An internet of things access control policy automatic generation method, system, device and medium

Abstract

The application relates to an Internet of Things access control strategy automatic generation method, system, device and medium, and belongs to the technical field of Internet of Things security and artificial intelligence. The method comprises the following steps: constructing an Internet of Things access control strategy dataset; inputting the Internet of Things access control strategy dataset into a teacher model by adopting a light-weight thinking chain knowledge distillation algorithm; carrying out thinking chain reflection and redundant reasoning elimination of the teacher model and a student model in sequence; obtaining a trained student model; finally inputting a pre-defined system prompt and an Internet of Things scene prompt provided by a user into the trained student model; the model adopts a thinking chain prompt mode to carry out step-by-step reasoning; and an Internet of Things access control strategy is automatically generated. By adopting the method, the Internet of Things access control strategy automatic generation can have the following advantages: the method has explainability, edge efficient deployment capability and automatic and accurate generation capability, and can adapt to the privacy security protection demand.

Description

Technical Field

[0001] This application relates to the fields of IoT security and artificial intelligence technology, and in particular to a method, system, device and medium for automatically generating IoT access control policies. Background Technology

[0002] With the popularization of smart Internet of Things (IoT) devices, in scenarios where multiple users share IoT devices, different users have different technical operation capabilities. Reasonable and balanced allocation of device permissions and standardized technical application models have become the core key to ensuring the legitimate use rights of all users.

[0003] Currently, traditional IoT access control policies (ACPs) rely heavily on manual configuration. However, the large number of devices, complex interaction logic, and diverse permission scenarios in IoT systems make manual configuration unsuitable for efficient and accurate operation and maintenance needs. There is an urgent need to optimize the efficiency and accuracy of policy configuration through automation technology. At the same time, most mainstream automated policy generation algorithms rely on implicit models, making the policy generation process difficult to understand, verify, and trust by ordinary users. This hinders the construction of a transparent and traceable privacy and access control system.

[0004] Large-scale language models, with their superior logical reasoning and content parsing capabilities, can provide reliable technical support for the intelligent generation and logical interpretation of IoT access control policies. However, these models have high demands for computing and storage resources, making them unsuitable for the resource-constrained deployment environments of IoT edge devices. While lightweight, smaller models can adapt to the operating conditions of edge terminals, their own reasoning and generation performance is limited, making it difficult to output high-quality, high-precision access control policies. Furthermore, in the technical path for implementing lightweight models, the learning adaptability of traditional knowledge distillation schemes still needs optimization. They cannot efficiently extract the core reasoning logic and key features of large-scale language models, making it difficult to achieve efficient transfer of large-scale model capabilities to smaller models. The effectiveness and conciseness of model learning can be further improved. Summary of the Invention

[0005] Therefore, it is necessary to provide a method, system, device, and medium for automatically generating IoT access control policies that combines interpretability, efficient edge deployment capability, automated and accurate generation capability, and adaptability to privacy and security protection requirements, in order to address the above-mentioned technical issues.

[0006] A method for automatically generating IoT access control policies, the method comprising: Construct an IoT access control policy dataset; A lightweight thought chain knowledge distillation algorithm is employed. An IoT access control policy dataset is input into a teacher model for zero-shot or few-shot inference. Based on the inference results, the teacher model undergoes thought chain reflection and redundant inference removal to generate a teacher reflection dataset. This dataset is then divided into a training set and a validation set. The training set is used to supervise and fine-tune a student model, resulting in a temporary model. The validation set is then input into the temporary model for inference, and the temporary model undergoes thought chain reflection and redundant inference removal to obtain a student reflection dataset. Finally, the teacher and student reflection datasets are merged to obtain a hybrid reflection dataset, which is then input into the student model for final supervised fine-tuning to obtain a trained student model. Both the teacher and student models are large language models. The predefined system prompts and user-provided IoT scenario prompts are input into the trained student model. The model uses a thought chain prompting approach to perform step-by-step reasoning and automatically generate IoT access control policies. The system prompts are used to limit the policy generation tasks, rules, and output format, and require that the policy generation follow the principles of security, privacy protection, and physical security.

[0007] In one embodiment, an IoT access control policy dataset is constructed, including: The formal expression for IoT access control policies is defined as follows: ; in, Description of IoT scenarios, For character collection, For equipment collection, For the role, For objects, and Forming role-object pairs, As a strategy, A policy generation model is established; simultaneously, the operation types targeted by IoT access control policies are defined, including read, write, and notification; permissions include allow, deny, and optional; and the smallest granularity of IoT access control policies is defined as device, service, and attribute, denoted as: ; in, , and These are the device name, service name, and attribute name, respectively. Permissions; Generate diverse virtual individuals using a character database. For each virtual individual, a large language model automatically generates a description of the IoT scenario. Character Collection and equipment collection The initial IoT scenario; among which, Indicates the first One device, , Total number of devices; Using an embedding model, all devices in the generated initial IoT scenario are vectorized, and the cosine similarity between the vectorized representations of any two devices is calculated. Device clustering and deduplication are performed based on cosine similarity. That is, if the cosine similarity is greater than or equal to a preset threshold, two devices are considered duplicate devices and assigned to the same device cluster. In this context, each device cluster retains only one standardized device description. Ultimately, this results in a standardized set of universal devices. ;in, and These are the vectorized representations of device a and device b, respectively, and the vectorized representation of each device includes the device name vector. and device function vectors ; Indicates the first The first in the device cluster One device , For the first The total number of devices in a device cluster , Number of device clusters; For each device in the initial IoT scenario, the most matching device is retrieved from a standardized set of general devices and replaced to form the final IoT scenario. Then, using a combination of multiple large language models and manual review, the final security, privacy protection, and physical security IoT access control policies are labeled for each triple consisting of role, device attributes, and operations in the final IoT scenario, forming an IoT access control policy dataset, represented as... ;in, Represents a set of roles Object IoT scenario description and equipment collection The input samples of the constructed model This represents the truth value of the IoT access control policy. , This represents the total number of strategies.

[0008] In one embodiment, a combination of multiple large language models and manual review is used to annotate each triple consisting of role, device attribute, and operation in the final IoT scenario with the final IoT access control policy for security, privacy protection, and physical security, including: First, multiple large language models are used to vote on IoT access control policies for each triple consisting of role, device attributes, and operations in the final IoT scenario. If the model voting results are consistent, the currently voted IoT access control policy is directly retained. If the model voting results are inconsistent, human experts review and make a final decision, and the IoT access control policy after the decision is retained. The basis for the multiple large language model voting and human expert review is the security principle, the privacy protection principle, and the physical security principle. The security principle is used to match role division and avoid redundant permissions and permission conflicts. The privacy protection principle is used to protect personal privacy and organizational / trade secrets. The physical security principle is used to ensure the safety of people, objects, and the environment in the IoT scenario.

[0009] In one embodiment, the IoT access control policy dataset is input into the teacher model for zero-shot or few-shot inference. Based on the inference results, the teacher model's thought process is reflected upon and redundant inference is eliminated to generate a teacher reflection dataset, including: IoT access control policy dataset Input Teacher Model ;in, Represents a set of roles Object IoT scenario description and equipment collection The input samples of the constructed model This represents the truth value of the IoT access control policy. , Total number of strategies; For model input samples The process of zero-shot inference in the teacher model is as follows: ; in, Represents the original thought chain, For predictive IoT access control policies, For zero-sample thought chain generation function, ; For model input samples When the teacher model performs few-shot inference, it uses An example The process of few-shot inference is as follows: ; in, For generating a few-sample thought chain function, The first j One example of input, one example of thought chain, and one example of output access control policy; judge and Whether they are consistent, if Then Store in teacher reflection dataset ;like Then, a reflection prompt is constructed, requiring the teacher model to regenerate reasoning only for the erroneous parts of the original thought chain, thus obtaining a corrected thought chain. and will deposit Among them, correcting the thought chain The generation method is represented as follows: ; in, Generate a function for reflecting on the thought chain.

[0010] In one embodiment, the teacher reflection dataset is divided into a training set and a validation set. The student model is supervised and fine-tuned using the training set to obtain a temporary model. The validation set is then input into the temporary model for inference. Based on the inference results, the temporary model's thought process chain is reflected upon and redundant inference is removed to obtain the student reflection dataset, which includes: Teacher reflection dataset Evenly divided into Fold the data, and select 1-fold data in turn as the validation set, and the remaining data... Folded data is used as the training set input for the student model. Supervised fine-tuning is performed to obtain a temporary model. Then, the validation set is input into the temporary model for inference. Based on the inference results, the temporary model's thought chain is reflected and redundant inference is eliminated. The way the temporary model's thought chain is reflected and redundant inference is eliminated is consistent with the teacher model, generating a new thought chain and a revised reflection dataset. By merging the corrected reflection datasets corresponding to each validation set, we obtain the student reflection dataset. , represented as: ; in, Indicates the first The corrected reflection dataset corresponding to each validation set. .

[0011] In one embodiment, the teacher reflection dataset and the student reflection dataset are merged to obtain a hybrid reflection dataset, which is then input into the student model for final supervised fine-tuning to obtain a trained student model, including: Teacher reflection dataset Student Reflection Dataset Merging them yields a hybrid reflection dataset. ; Will Input student model Final supervised fine-tuning is performed to obtain the trained student model. , The training loss function is to minimize the negative log-likelihood loss, expressed as: ; in, The value of the loss function. This indicates the expected calculation. Strategies for student models, The number of steps to output. For the first Each output word element Input to the model, For the output result, and It includes both the reasoning process and the final strategy.

[0012] In one embodiment, predefined system prompts and user-provided IoT scenario prompts are input into a trained student model. The model uses a thought chain prompting approach for step-by-step reasoning to automatically generate IoT access control policies, including: Input the predefined system prompts and user-provided IoT scenario prompts into the trained student model. , Using thought chain prompts for step-by-step reasoning, in <think>The analysis process is output within the tag.< / think> Following the tag, the machine-readable IoT access control policy is output in Markdown JSON code block format; where, <think> and< / think> These are two labels representing the internal reasoning process of a large language model.

[0013] An automatic generation system for Internet of Things (IoT) access control policies, the system comprising: The dataset building module is used to build IoT access control policy datasets; The Mind Chain Knowledge Distillation module employs a lightweight Mind Chain Knowledge Distillation algorithm. It inputs an IoT access control policy dataset into a teacher model for zero-shot or few-shot inference. Based on the inference results, it performs Mind Chain Reflection and Redundant Inference Removal on the teacher model, generating a teacher reflection dataset. This dataset is then divided into a training set and a validation set. The training set is used to supervise and fine-tune a student model, resulting in a temporary model. The validation set is then input into the temporary model for inference. Based on the inference results, the temporary model undergoes Mind Chain Reflection and Redundant Inference Removal, yielding a student reflection dataset. Finally, the teacher and student reflection datasets are merged to obtain a hybrid reflection dataset, which is then input into the student model for final supervised fine-tuning, resulting in a trained student model. Both the teacher and student models are large language models. The policy generation module is used to input predefined system prompts and user-provided IoT scenario prompts into a trained student model. The model uses a thought chain prompting approach to perform step-by-step reasoning and automatically generate IoT access control policies. The system prompts are used to limit the policy generation tasks, rules, and output format, and require that policy generation follow the principles of security, privacy protection, and physical security.

[0014] A computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program performing the following steps: Construct an IoT access control policy dataset; A lightweight thought chain knowledge distillation algorithm is employed. An IoT access control policy dataset is input into a teacher model for zero-shot or few-shot inference. Based on the inference results, the teacher model undergoes thought chain reflection and redundant inference removal to generate a teacher reflection dataset. This dataset is then divided into a training set and a validation set. The training set is used to supervise and fine-tune a student model, resulting in a temporary model. The validation set is then input into the temporary model for inference, and the temporary model undergoes thought chain reflection and redundant inference removal to obtain a student reflection dataset. Finally, the teacher and student reflection datasets are merged to obtain a hybrid reflection dataset, which is then input into the student model for final supervised fine-tuning to obtain a trained student model. Both the teacher and student models are large language models. The predefined system prompts and user-provided IoT scenario prompts are input into the trained student model. The model uses a thought chain prompting approach to perform step-by-step reasoning and automatically generate IoT access control policies. The system prompts are used to limit the policy generation tasks, rules, and output format, and require that the policy generation follow the principles of security, privacy protection, and physical security.

[0015] A computer-readable storage medium having a computer program stored thereon, the computer program performing the following steps when executed by a processor: Construct an IoT access control policy dataset; A lightweight thought chain knowledge distillation algorithm is employed. An IoT access control policy dataset is input into a teacher model for zero-shot or few-shot inference. Based on the inference results, the teacher model undergoes thought chain reflection and redundant inference removal to generate a teacher reflection dataset. This dataset is then divided into a training set and a validation set. The training set is used to supervise and fine-tune a student model, resulting in a temporary model. The validation set is then input into the temporary model for inference, and the temporary model undergoes thought chain reflection and redundant inference removal to obtain a student reflection dataset. Finally, the teacher and student reflection datasets are merged to obtain a hybrid reflection dataset, which is then input into the student model for final supervised fine-tuning to obtain a trained student model. Both the teacher and student models are large language models. The predefined system prompts and user-provided IoT scenario prompts are input into the trained student model. The model uses a thought chain prompting approach to perform step-by-step reasoning and automatically generate IoT access control policies. The system prompts are used to limit the policy generation tasks, rules, and output format, and require that the policy generation follow the principles of security, privacy protection, and physical security.

[0016] The above-mentioned method, system, device, and medium for automatically generating IoT access control policies have the following advantages compared to existing technologies: 1. It possesses lightweight deployment capabilities for edge devices and improves user comprehension efficiency: Based on the two-stage reflection mechanism (teacher reflection + student reflection) in the lightweight thinking chain knowledge distillation algorithm, redundant reasoning steps can be eliminated, efficiently compressing the policy generation and reasoning capabilities of large models (hundreds to hundreds of billions of parameters) into small models (1B~3B parameters), enabling them to run on resource-constrained IoT edge gateways or smart devices while maintaining high accuracy and low latency; and after eliminating redundant reasoning steps, only the reasoning of key error-prone links is retained, shortening the length of the output thinking chain by 37%~54% compared to traditional methods, allowing ordinary IoT users to quickly understand the policy basis.

[0017] 2. Achieve automated and interpretable access control policy generation: Utilize the natural language understanding and reasoning capabilities of the large language model to automatically generate structured Internet of Things access control policies (ACPs) directly from IoT scenario descriptions. The embedded lightweight thought chain (CoT) provides users with explanations of policy decisions, overcoming the poor interpretability problem of traditional black-box algorithms.

[0018] 3. Adapt to privacy and security protection needs: Based on system prompts, the generated IoT access control policies strictly adhere to the principles of security, privacy protection, and physical security, paying particular attention to the power balance in multi-user scenarios, providing automated protection for vulnerable groups (such as children, the elderly, and people with disabilities), and preventing the abuse of technology and the monopoly of power.

[0019] 4. Reduce the environmental footprint of AI systems: By compressing thought chains, invalid computations can be reduced, significantly decreasing the number of tokens consumed by each strategy generation task (e.g., from over 500 tokens to below 280 tokens), thereby reducing energy consumption and aligning with the development concept of green and sustainable AI (Web4Good). Attached Figure Description

[0020] Figure 1 This is a flowchart illustrating an automatic generation method for IoT access control policies in one embodiment. Figure 2This is a schematic diagram of the framework of an automatic generation method for IoT access control policies in one embodiment; Figure 3 This is a flowchart illustrating the lightweight mind chain knowledge distillation algorithm in one embodiment; Figure 4 This is a schematic diagram of the IoT access control policy output by the model in one embodiment; Figure 5 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0022] In one embodiment, such as Figure 1 and Figure 2 As shown, an automatic generation method for IoT access control policies is provided, including the following steps: Step 1: Construct an IoT access control policy dataset.

[0023] In this embodiment, step 1 includes: Step 1.1, Attribute-level policy definition: Define the formal expression of the IoT access control policy as follows: ; in, Description of IoT scenarios, For character collection, For equipment collection, For the role, For objects, and Forming role-object pairs, As a strategy, A policy generation model is established; simultaneously, the operation types targeted by the IoT access control policy are defined, including read, write, and notify; permissions include allow, deny, and optional; and the smallest granularity of the IoT access control policy is defined as device, service, and attribute, denoted as: ; in, , and These are the device name, service name, and attribute name, respectively. For permissions. Specifically, the types of operations and permissions targeted by IoT access control policies can be defined according to the MIJIA IoT protocol.

[0024] Step 1.2, Character-Driven Scene Compositing: Generating diverse virtual individuals using the Persona Hub. (e.g., 1000), for each virtual individual, a large language model (e.g., DeepSeek-V3) automatically generates a description of the IoT scenario. Character Collection and equipment collection In the initial IoT scenario, all elements exist in the same space and time; among them, Indicates the first One device , This represents the total number of devices.

[0025] Step 1.3, Device Deduplication and Standardization: Using an embedding model, all devices in the initial IoT scenario (e.g., 6823 devices) are vectorized, and the cosine similarity between the vectorized representations of any two devices is calculated. Device clustering and deduplication are performed based on cosine similarity. That is, if the cosine similarity is greater than or equal to a preset threshold (such as 0.9), two devices are considered duplicate devices and are grouped into the same device cluster. In this context, each device cluster retains only one standardized device description. Ultimately, this results in a standardized set of universal devices. ;in, and These are the vectorized representations of device a and device b, respectively, and the vectorized representation of each device includes the device name vector. and device function vectors ; Indicates the first The first in the device cluster One device , For the first The total number of devices in a device cluster , This represents the number of device clusters (e.g., 3001).

[0026] In this context, standardized device descriptions refer to defining a standardized device description (MIoT Spec) for each device cluster that conforms to the MIoT protocol. For example, all different types of "temperature and humidity sensors" are standardized into a unified set of names, services, and attributes (such as the service "environment", attributes "temperature" and "humidity", and operation "read").

[0027] Step 1.4, Scene Update and Policy Labeling: For each device in the initial IoT scene, the most matching device is retrieved from a standardized set of general devices and replaced to form the final IoT scene. Then, using a combination of multiple large language models (such as DeepSeek-V3, Qwen2.5-Max, and Doubao1.5-pro) and manual review, the final security, privacy protection, and physical security IoT access control policies are labeled for each triple consisting of role, device attributes, and operation in the final IoT scene, forming an IoT access control policy dataset, represented as... ;in, Represents a set of roles Object IoT scenario description and equipment collection The input samples of the constructed model This represents the truth value of the IoT access control policy. , This represents the total number of policies. In this embodiment, the final IoT access control policy dataset contains approximately 44 training scenarios, 44 development scenarios, 495 test scenarios, and over 16,000 samples and 174,000 role-object pairs.

[0028] Specifically, by combining multiple large language models with manual review, the final IoT access control policies for security, privacy protection, and physical security are labeled for each triple consisting of role, device attribute, and operation in the final IoT scenario, including: First, multiple large language models are used to vote on IoT access control policies for each triple consisting of role, device attributes, and operations in the final IoT scenario. If the model voting results are consistent, the currently voted IoT access control policy is directly retained. If the model voting results are inconsistent, human experts review and make a final decision, and the IoT access control policy after the decision is retained. The basis for the multiple large language model voting and human expert review is the security principle, the privacy protection principle, and the physical security principle. The security principle is used to match role division and avoid redundant permissions and permission conflicts. The privacy protection principle is used to protect personal privacy and organizational / trade secrets. The physical security principle is used to ensure the safety of people, objects, and the environment in the IoT scenario.

[0029] Step 2: A lightweight thought chain knowledge distillation algorithm is used to input the IoT access control policy dataset into the teacher model for zero-shot or few-shot inference. Based on the inference results, the teacher model's thought chain is reflected upon and redundant inference is eliminated to generate a teacher reflection dataset. The teacher reflection dataset is divided into a training set and a validation set. The student model is supervised and fine-tuned using the training set to obtain a temporary model. The validation set is then input into the temporary model for inference. Based on the inference results, the temporary model's thought chain is reflected upon and redundant inference is eliminated to obtain a student reflection dataset. The teacher reflection dataset and the student reflection dataset are merged to obtain a hybrid reflection dataset, which is then input into the student model for final supervised fine-tuning to obtain a trained student model. The teacher model and the student model are large language models.

[0030] The lightweight thinking chain knowledge distillation algorithm in step 2 is abbreviated as STaR-Light (Self-Taught Rethinkwith Lighter Chain-of-Thought) algorithm, and the algorithm flow is as follows: Figure 3 As shown, its core lies in the "reflection" mechanism in both the teacher and student stages to compress and refine the chain of thought.

[0031] In this embodiment, DeepSeek-V3 is used as the teacher model. Using Qwen2.5-1.5B as the student model Step 2 includes: Step 2.1, Initialization: Configure the IoT access control policy dataset. Input Teacher Model ;in, Represents a set of roles Object IoT scenario description and equipment collection The input samples of the constructed model This represents the truth value of the IoT access control policy. , This represents the total number of strategies.

[0032] Step 2.2, Teacher Model Reflection: First, the teacher model performs zero-shot or few-shot inference. Specifically, for the model input samples... The process of zero-shot inference in the teacher model is as follows: ; in, Represents the original thought chain, For predictive IoT access control policies, For zero-sample thought chain generation function, .

[0033] For model input samples When the teacher model performs few-shot inference, it uses An example The process of few-shot inference is as follows: ; in, For generating a few-sample thought chain function, The first j Examples of inputs, thought chains, and output access control policies.

[0034] judge and Whether they are consistent, if Then Store in teacher reflection dataset ;like Then, a reflection prompt is constructed, requiring the teacher model to regenerate reasoning only for the erroneous parts of the original thought chain, thus obtaining a corrected thought chain. and will deposit Among them, correcting the thought chain The generation method is represented as follows: ; in, Generate a function for reflecting on the thought chain.

[0035] Step 2.3, Student Model Reflection: The teacher reflection dataset... Evenly divided into Fold the data, and select 1-fold data in turn as the validation set, and the remaining data... Folded data is used as the training set input for the student model. Supervised fine-tuning is performed to obtain a temporary model. Then, the validation set is input into the temporary model for inference. Based on the inference results, the temporary model's thought chain is reflected upon and redundant inference is removed. The method of reflection and redundant inference removal for the temporary model is consistent with that of the teacher model, generating new thought chains and a revised reflection dataset. By merging the revised reflection datasets corresponding to each validation set, the student reflection dataset is obtained. , represented as: ; in, Indicates the first The corrected reflection dataset corresponding to each validation set. .

[0036] For example, when At that time, the teacher reflection dataset will be used. Uniformly divide the training set and verification set .use Supervised fine-tuning of the student model Qwen2.5-1.5B was performed using LoRA (low-rank adaptive model) (hyperparameters: inner dimension of the low-rank adapter matrix = 16, learning rate = 2 × 10^(-4), batch size = 8, number of iterations = 3) to obtain a temporary model. Then, the validation set Input a temporary model for inference and obtain the inference result. Each sample in the dataset applies the same reflection mechanism as the teacher model, but the guidance model for reflection still uses DeepSeek-V3 to generate new thought chains and datasets. Swap the training and validation sets, and repeat the same operation to obtain... The merged dataset yields the student reflection dataset. .

[0037] Step 2.4, Hybrid Supervision Fine-tuning: Using the teacher reflection dataset Student Reflection Dataset Merging them yields a hybrid reflection dataset. ;Will Input student model Final supervised fine-tuning is performed to obtain the trained student model. , The training loss function is to minimize the negative log-likelihood loss, expressed as: ; in, The value of the loss function. This indicates the expected calculation. Strategies for student models, The number of steps to output. For the first Each output word element Input to the model, For the output result, and It includes both the reasoning process and the final strategy.

[0038] Step 3: Input the predefined system prompts and user-provided IoT scenario prompts into the trained student model. The model uses a thought chain prompting approach to perform step-by-step reasoning and automatically generate IoT access control policies. The system prompts are used to limit the policy generation tasks, rules, and output format, and require that the policy generation follow the principles of security, privacy protection, and physical security.

[0039] In this embodiment, step 3 includes: Step 3.1, Predefine system prompt: Predefine a system prompt that defines the policy generation task, rules and output format, and requires that policy generation follow the principles of security, privacy protection and physical security.

[0040] Step 3.2, Obtain User Input: The user provides an IoT scenario prompt, including natural language text describing an IoT scenario (containing scenario description, device list, role description) and a specified device and its attributes. For example, a scenario called "Real-time Misinformation Detection and Public Awareness System" details roles such as researchers, community center staff, and the public, as well as devices such as content moderation AI. The user then specifies the "Detection Language" attribute generation strategy to be generated for the device "Content Moderation AI".

[0041] Step 3.3, Model Inference: Load the trained student model , Using thought chain prompts for step-by-step reasoning, in <think> The analysis process is output within the tag.< / think> Following the tag, the machine-readable IoT access control policy is output in Markdown JSON code block format; where, <think> and< / think> These are two labeled tags representing the internal reasoning process of a large language model. For example, First of all <think>The tag outputs a concise analysis: "1. Community center staff: Their responsibilities are limited to equipment maintenance; they should not read language data. Policy: Deny. 2. Technical support: Their responsibilities are to resolve network issues; reading data may only be used for troubleshooting. Optional; no real-time notification required…". Then… Output a Markdown JSON block containing IoT access control policies for each role ID for "read" and "notification" operations, such as... Figure 4 As shown. This output can be directly parsed and implemented by the Policy Enforcement Point (PEP) of the IoT system.

[0042] Finally, to validate the trained student model The performance was evaluated on the IoT-ACP test set, using accuracy (Acc.) and average number of tokens generated (#Tokens) as metrics. Accuracy was defined as:

[0043] in For the first Number of strategy pairs in a sample is the indicator function. Experimental results show that the Qwen2.5-1.5B model, fine-tuned by STaR-Light, achieves an accuracy of 65.6% in the zero-sample setting, consuming only 279.8 tokens on average. Compared to the undistilled model (accuracy 16.5%, 432.7 tokens) and naive distillation (63.5%, 468.1 tokens), this represents a significant improvement in accuracy and a substantial reduction in the thought chain length.

[0044] In summary, the aforementioned method for automatically generating IoT access control policies achieves end-to-end automatic generation from natural language descriptions to machine-executable access control policies, eliminating the need for manually writing complex rules and reducing configuration barriers and error rates. While generating policies, the model outputs lightweight explanations of the thought process chain, allowing users to understand "why this policy was generated," overcoming the black-box nature of traditional algorithms and increasing user trust. Through the innovative STaR-Light knowledge distillation method, the reasoning capabilities of large models are successfully compressed and transferred to small models with only 1B–3B parameters. Experiments show that compared to baseline methods, the length of the generated thought process chain is significantly shortened (37% shorter under zero-sample conditions). 44%, a 50% reduction in small sample sizes. It achieves a 54% accuracy rate while maintaining the highest or even better policy generation accuracy, enabling it to operate efficiently on resource-constrained IoT edge devices. Furthermore, the generated policies strictly adhere to principles of security, privacy protection, and personal safety guarantees, making it particularly suitable for protecting vulnerable groups in multi-user IoT environments and effectively preventing technology abuse. In addition, by compressing the thought process, it reduces unnecessary consumption of computing resources, aligning with the development philosophy of green and sustainable AI.

[0045] In one embodiment, an automatic generation system for IoT access control policies is provided, comprising: The dataset building module is used to build IoT access control policy datasets; The Mind Chain Knowledge Distillation module employs a lightweight Mind Chain Knowledge Distillation algorithm. It inputs an IoT access control policy dataset into a teacher model for zero-shot or few-shot inference. Based on the inference results, it performs Mind Chain Reflection and Redundant Inference Removal on the teacher model, generating a teacher reflection dataset. This dataset is then divided into a training set and a validation set. The training set is used to supervise and fine-tune a student model, resulting in a temporary model. The validation set is then input into the temporary model for inference. Based on the inference results, the temporary model undergoes Mind Chain Reflection and Redundant Inference Removal, yielding a student reflection dataset. Finally, the teacher and student reflection datasets are merged to obtain a hybrid reflection dataset, which is then input into the student model for final supervised fine-tuning, resulting in a trained student model. Both the teacher and student models are large language models. The policy generation module is used to input predefined system prompts and user-provided IoT scenario prompts into the trained student model. The model uses a thought chain prompting approach to perform step-by-step reasoning and automatically generate IoT access control policies. The system prompts are used to limit the policy generation tasks, rules, and output format, and require that policy generation follow the principles of security, privacy protection, and physical security.

[0046] For specific limitations regarding an automatic IoT access control policy generation system, please refer to the limitations of an automatic IoT access control policy generation method described above, which will not be repeated here. Each module in the aforementioned automatic IoT access control policy generation system can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0047] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 5 As shown, the computer device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements an automatic generation method for Internet of Things (IoT) access control policies. The display screen can be an LCD screen or an e-ink display screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0048] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0049] In one embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, the processor executing the computer program to perform the following steps: Construct an IoT access control policy dataset; A lightweight thought chain knowledge distillation algorithm is employed. An IoT access control policy dataset is input into a teacher model for zero-shot or few-shot inference. Based on the inference results, the teacher model undergoes thought chain reflection and redundant inference removal to generate a teacher reflection dataset. This dataset is then divided into a training set and a validation set. The training set is used to supervise and fine-tune a student model, resulting in a temporary model. The validation set is then input into the temporary model for inference, and the temporary model undergoes thought chain reflection and redundant inference removal to obtain a student reflection dataset. Finally, the teacher and student reflection datasets are merged to obtain a hybrid reflection dataset, which is then input into the student model for final supervised fine-tuning to obtain a trained student model. Both the teacher and student models are large language models. The predefined system prompts and user-provided IoT scenario prompts are input into the trained student model. The model uses a thought chain prompting approach to perform step-by-step reasoning and automatically generate IoT access control policies. The system prompts are used to limit the policy generation tasks, rules, and output format, and require that the policy generation follow the principles of security, privacy protection, and physical security.

[0050] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor: Construct an IoT access control policy dataset; A lightweight thought chain knowledge distillation algorithm is employed. An IoT access control policy dataset is input into a teacher model for zero-shot or few-shot inference. Based on the inference results, the teacher model undergoes thought chain reflection and redundant inference removal to generate a teacher reflection dataset. This dataset is then divided into a training set and a validation set. The training set is used to supervise and fine-tune a student model, resulting in a temporary model. The validation set is then input into the temporary model for inference, and the temporary model undergoes thought chain reflection and redundant inference removal to obtain a student reflection dataset. Finally, the teacher and student reflection datasets are merged to obtain a hybrid reflection dataset, which is then input into the student model for final supervised fine-tuning to obtain a trained student model. Both the teacher and student models are large language models. The predefined system prompts and user-provided IoT scenario prompts are input into the trained student model. The model uses a thought chain prompting approach to perform step-by-step reasoning and automatically generate IoT access control policies. The system prompts are used to limit the policy generation tasks, rules, and output format, and require that the policy generation follow the principles of security, privacy protection, and physical security.

[0051] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0052] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0053] The above embodiments are merely illustrative of several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make several modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application.< / think>

Claims

1. A method for automatically generating Internet of Things (IoT) access control policies, characterized in that, The method includes: Construct an IoT access control policy dataset; A lightweight thought chain knowledge distillation algorithm is employed. The IoT access control policy dataset is input into the teacher model for zero-shot or few-shot inference. Based on the inference results, the teacher model undergoes thought chain reflection and redundant inference removal to generate a teacher reflection dataset. This teacher reflection dataset is then divided into a training set and a validation set. The training set is used to supervise and fine-tune the student model, resulting in a temporary model. The validation set is then input into the temporary model for inference. Based on the inference results, the temporary model undergoes thought chain reflection and redundant inference removal to obtain a student reflection dataset. Finally, the teacher reflection dataset and the student reflection dataset are merged to obtain a hybrid reflection dataset, which is then input into the student model for final supervised fine-tuning to obtain a trained student model. Both the teacher model and the student model are large language models. The predefined system prompts and user-provided IoT scenario prompts are input into the trained student model. The model uses a thought chain prompting approach to perform step-by-step reasoning and automatically generate IoT access control policies. The system prompts are used to limit the policy generation tasks, rules, and output format, and require that policy generation follow the principles of security, privacy protection, and physical security.

2. The method for automatically generating IoT access control policies according to claim 1, characterized in that, Construct an IoT access control policy dataset, including: The formal expression for IoT access control policies is defined as follows: ； in, Description of IoT scenarios, For character collection, For equipment collection, For the role, For objects, and Forming role-object pairs, As a strategy, A policy generation model is established; simultaneously, the operation types targeted by IoT access control policies are defined, including read, write, and notification; permissions include allow, deny, and optional; and the smallest granularity of IoT access control policies is defined as device, service, and attribute, denoted as: ； in, , and These are the device name, service name, and attribute name, respectively. Permissions; Generate diverse virtual individuals using a character database. For each virtual individual, a large language model automatically generates a description of the IoT scenario. Character Collection and equipment collection The initial IoT scenario; among which, Indicates the first One device , Total number of devices; Using an embedding model, all devices in the generated initial IoT scenario are vectorized, and the cosine similarity between the vectorized representations of any two devices is calculated. Device clustering and deduplication are performed based on cosine similarity. That is, if the cosine similarity is greater than or equal to a preset threshold, two devices are considered duplicate devices and assigned to the same device cluster. In this context, each device cluster retains only one standardized device description. Ultimately, this results in a standardized set of universal devices. ;in, and These are the vectorized representations of device a and device b, respectively, and the vectorized representation of each device includes the device name vector. and device function vectors ; Indicates the first The first in the device cluster One device , For the first The total number of devices in a device cluster , Number of device clusters; For each device in the initial IoT scenario, the most matching device is retrieved from the standardized general device set and replaced to form the final IoT scenario. Then, using a combination of multiple large language models and manual review, the final security, privacy protection, and physical security IoT access control policies are labeled for each triple consisting of role, device attributes, and operation in the final IoT scenario, forming an IoT access control policy dataset, represented as follows: ;in, Represents a set of roles Object IoT scenario description and equipment collection The input samples of the constructed model This represents the truth value of the IoT access control policy. , This represents the total number of strategies.

3. The method for automatically generating IoT access control policies according to claim 2, characterized in that, By combining multiple large language models with manual review, the final IoT access control policies for security, privacy protection, and physical security are labeled for each triple consisting of role, device attribute, and operation in the final IoT scenario, including: First, multiple large language models are used to vote on IoT access control policies for each triple consisting of role, device attributes, and operations in the final IoT scenario. If the model voting results are consistent, the currently voted IoT access control policy is directly retained. If the model voting results are inconsistent, a human expert reviews the vote and makes a final decision, and the IoT access control policy after the decision is retained. The basis for the multiple large language model voting and human expert review is the principles of security, privacy protection, and physical security. The security principle is used to match role division and avoid redundant permissions and permission conflicts. The privacy protection principle is used to protect personal privacy and organizational / trade secrets. The physical security principle is used to ensure the safety of people, objects, and the environment in the IoT scenario.

4. The method for automatically generating IoT access control policies according to claim 1, characterized in that, The IoT access control policy dataset is input into the teacher model for zero-shot or few-shot inference. Based on the inference results, the teacher model's thought process chain is reflected upon and redundant inference is eliminated, generating a teacher reflection dataset, including: IoT access control policy dataset Input Teacher Model ;in, Represents a set of roles Object IoT scenario description and equipment collection The input samples of the constructed model This represents the truth value of the IoT access control policy. , Total number of strategies; For model input samples The process of zero-shot inference in the teacher model is as follows: ； in, Represents the original thought chain, For predictive IoT access control policies, For zero-sample thought chain generation function, ; For model input samples When the teacher model performs few-shot inference, it uses An example The process of few-shot inference is as follows: ； in, For generating a few-sample thought chain function, The first j One example of input, one example of thought chain, and one example of output access control policy; judge and Whether they are consistent, if Then Store in teacher reflection dataset ;like Then, a reflection prompt is constructed, requiring the teacher model to regenerate reasoning only for the erroneous parts of the original thought chain, thus obtaining a corrected thought chain. and will deposit Among them, correcting the thought chain The generation method is represented as follows: ； in, Generate a function for reflecting on the thought chain.

5. The method for automatically generating IoT access control policies according to claim 4, characterized in that, The teacher reflection dataset is divided into a training set and a validation set. The student model is supervised and fine-tuned using the training set to obtain a temporary model. The validation set is then input into the temporary model for inference. Based on the inference results, the temporary model's thought process chain is reflected upon, and redundant inference is removed to obtain the student reflection dataset, which includes: Teacher reflection dataset Evenly divided into Fold the data, and select 1-fold data in turn as the validation set, and the remaining data... Folded data is used as the training set input for the student model. Supervised fine-tuning is performed to obtain a temporary model. Then, the validation set is input into the temporary model for inference. Based on the inference results, the temporary model's thought chain is reflected and redundant inference is eliminated. The way the temporary model's thought chain is reflected and redundant inference is eliminated is consistent with the teacher model, generating a new thought chain and a revised reflection dataset. By merging the corrected reflection datasets corresponding to each validation set, we obtain the student reflection dataset. , represented as: ； in, Indicates the first The corrected reflection dataset corresponding to each validation set. .

6. The method for automatically generating IoT access control policies according to claim 5, characterized in that, The teacher reflection dataset and the student reflection dataset are merged to obtain a hybrid reflection dataset, which is then input into the student model for final supervised fine-tuning to obtain a trained student model, including: Teacher reflection dataset Student Reflection Dataset Merging them yields a hybrid reflection dataset. ; Will Input student model Final supervised fine-tuning is performed to obtain the trained student model. , The training loss function is to minimize the negative log-likelihood loss, expressed as: ； in, The value of the loss function. This indicates the expected calculation. Strategies for student models, The number of steps to output. For the first Each output word element Input to the model, For the output result, and It includes both the reasoning process and the final strategy.

7. The method for automatically generating IoT access control policies according to claim 6, characterized in that, The predefined system prompts and user-provided IoT scenario prompts are input into the trained student model. The model uses a thought chain prompt approach for step-by-step reasoning to automatically generate IoT access control policies, including: Input the predefined system prompts and user-provided IoT scenario prompts into the trained student model. , Using thought chain prompts for step-by-step reasoning, in <think> The analysis process is output within the tag.< / think> Following the tag, the machine-readable IoT access control policy is output in Markdown JSON code block format; where, <think> and< / think> These are two labels representing the internal reasoning process of a large language model.

8. An automatic generation system for Internet of Things (IoT) access control policies, characterized in that, The system includes: The dataset building module is used to build IoT access control policy datasets; The thought chain knowledge distillation module employs a lightweight thought chain knowledge distillation algorithm to input the IoT access control policy dataset into the teacher model for zero-shot or few-shot inference. Based on the inference results, it performs thought chain reflection and redundant inference removal on the teacher model, generating a teacher reflection dataset. The teacher reflection dataset is then divided into a training set and a validation set. The training set is used to supervise and fine-tune the student model, resulting in a temporary model. The validation set is then input into the temporary model for inference. Based on the inference results, the temporary model undergoes thought chain reflection and redundant inference removal, yielding a student reflection dataset. Finally, the teacher reflection dataset and the student reflection dataset are merged to obtain a hybrid reflection dataset, which is then input into the student model for final supervised fine-tuning, resulting in a trained student model. Both the teacher model and the student model are large language models. The policy generation module is used to input predefined system prompts and user-provided IoT scenario prompts into the trained student model. The model uses a thought chain prompting approach to perform step-by-step reasoning and automatically generate IoT access control policies. The system prompts are used to limit the policy generation tasks, rules, and output format, and require that policy generation follow the principles of security, privacy protection, and physical security.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images