recognition and relationship extraction is limited, the information security level analysis is affected, the effective access level of users cannot be accurately predicted, and the initial evaluation and dynamic adjustment of the effective access level lack reliable basis; the effective access level is dynamically updated by combining static attributes, real-time behavior and access context continuous evaluation trust value. The permission of a user is automatically reduced when abnormal behavior occurs, and the permission is gradually restored when long-term compliance access is achieved, so that the elastic access control of behavior perception is realized, the data leakage risk caused by account theft and abnormal operation is reduced, and the role RBAC, attribute ABAC and dynamic trust level are fused to complete joint authorization decision by relying on a model. Meanwhile, a deep sorting model is used to match the accessible information security level of a user, and static identity rules and dynamic real-time risks are considered.

Description

Technical Field

[0001] The present invention belongs to the field of access control, and specifically relates to a hierarchical access control method for information platforms. Background Art

[0002] With the rapid iteration and in-depth implementation of big data and artificial intelligence technologies, various government, industry and public information platforms have realized the aggregation and integration of massive multi-source heterogeneous information data. The information content covers data resources of different security levels such as public general information, internal business information, and classified sensitive information, and the data volume, content dimension and communication form are becoming increasingly complex and diverse. As the core carrier for information storage, circulation and sharing, information platforms are facing multiple security risks such as unauthorized access, data leakage, malicious theft, and illegal dissemination while supporting efficient business operation and efficient information circulation. The security management and control of information content and refined access constraints have become the research focus in the field of network data security. The current network security and data hierarchical protection system is increasingly improved, which requires the formulation of differentiated protection strategies based on the sensitivity level and risk level of information, and eliminates the indiscriminate and extensive access control mode. Higher standards are put forward for the accuracy, dynamics and security of access control of information platforms.

[0003] When the existing hierarchical access control technology for information platforms processes the data of information platforms, there is usually a lack of systematically constructed knowledge graphs in the information platform field, and the accuracy of entity recognition and relationship extraction models is limited, resulting in missing nodes or relationship errors in the constructed knowledge subgraphs, which further affects the analysis of information security levels; it is difficult to accurately predict the user's effective access level, resulting in the lack of a reliable basis for the initial evaluation and dynamic adjustment of the effective access level, which may lead to misjudgment. Summary of the Invention

[0004] The present invention aims to at least solve one of the technical problems existing in the prior art; for this purpose, the present invention proposes a hierarchical access control method for information platforms, which is used to solve the technical problems of lacking a systematically constructed knowledge graph, limited accuracy of entity recognition and relationship extraction, affecting the analysis of information security levels, and being difficult to accurately predict the user's effective access level, resulting in the lack of a reliable basis for the initial evaluation and dynamic adjustment of the effective access level.

[0005] To solve the above problems, a first aspect of the present invention provides a hierarchical access control method for an information platform, comprising the following steps: Access multi-source heterogeneous information data through a data acquisition module, extract multi-dimensional feature vectors of the information content, construct an information content hierarchical model, and map all information contents to different security levels according to preset security level division rules; In response to a user's access request, the system obtains the user's static attribute information, dynamic behavior information, and current access context information. It then calculates the user's comprehensive trust value through a multi-dimensional dynamic authentication model and grants the user an initial access level based on the comprehensive trust value. During user access, based on real-time behavioral data collected with user authorization, the dynamic impact of user behavior on trust value is evaluated using a time decay function, and the effective access level of the user is updated in real time through a time-series prediction network. Based on the user's valid access level, user role affiliation, and user attribute information, combined with access environment attributes, authorization decisions are made through a deep ranking model and an access control model to determine the target information content corresponding to the user's appropriate security level. For the target information content corresponding to the user's appropriate security level, query the corresponding key derivation matrix to determine whether the user has a key derivation path for the target information content. If a derivation path exists, reconstruct the decryption key using the user's bound dynamic key fragments, decrypt the target information content, and return it to the user; otherwise, diagnose the reason why no derivation path exists and set a tiered response strategy.

[0006] Optionally, in one example of the above aspects, an information content classification model is constructed to map all information content to different security levels according to preset security level classification rules, including the following steps: The system uses Kafka message queues to access multi-source heterogeneous information data in real time, including scientific papers, research reports, news information, policy documents, patent documents, and internal enterprise knowledge documents. It also cleans the multi-source heterogeneous information data and extracts plain text content to obtain information text data. Constructing a hierarchical information content model includes: Using a pre-trained Transformer model, semantic encoding is performed on the information text. The information text data is input into the Transformer model, and the output vector at the sentence start marker is taken to obtain the global semantic representation of the information, which serves as the final semantic feature. For long texts exceeding the model's maximum input length, segmented encoding is used, and the average of the output vectors of each segment is taken as the final semantic feature, denoted as . ; Named entities are extracted from information content, including people, organizations, technical terms, products, and events. Relationships between entities are extracted using a large AI model, including: research and development, cooperation, competitors, and affiliation. The entity with the most relationships is selected as the core entity. Using entities as nodes and relationships as edges, an information knowledge subgraph is constructed. A graph neural network is used to encode the knowledge subgraph, extracting information about the core entity's corresponding node and its adjacent nodes, as well as the degree centrality of the corresponding nodes, as the graph structure feature vector of the information. ; The TransE knowledge graph reasoning algorithm completes implicit paths between information that lack explicit relationships but have semantic connections. The vectors of all implicitly related entities are pooled and aggregated to obtain the reasoning feature vectors of the information. ; Extract statistical features from the information content, including word count, number of paragraphs, number of sentences, average sentence length, grammatical correctness score, authority of the publishing organization, time since publication, number of reads, and number of reposts. Combine these statistical features into a statistical feature vector. .

[0007] Final semantic features Graph structure eigenvectors Inference feature vectors and statistical eigenvectors The features are concatenated into a unified information feature vector. The fused feature vector is then standardized using Z-scores to eliminate the dimensional differences between different feature dimensions, resulting in a fused feature vector. ; From historical data of information platforms, information samples that have been labeled with security levels by security experts are selected, and their standardized fusion feature vectors are extracted. The training dataset is constructed by training a random forest multi-classifier, taking the fused feature vector as input and the corresponding security level label as output; the fused feature vector is extracted from all information content, and the fused feature vector is input into the trained random forest multi-classifier to output the security level to which the corresponding information belongs.

[0008] Optionally, in one example of the above aspects, calculating a user's overall trust value through a multi-dimensional dynamic authentication model and granting the user an initial access level based on the overall trust value includes the following steps: Analyze the user's comprehensive trust value based on the user's static attribute information, dynamic behavior information, and current access context information; Based on the user's static attribute features, including registration information and historical reputation, the registration information and historical reputation are numerically encoded at different levels to obtain the numerical codes of the static attribute features, and the static trust value is calculated. Based on the user's recent access behavior patterns, a dynamic trust value is calculated; considering the current access environment, a contextual trust value is analyzed; and an initial access level is granted to the user based on the comprehensive trust value.

[0009] Optionally, in one example of the above aspects, updating the effective access level of a user in real time via a time-series prediction network includes the following steps: Set up dynamic monitoring functions based on real-time behavior data collected with user authorization. In the time window Internal continuous evaluation; analysis of effective user access levels .

[0010] Optionally, in one example of the above aspects, determining the target information content corresponding to the user's appropriate security level includes the following steps: The user-adaptive security level allocation strategy is set as follows: only users with the highest valid access level can access all security level information, while users with lower valid access levels can access information of other security levels except for the highest level. Within the scope of security level information adapted to the user, authorization decisions are made through an access control model. The access control model is a hybrid model that integrates role-based access control (RBAC) and attribute-based access control (ABAC), with an authorization decision function. The final authorization decision result obtained through the authorization decision function is used as a candidate information set. The semantic features of the user-input query data and the final information are calculated separately. Graph structure eigenvectors and inference feature vectors The correlation degree is calculated, and the correlation results are weighted and averaged to obtain a correlation score. The correlation scores are then sorted from high to low.

[0011] Optionally, in one example of the above aspects, determining whether a user possesses a key derivation path for the target information content includes the following steps: The transitive closure matrix is ​​calculated based on the adjacency matrix D derived from the key. This characterizes all reachable derivation links between all keys; Iterate through the keys held by the user and query the transitive closure matrix: if any key held by the user satisfies the decryption key of the target information... If a valid key derivation path exists, then the key distribution request is rejected; otherwise, if no valid derivation path exists, the request is rejected. This indicates that the element in the i-th row and t-th column of the closure matrix is ​​passed.

[0012] Optionally, in one example of the above aspects, the decryption key is reconstructed from the user-bound dynamic key fragments, the target information content is decrypted, and returned to the user, including the following steps: The original decryption key of the target information Divided into A fragment , For the first Fragments of the original decryption key; user To the set of key management nodes When requesting fragments, calculate the first... Each node returns the fragment bound to the user. ; Based on the reconstructed decryption key, the target information content is decrypted and returned to the user.

[0013] Compared with the prior art, the beneficial effects of the present invention are: This invention continuously assesses trust values ​​by combining static attributes, real-time behavior, and access context, and dynamically updates the effective access level. User privileges are automatically downgraded when abnormal behavior is observed, while long-term compliant access is gradually restored, achieving behavior-aware, flexible access control and reducing the risk of data leakage due to account theft or abnormal operations.

[0014] This invention integrates role-based RBAC, attribute-based ABAC, and dynamic trust levels, relying on a model to complete joint authorization decisions. Simultaneously, it uses a deep ranking model to match the security level of user-accessible information, balancing static identity rules with dynamic real-time risks, and reducing classic problems such as excessive permission allocation and role explosion arising from solely relying on roles.

[0015] This invention does not directly control the distribution of plaintext information, but rather manages the key derivation path. Even if a user obtains ciphertext, the decryption key cannot be reconstructed without a valid key derivation path. The key is bound to the user's identity and expiration date, and in conjunction with a key sharding mechanism, it avoids the risk of single-point key leakage, ensuring that decryption is only permitted for authorized users. When a valid key derivation path does not exist, the invention can diagnose the cause of the blockage and execute a tiered response, rather than simply returning a uniform rejection, facilitating security auditing and anomaly tracing on the platform. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a schematic diagram of the method flow of the present invention. Detailed Implementation

[0018] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] Please see Figure 1 The first aspect of this invention provides a hierarchical access control method for an information platform, comprising the following steps: By accessing multi-source heterogeneous information data through the data acquisition module, extracting multi-dimensional feature vectors of information content, constructing an information content hierarchical model, and mapping all information content to different security levels according to preset security level classification rules; In response to a user's access request, the system obtains the user's static attribute information, dynamic behavior information, and current access context information. It then calculates the user's comprehensive trust value through a multi-dimensional dynamic authentication model and grants the user an initial access level based on the comprehensive trust value. During user access, based on real-time behavioral data collected with user authorization, a time decay function is used to evaluate the dynamic impact of user behavior on trust value, and a time-series prediction network updates the user's effective access level in real time. In this embodiment, a time-series prediction network based on an LSTM (Long Short-Term Memory) network architecture updates the user's effective access level in real time. Specifically, the time window... Dynamic real-time reliable score series after discretization by time step The input sequence serves as the input sequence for the LSTM network. The hidden layers of the LSTM network update cell states through input gates, forget gates, and output gates, extracting the temporal evolution features of trust scores. The output layer of the LSTM network employs a fully connected layer structure, linearly mapping the final state vector of the hidden layers and outputting the effective access level for the next time step via a Softmax function. The probability distribution is used, and the level corresponding to the maximum probability is taken as the valid access level that is updated in real time.

[0020] Based on the user's valid access level, user role affiliation, and user attribute information, combined with access environment attributes, authorization decisions are made through a deep ranking model and an access control model to determine the target information content corresponding to the user's appropriate security level. For the target information content corresponding to the user's appropriate security level, query the corresponding key derivation matrix to determine whether the user has a key derivation path for the target information content. If a derivation path exists, reconstruct the decryption key using the user's bound dynamic key fragments, decrypt the target information content, and return it to the user; otherwise, diagnose the reason why no derivation path exists and set a tiered response strategy.

[0021] In this embodiment, a data acquisition module is used to access multi-source heterogeneous information data. The data acquisition module uses a Kafka message queue to achieve real-time access to multi-source heterogeneous information data. The data cleaning and standardization module performs format unification, deduplication, and outlier processing on the collected data. The feature modeling module uses a vector retrieval library to complete semantic retrieval and similarity matching of information content.

[0022] In response to user access requests, the system acquires the user's static attribute information, dynamic behavior information, and current access context information. It calculates the user's comprehensive trust value using a multi-dimensional dynamic authentication model and grants an initial access level. Access permissions are adjusted in real-time based on dynamic changes in user behavior. Abnormal behavior is promptly penalized with reduced privileges, while users exhibiting consistently normal behavior have their privileges gradually restored. This effectively addresses changes in the access environment, ensuring both security and flexibility. Based on the user's effective access level, user role affiliation, and user attribute information, combined with access environment attributes, authorization decisions are made using a deep ranking model and a permission control model. Compared to existing technologies that rely solely on a single role or simple identity authentication, this system achieves fine-grained control, ensuring that users can only access information within their security level, strictly adhering to the principle of least privilege, and effectively preventing excessive information exposure due to overly broad access permissions.

[0023] For the target information content corresponding to the user's appropriate security level, the key derivation matrix is ​​queried to determine the path. If a derivation path exists, the decryption key is reconstructed using the user-bound dynamic key fragments to complete decryption; if no derivation path exists, the specific cause is diagnosed and a tiered response strategy is executed. This achieves flexible key management with non-linearity, user binding, and time binding, effectively preventing the unlimited propagation of keys and content copying, while also meeting dynamic authorization requirements through temporary derivation paths.

[0024] In one embodiment of the present invention, an information content classification model is constructed, mapping all information content to different security levels according to a preset security level classification rule, including the following steps: Multi-source heterogeneous information data, including scientific papers, research reports, news, policy documents, patent documents, and internal enterprise knowledge documents, is accessed in real time through a Kafka message queue. This multi-source heterogeneous information data is cleaned, and plain text content is extracted to obtain information text data. In this embodiment, the following cleaning operations are performed on the original information data: plain text content is extracted from different formats such as PDF, Word, and HTML; the unified encoding format is UTF-8, and the unified time expression format is ISO8601 standard; text fingerprints are calculated based on the SimHash algorithm, and duplicate information with similarity exceeding a preset threshold is removed. Constructing a hierarchical information content model includes: In this embodiment, a pre-trained Transformer model, specifically the BERT model, is used to semantically encode the information text. The information text data is input into the Transformer model, and the output vector at the sentence start marker is taken to obtain the global semantic representation of the information, which serves as the final semantic feature. For long texts exceeding the model's maximum input length, segmented encoding is used, and the average of the output vectors from each segment is taken as the final semantic feature, denoted as . ; Named entities are extracted from information content, including people, organizations, technical terms, products, and events. Relationships between entities are extracted using a large AI model, including: research and development, cooperation, competitors, and affiliation. The entity with the most relationships is selected as the core entity. Using entities as nodes and relationships as edges, an information knowledge subgraph is constructed. A graph neural network is used to encode the knowledge subgraph, extracting information about the core entity's corresponding node and its adjacent nodes, as well as the degree centrality of the corresponding nodes, as the graph structure feature vector of the information. Specifically, in this embodiment, a pre-trained BERT entity relationship extraction model is used to extract relationships between entities. In practice, the information text sentence containing the head and tail entities is converted into a sequence of character vectors and input into the BERT model. The feature vectors of the head and tail entities in the last hidden layer are obtained and concatenated. This concatenation is then fed into a two-layer fully connected network for dimensionality reduction and classification. The probability distribution of the output entity pairs belonging to the relationships of R&D, cooperation, competitor, and affiliation is calculated, and the relationship with the highest probability is taken as the final relationship.

[0025] The TransE knowledge graph reasoning algorithm completes implicit paths between information that lack explicit relationships but have semantic connections. The vectors of all implicitly related entities are pooled and aggregated to obtain the reasoning feature vectors of the information. ; Extract statistical features from the information content, including word count, number of paragraphs, number of sentences, average sentence length, grammatical correctness score, authority of the publishing organization, time since publication, number of reads, and number of reposts. Combine these statistical features into a statistical feature vector. .

[0026] Final semantic features Graph structure eigenvectors Inference feature vectors and statistical eigenvectors The features are concatenated into a unified information feature vector. The fused feature vector is then standardized using Z-scores to eliminate the dimensional differences between different feature dimensions, resulting in a fused feature vector. ; From historical data of information platforms, information samples that have been labeled with security levels by security experts are selected, and their standardized fusion feature vectors are extracted. The training dataset is constructed from the following: a random forest multi-classifier is trained, taking the fused feature vector as input and the corresponding security level label as output; the multi-classifier learns the intrinsic mapping relationship between the feature vector and the security level, fitting the classification decision boundary from features to levels. All information content is processed to extract fused feature vectors, which are then input into the trained random forest multi-classifier, outputting the security level of the corresponding information.

[0027] In one embodiment of the present invention, a user's comprehensive trust value is calculated through a multi-dimensional dynamic authentication model, and an initial access level is granted to the user based on the comprehensive trust value, including the following steps: Analyze the user's comprehensive trust value based on the user's static attribute information, dynamic behavior information, and current access context information. The formula is: in, This is a static trust value. It is a dynamic trust value. For contextual trust values, These are the corresponding weighting coefficients; specifically, the weighting coefficients are dynamically determined using an objective weighting method based on information entropy, specifically the entropy weighting method: for a preset historical time period... For each user access sample, the information entropy of the three trust value indicators mentioned above is calculated. The smaller the information entropy, the greater the degree of variation of the indicator, and a larger weight coefficient is assigned to it, while ensuring... .

[0028] Based on the user's static attribute features, including registration information and historical reputation, the registration information and historical reputation are numerically encoded at different levels to obtain the numerical codes of the static attribute features, and the static trust value is calculated. : in, For user number The numerical encoding of a static attribute feature, where p is the total number of static attribute features. For the corresponding weights, This is the bias constant; and The fitting parameters are obtained by constructing a logistic regression model and using a historical user dataset containing marked violations / compliance status, employing maximum likelihood estimation combined with gradient descent optimization algorithm for iterative training.

[0029] Calculate dynamic trust values ​​based on users' recent browsing behavior patterns. : in, As the dynamic trust baseline score, all users' initial dynamic trust baseline is set to 0.75 in this embodiment. For an abnormal and unauthorized access behavior that occurs at time t, This is a function for penalizing abnormal behavior. This represents compliant and normal access behavior at time t. Here, T represents the reward function for normal behavior, and T is the length of the time window for the statistical behavior. and This is the time decay factor; =γ tna-tnb The attenuation factor calculation parameter γ∈(0,1), tna is the current time, and tnb is the historical time of data acquisition; It can be set according to the actual situation. 0.8 to 1.2 times; Contextual trust value Based on the current access environment: ;in, Assign a trust score to the IP address. To score the trustworthiness of the accessed device, To score the reasonableness of the access period, For the corresponding weighting coefficients, in this embodiment, The initial values ​​are set to 0.4, 0.3, and 0.3 respectively, and can be fine-tuned as needed. If it is found that users with high IP address trust scores and access device trust scores have a low probability of accessing abnormalities, the weights of the first two items can be increased. The initial values ​​were set to 0.4, 0.4, and 0.2 respectively. Initial access level is granted to the user based on overall trust score. for: in, The highest level allowed by the user. This represents the system's maximum security level. Indicates the user's overall trust value With the system's maximum security level Round down the product of the products. This is for calculating the minimum value.

[0030] In this embodiment, the registration information is numerically encoded at different levels using the following registration information encoding table, as shown in Table 1: Table 1: Registration Information Coding Table Level 4 (Highly Trustworthy) Complete real-name authentication; complete all required information; have been registered for more than 180 days; and registered through official channels. 0.8~1.0 Level 3 Complete real-name authentication; complete 80% or more of the required information; and have been registered for 30-180 days. 0.6~0.8 Level 2 Unverified; only basic information was provided in the registration form; and the registration period was 7-30 days. 0.3~0.6 Level 1 (High Risk) Does not meet the above criteria for determination. 0.0~0.3 The historical credit rating is categorized and numerically encoded according to the following historical credit rating coding table, as shown in Table 2: Table 2: Historical Credit Code Table Level 4 Excellent No violations in the past year 0.8~1.0 Level 3 Good Only one warning or penalty in the past year 0.6~0.8 Level 2 General There have been 2 to 4 warnings or penalties in the past year. 0.3~0.6 Grade 1 difference There have been more than 4 warnings or penalties in the past year. 0.0~0.3 In this embodiment, the abnormal behavior penalty function is set as follows: Wherein, no abnormal behavior is defined as no occurrence. Any action at any time; The reward function for normal behavior is: In this embodiment, the IP address trust score The settings are as follows: a fixed intranet IP or enterprise leased line IP is scored as 0.9, a regular home broadband public IP is scored as 0.7, a data center server room IP or cloud server IP is scored as 0.5, and other cases are scored as 0.2. Access Device Trust Score The settings are as follows: devices that log in more than 10 times in three months are scored as 0.8; devices that log in 10 or less but more than 2 times in three months are scored as 0.5; and devices that log in less than 2 times in three months are scored as 0.2. Reasonableness score for access time period The settings are as follows: the access score during normal working hours is 0.9, the access score during pre-application overtime hours is 0.8, and the access score during non-normal working hours and pre-application overtime hours is 0.5. In one embodiment of the present invention, updating the effective access level of a user in real time through a time-series prediction network includes the following steps: Set up dynamic monitoring functions based on real-time behavior data collected with user authorization. In the time window Internal continuous assessment, the formula is: in, Let t be the dynamic real-time trusted score of user u. Based on the user's overall trust score, The penalty weight for the i-th abnormal behavior is determined according to the penalty function. set up, The reward weight for the j-th normal behavior is determined according to the reward function. set up, Let be the time when the i-th abnormal behavior occurs, and n be the total number of abnormal behaviors detected within the time window [tT, t]. Let k be the time of the j-th normal behavior occurrence, k be the total number of normal behaviors within the time window [tT, t], and the sum be the time decay function. ; and The attenuation coefficient is, and In this embodiment, Any behavior at a given time is defined as abnormal behavior, and other behaviors that are not abnormal behaviors are defined as normal behaviors. User valid access level for: ;in, The user's initial access level, This represents the maximum security level of the system. To round down, This is for calculating the minimum value.

[0031] When abnormal user behavior is detected, the effective access level is dynamically reduced; when no abnormal behavior is detected within a preset time period, the effective access level is restored.

[0032] In one embodiment of the present invention, determining the target information content corresponding to the user's appropriate security level includes the following steps: The user-adaptive security level allocation strategy is set as follows: only users with the highest valid access level can access all security level information, while users with lower valid access levels can access information of other security levels except for the highest level. Within the scope of the security level information adapted to the user, authorization decisions are made through an access control model. This model is a hybrid of role-based access control (RBAC) and attribute-based access control (ABAC), and the authorization decision function is:

[0033] in, For the final authorization decision, u represents the user who initiated the access request. Let t represent the permissions for the i-th information resource to be accessed, and t represent the time when the access occurs. Functions for checking basic permissions obtained by users through roles; This is an attribute-based access control policy matching function that evaluates policies based on user attributes, information resource attributes, and environment attributes. For logical AND operation; The final authorization decision result obtained through the authorization decision function is used as a candidate information set. The semantic features of the user-input query data and the final information are calculated separately. Graph structure eigenvectors and inference feature vectors The correlation degree is calculated, and the correlation results are weighted and averaged to obtain a correlation score. The correlation scores are then sorted from high to low.

[0034] In this embodiment, the semantic features of the user-input query data and the final information are calculated separately. Cosine similarity and graph structure feature vectors Cosine similarity and inference feature vectors The cosine similarity is calculated, and the results of the cosine similarity calculation are weighted and averaged to obtain the correlation score; in this embodiment, the weights of the weighted average are equal, but they can also be adjusted as needed.

[0035] In one embodiment of the present invention, a basic permission check function obtained by the user through a role is described. Matching functions with attribute-based access control policies Set as; Users through roles Get the basic permission set and set it. for: Where True indicates access is allowed, False indicates access is denied, Roles(u) is the set of all roles assigned to user u; r is the system-defined role; Perms(r) is the role... The complete set of permissions possessed; "Existent quantifier" means that a user possesses a certain role, and that role includes permissions. Static role verification passed; To address the issue of character explosion, a hierarchical inheritance relationship is introduced, where the permissions of a parent role include all permissions of its child roles. This hierarchical inheritance reduces the number of roles and alleviates the problem of character explosion. Furthermore, an on-demand permission activation mechanism is adopted, where users only activate the minimum subset of permissions required for the current session. Based on the user's valid access level, user role affiliation, and user attribute information, the user's entered identity information is categorized into user role affiliation categories. Access control rules are then matched using predefined user role affiliation information settings. Set to: Where Policy is the set of all access control rules predefined by the system; p is a single access control policy rule; ⋀ is the logical conjunction of all policies, and all policies must be satisfied; eval(⋅) is the policy evaluation function. The input is: a single access control policy rule p, user attributes, and environment attributes. The output is True / False, which determines whether the policy is satisfied. The user attribute set contains the static trust value calculated earlier. Dynamic trust value and context trust value ; The information resource attribute corresponds to the security level of the information. The set of environmental attributes includes: IP address trust score. Access device trust score .

[0036] In one embodiment of the present invention, querying the corresponding key derivation matrix for the target information content corresponding to the user's adapted security level includes the following steps: Establish an authorization relationship matrix based on the target information content corresponding to the user's appropriate security level. , Indicates user Authorized access to information ; Establish key derivation matrix , Indicates the upper-level base parent key Resource-specific subkeys can be derived. The key derivation matrix is ​​derived from the nonlinear key derivation graph. definition; Key derivation matrix The conditions for dynamic generation are: The derived function is: in, For static permission association tags, =1 indicates that the user has undergone basic RBAC / ABAC authorization and has authorized access to information. Basic permissions; =0 indicates no basic permissions; For users Valid access level, Information access is authorized in the security level allocation policy adapted to the user. The minimum valid access level; To derive the generated resource-specific subkey, This is the parent key for the upper layer. This is the key derivation function. As a unique identifier for users, For timestamps, It generates one-time random numbers to resist replay attacks and ensures that the input for each derivation is random. For bitwise XOR operation, This is a hash message authentication code.

[0037] In this embodiment, key derivation depends on user identity. and timestamp Even if different users have the same high-level key, the low-level keys derived from them will be different and have time limits.

[0038] In one embodiment of the present invention, determining whether a user possesses a key derivation path for the target information content includes the following steps: The transitive closure matrix is ​​calculated based on the adjacency matrix D derived from the key. This represents the fact that all derivation links between all keys are reachable. In this embodiment, based on a set maximum search depth... The directed graph depth-first search (DFS) algorithm computes a constrained transitive closure matrix. This characterizes all reachable derivation links between all keys; however, the search depth is limited by the physical upper limit of the system's security level classification. ( (This represents the maximum security level of the system) to avoid inference dead loops in complex permission networks and reduce computing power overhead.

[0039] Iterate through the keys held by the user and query the transitive closure matrix: if any key held by the user satisfies the decryption key of the target information... If a valid key derivation path exists, then the key distribution request is rejected; otherwise, if no valid derivation path exists, the request is rejected. This indicates that the element in the i-th row and t-th column of the closure matrix is ​​passed.

[0040] In this embodiment, Represents the upper-level basic parent key There exists one or more directed paths from which the resource-specific subkey can be derived at multiple levels. ; This means that there is no valid derivation link.

[0041] In one embodiment of the present invention, the decryption key is reconstructed using user-bound dynamic key fragments, the target information content is decrypted, and returned to the user, including the following steps: The original decryption key of the target information Divided into A fragment , is a fragment of the i-th original decryption key; the user sends the key to the set of key management nodes. When requesting fragments, calculate the first... Each node returns the fragment bound to the user. for: Perform fragmentation and unique user identification and expiration timestamp Binding; User collection at least A fragment Reconstruct the user binding key: Set the decryption conditions as follows: in, For the first Fragments of the original decryption key As a unique identifier for users, Expired timestamp A unique random salt value for the r-th shard node; The information decryption key, which is bound to the user's identity validity period, is generated by equivalently calling the Derive derivation function mentioned above. Refactoring functions for threshold secret sharing For the first Each node returns the fragment bound to the user. This is the key derivation function; For information decryption function, Encrypt the information into ciphertext. The original plaintext of the information This is the current system timestamp. This is a function for verifying the legitimacy of user identity. The symbol is a mathematical sign indicating that decryption failed. For bitwise XOR operation, For hash message authentication codes; Based on the reconstructed decryption key, the target information content is decrypted and returned to the user.

[0042] In one embodiment of the present invention, diagnosing the reason why there is no derivation path and setting a hierarchical response strategy includes the following steps: The reasons for the absence of a derivation path include insufficient user access level, unauthorized access to target information, or the existence of an authorization relationship but the lack of a derivation path in the key derivation graph. Based on the diagnostic results, a tiered response strategy is implemented: if the user's valid access level is insufficient, a summary or de-identified version of the target information is returned, and the user is prompted to upgrade their authentication to obtain full content access rights; if the user is not authorized to access the target information, a permission-unauthorized prompt is returned and an audit log is recorded; if the authorization relationship exists but the key derivation graph lacks a derivation path, a dynamic path discovery mechanism is implemented. Through the dynamic path discovery mechanism, when a user’s actual access need for target information is detected, a temporary authorization application process is automatically triggered. After approval, a temporary derivation edge is added to the key derivation graph. The temporary derivation edge has a limited validity period and automatically expires after the expiration. Extract the timestamp parameter from all abnormal access attempts that lack a valid key derivation path. User identification parameters The target information is encrypted and indexed, packaged and written into an independent security audit log database with tamper-proof hash signature verification; the system background deploys a timed monitoring script to traverse the audit log database, and when the number of times the same user triggers abnormal interception records within a preset time window exceeds a preset threshold, a security level mismatch warning is triggered.

[0043] The above embodiments are only used to illustrate the technical methods of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical methods of the present invention without departing from the spirit and scope of the technical methods of the present invention.

Claims

1. A hierarchical access control method for an information platform, characterized in that, Includes the following steps: By accessing multi-source heterogeneous information data through the data acquisition module, extracting multi-dimensional feature vectors of information content, constructing an information content hierarchical model, and mapping all information content to different security levels according to preset security level classification rules; In response to a user's access request, the system obtains the user's static attribute information, dynamic behavior information, and current access context information. It then calculates the user's comprehensive trust value through a multi-dimensional dynamic authentication model and grants the user an initial access level based on the comprehensive trust value. During user access, based on real-time behavioral data collected with user authorization, the dynamic impact of user behavior on trust value is evaluated using a time decay function, and the effective access level of the user is updated in real time through a time-series prediction network. Based on the user's valid access level, user role affiliation, and user attribute information, combined with access environment attributes, authorization decisions are made through a deep ranking model and an access control model to determine the target information content corresponding to the user's appropriate security level. For the target information content corresponding to the user's appropriate security level, query the corresponding key derivation matrix to determine whether the user has a key derivation path for the target information content. If a derivation path exists, reconstruct the decryption key using the user's bound dynamic key fragments, decrypt the target information content, and return it to the user; otherwise, diagnose the reason why no derivation path exists and set a tiered response strategy.

2. The hierarchical access control method for an information platform according to claim 1, characterized in that, Construct a content hierarchy model to map all content to different security levels according to preset security level classification rules, including the following steps: The system uses Kafka message queues to access multi-source heterogeneous information data in real time, including scientific papers, research reports, news information, policy documents, patent documents, and internal enterprise knowledge documents. It also cleans the multi-source heterogeneous information data and extracts plain text content to obtain information text data. Constructing a hierarchical information content model includes: Using a pre-trained Transformer model, semantic encoding is performed on the information text. The information text data is input into the Transformer model, and the output vector at the sentence start marker is taken to obtain the global semantic representation of the information, which serves as the final semantic feature. For long texts exceeding the model's maximum input length, segmented encoding is used, and the average of the output vectors of each segment is taken as the final semantic feature, denoted as . ; Named entities are extracted from information content, including people, organizations, technical terms, products, and events. Relationships between entities are extracted using a large AI model, including: research and development, cooperation, competitors, and affiliation. The entity with the most relationships is selected as the core entity. Using entities as nodes and relationships as edges, an information knowledge subgraph is constructed. A graph neural network is used to encode the knowledge subgraph, extracting information about the core entity's corresponding node and its adjacent nodes, as well as the degree centrality of the corresponding nodes, as the graph structure feature vector of the information. ; The TransE knowledge graph reasoning algorithm completes implicit paths between information that lack explicit relationships but have semantic connections. The vectors of all implicitly related entities are pooled and aggregated to obtain the reasoning feature vectors of the information. ; Extract statistical features from the information content, including word count, number of paragraphs, number of sentences, average sentence length, grammatical correctness score, authority of the publishing organization, time since publication, number of reads, and number of reposts. Combine these statistical features into a statistical feature vector. ; Final semantic features Graph structure eigenvectors Inference feature vectors and statistical eigenvectors The features are concatenated into a unified information feature vector. The fused feature vector is then standardized using Z-scores to eliminate the dimensional differences between different feature dimensions, resulting in a fused feature vector. ; From historical data of information platforms, information samples that have been labeled with security levels by security experts are selected, and their standardized fusion feature vectors are extracted. The training dataset is constructed by training a random forest multi-classifier, taking the fused feature vector as input and the corresponding security level label as output; the fused feature vector is extracted from all information content, and the fused feature vector is input into the trained random forest multi-classifier to output the security level to which the corresponding information belongs.

3. The hierarchical access control method for an information platform according to claim 1, characterized in that, The system calculates a user's overall trust score using a multi-dimensional dynamic authentication model and grants the user an initial access level based on that score, including the following steps: Analyze the user's comprehensive trust value based on the user's static attribute information, dynamic behavior information, and current access context information. The formula is: in, This is a static trust value. It is a dynamic trust value. For contextual trust values, These are the corresponding weighting coefficients; Based on the user's static attribute features, including registration information and historical reputation, the registration information and historical reputation are numerically encoded at different levels to obtain the numerical codes of the static attribute features, and the static trust value is calculated. : in, For user number The numerical encoding of a static attribute feature, where p is the total number of static attribute features. For the corresponding weights, This is the bias constant; Calculate dynamic trust values ​​based on users' recent browsing behavior patterns. : in, As the baseline score for dynamic trust, this serves as the initial dynamic trust baseline for all users. For an abnormal and unauthorized access behavior that occurs at time t, This is a function for penalizing abnormal behavior. This represents compliant and normal access behavior at time t. Here, T represents the reward function for normal behavior, and T is the length of the time window for the statistical behavior. and This is the time decay factor; Contextual trust value Based on the current access environment: in, Assign a trust score to the IP address. To score the trustworthiness of the accessed device, To score the reasonableness of the access period, These are the corresponding weighting coefficients; Initial access level is granted to the user based on overall trust score. for: in, The highest level allowed by the user. This represents the system's maximum security level. Indicates the user's overall trust value With the system's maximum security level The product is rounded down.

4. The hierarchical access control method for an information platform according to claim 1, characterized in that, The effective access level of users is updated in real time through time-series prediction networks, including the following steps: Based on real-time behavioral data collected with user authorization, a dynamic monitoring function is set up within a time window. Internal continuous assessment, the formula is: in, Let t be the dynamic real-time trusted score of user u. Based on the user's overall trust score, The penalty weight for the i-th abnormal behavior is determined according to the penalty function. set up, The reward weight for the j-th normal behavior is determined according to the reward function. set up, Let be the time when the i-th abnormal behavior occurs, and n be the total number of abnormal behaviors detected within the time window [tT, t]. Let k be the time when the j-th normal behavior occurs, and k be the total number of normal behaviors within the time window [tT, t]. and The time decay function is: ; and The attenuation coefficient is, and ; User valid access level for: ;in, The user's initial access level, This represents the maximum security level of the system.

5. The hierarchical access control method for an information platform according to claim 1, characterized in that, Determining the appropriate security level for a user and the corresponding target information content includes the following steps: The user-adaptive security level allocation strategy is set as follows: only users with the highest valid access level can access all security level information, while users with lower valid access levels can access information of other security levels except for the highest level. Within the scope of the security level information adapted to the user, authorization decisions are made through an access control model. This model is a hybrid of role-based access control (RBAC) and attribute-based access control (ABAC), and the authorization decision function is: in, For the final authorization decision, u represents the user who initiated the access request. Let t represent the permissions for the i-th information resource to be accessed, and t represent the time when the access occurs. Functions for checking basic permissions obtained by users through roles; This is an attribute-based access control policy matching function that evaluates policies based on user attributes, information resource attributes, and environment attributes. For logical AND operation; The final authorization decision result obtained through the authorization decision function is used as a candidate information set. The semantic features of the user-input query data and the final information are calculated separately. Graph structure eigenvectors and inference feature vectors The correlation degree is calculated, and the correlation results are weighted and averaged to obtain a correlation score. The correlation scores are then sorted from high to low.

6. The hierarchical access control method for an information platform according to claim 5, characterized in that, Basic permission check function obtained by the user through the role Matching functions with attribute-based access control policies Set as; Users through roles Get the basic permission set and set it. for: Where True indicates access is allowed, False indicates access is denied, Roles(u) is the set of all roles assigned to user u; r is the system-defined role; Perms(r) is the role... The complete set of permissions possessed; "Existent quantifier" means that a user possesses a certain role, and that role includes permissions. Static role verification passed; Based on the user's valid access level, user role affiliation, and user attribute information, the user's entered identity information is categorized into user role affiliation categories. Access control rules are then matched using predefined user role affiliation information settings. Set to: Where Policy is the set of all access control rules predefined by the system; p is a single access control policy rule; ⋀ is the logical conjunction of all policies, and all policies must be satisfied; The input to the policy evaluation function is: a single access control policy rule p, user attributes, and environment attributes. The output is True / False, determining whether the policy is satisfied. The user attribute set contains the static trust value calculated earlier. Dynamic trust value and context trust value ; The information resource attribute corresponds to the security level of the information. The set of environmental attributes includes: IP address trust score. Access device trust score .

7. The hierarchical access control method for an information platform according to claim 1, characterized in that, To determine the target information content corresponding to the user's appropriate security level, the corresponding key derivation matrix is ​​queried, including the following steps: Establish an authorization relationship matrix based on the target information content corresponding to the user's appropriate security level. , Indicates user Authorized access to information ; Establish key derivation matrix , Indicates the upper-level base parent key Resource-specific subkeys can be derived. The key derivation matrix is ​​derived from the nonlinear key derivation graph. definition; Key derivation matrix The conditions for dynamic generation are: The derived function is: in, For static permission association tags, =1 indicates that the user has undergone basic RBAC / ABAC authorization and has authorized access to information. Basic permissions; =0 indicates no basic permissions; For users Valid access level, Information access is authorized in the security level allocation policy adapted to the user. The minimum valid access level; To derive the generated resource-specific subkey, This is the parent key for the upper layer. This is the key derivation function. As a unique identifier for users, For timestamps, It generates one-time random numbers to resist replay attacks and ensures that the input for each derivation is random. For bitwise XOR operation, This is a hash message authentication code.

8. The hierarchical access control method for an information platform according to claim 1, characterized in that, Determining whether a user possesses the key derivation path for the target information content includes the following steps: The transitive closure matrix is ​​calculated based on the adjacency matrix D derived from the key. This characterizes all reachable derivation links between all keys; Iterate through the keys held by the user and query the transitive closure matrix: if any key held by the user satisfies the decryption key of the target information... If a valid key derivation path exists, then the key distribution request is rejected; otherwise, if no valid derivation path exists, the request is rejected. This indicates that the element in the i-th row and t-th column of the closure matrix is ​​passed.

9. The hierarchical access control method for an information platform according to claim 1, characterized in that, The decryption key is reconstructed from the user-bound dynamic key fragments to decrypt the target information content and return it to the user, including the following steps: The original decryption key of the target information Divided into A fragment , For the first Fragments of the original decryption key; user To the set of key management nodes When requesting fragments, calculate the first... Each node returns the fragment bound to the user. for: User collection at least A fragment Post-reconstruction of user-bound keys: User collection at least A fragment Reconstruct the user binding key: Set the decryption conditions as follows: in, For the first Fragments of the original decryption key As a unique identifier for users, Expired timestamp A unique random salt value for the r-th shard node; The information decryption key is linked to the validity period of the user's identity. Refactoring functions for threshold secret sharing For the first Each node returns the fragment bound to the user. This is the key derivation function; For information decryption function, Encrypt the information into ciphertext. The original plaintext of the information This is the current system timestamp. This is a function for verifying the legitimacy of user identity. The symbol is a mathematical sign indicating that decryption failed. For bitwise XOR operation, For hash message authentication codes; Based on the reconstructed decryption key, the target information content is decrypted and returned to the user.

10. The hierarchical access control method for an information platform according to claim 1, characterized in that, Diagnose the reasons for the absence of a derivation path and set up a tiered response strategy, including the following steps: The reasons for the absence of a derivation path include insufficient user access level, unauthorized access to target information, or the existence of an authorization relationship but the lack of a derivation path in the key derivation graph. Based on the diagnostic results, a tiered response strategy is implemented: if the user's valid access level is insufficient, a summary or de-identified version of the target information is returned, and the user is prompted to upgrade their authentication to obtain full content access rights; if the user is not authorized to access the target information, a permission-unauthorized prompt is returned and an audit log is recorded; if the authorization relationship exists but the key derivation graph lacks a derivation path, a dynamic path discovery mechanism is implemented. Through the dynamic path discovery mechanism, when a user’s actual access need for target information is detected, a temporary authorization application process is automatically triggered. After approval, a temporary derivation edge is added to the key derivation graph. The temporary derivation edge has a limited validity period and automatically expires after the expiration. Extract the timestamp parameter from all abnormal access attempts that lack a valid key derivation path. User identification parameters The target information is encrypted and indexed, packaged and written into an independent security audit log database with tamper-proof hash signature verification; the system background deploys a timed monitoring script to traverse the audit log database, and when the number of times the same user triggers abnormal interception records within a preset time window exceeds a preset threshold, a security level mismatch warning is triggered.

Images