Government affair data hierarchical access supervision system and method based on artificial intelligence

Abstract

The application discloses a kind of based on artificial intelligence's government affair data hierarchical access supervision system and method, access context construction module will this time to be accessed data and the associated government affair data that access subject has acquired in preset history window combination form to be evaluated data set;Sensitivity fact deduction module generates candidate sensitive fact based on entity relationship, time relationship, state relationship and business relationship, and determines sensitive grade and recoverable degree, the present application relates to government affair data security management and intelligent access control technical field.The method, for the candidate sensitive fact of recoverable degree exceeding recovery threshold, executes counterfactual removal, reduces precision replacement or semantic masking, determines minimum sensitization data subset by recovery degree span verification, and only to actual data item that causes sensitive grade transition implements granularity reduction, intervalization, association relationship cut-off, delay release or aggregation processing, reduce excessive restriction to non-sensitization data.

Description

Technical Field

[0001] This invention relates to the field of government data security management and intelligent access control, and more specifically, to a government data hierarchical access supervision system and method based on artificial intelligence. Background Technology

[0002] Government data sharing typically implements tiered access based on data catalogs, field tags, and access subject permissions, and reduces the risk of direct leakage of sensitive fields through dynamic desensitization. For example, CN116502273B discloses desensitization of query results based on data lineage analysis field mapping combined with user permissions; CN121351140A discloses control of data service output based on field-level data lineage, permission policies, and desensitization rules. These solutions can improve security control for single queries or service exits, but they primarily target the current request, current result, or preset lineage policies. When the same access subject obtains correlated data through multiple legitimate accesses, multiple individually low-sensitivity results may still combine to recover highly sensitive facts; for derived data formed by statistics, correlation, feature extraction, or model inference, it is also difficult to reclassify based on the actual sensitive information remaining in the derived results from the source data. Furthermore, existing desensitization processes lack a mechanism to locate and specifically address the smallest data combination that causes a jump in sensitivity level. Therefore, a tiered access scheme is needed that can combine historical access results, identify the smallest sensitive data subset, continuously monitor derived data, and accumulate recovery risks. Summary of the Invention

[0003] The purpose of this invention is to provide an artificial intelligence-based hierarchical access supervision system and method for government data, which solves the problems of existing hierarchical access technologies, such as difficulty in identifying combinations of historical access results to recover sensitive facts, difficulty in locating key data combinations that cause sensitivity level jumps, and difficulty in reflecting the actual residual sensitive information in the derived data access levels.

[0004] This invention achieves the above objectives through the following technical solution: a government data hierarchical access supervision system based on artificial intelligence, the system comprising:

[0005] The access context building module is used to obtain government data access requests, parse the fields to be accessed, record range, time range and relationship, and combine the related government data already obtained in the preset history window of the access subject with the data to be accessed this time to form a data set to be evaluated;

[0006] The sensitive fact inference module is used to input the dataset to be evaluated into an AI-powered sensitive fact inference model. This model is implemented using a relational graph encoding network, which generates candidate sensitive facts based on entities, time, state, and business relationships, and determines the sensitivity level and recoverability. Specifically, the recoverable and unrecoverable state values ​​output by the relational graph encoding network for the candidate sensitive facts are subjected to exponential transformations. The ratio of the exponential value corresponding to the recoverable state value to the sum of the exponential values ​​corresponding to the two state values ​​is used as the recoverability level. The recoverability level ranges from 0 to 1; a larger value indicates a higher degree of recovery of the corresponding candidate sensitive fact from the dataset to be evaluated.

[0007] The sensitive subset identification module is used to perform counterfactual processing on candidate sensitive facts whose recoverability exceeds the recovery threshold, and determine the minimum sensitive data subset based on the change in recoverability before and after processing;

[0008] The access result control module is used to perform desensitization processing based on the minimum sensitive data subset, and output the access result after recovery verification;

[0009] The derived data classification module is used to determine the residual contribution of sensitive information based on the difference in the recoverability of derived results before and after counterfactual processing of source data, and to determine the level of derived data accordingly.

[0010] The cumulative monitoring module is used to combine the current output results with historical associated output results for recovery analysis. When the recoverability of the current output is not higher than the recovery threshold and the recoverability of the combined output exceeds the recovery threshold, the cumulative sensitivity level is determined to jump, and the access control parameters are adjusted.

[0011] Furthermore, the access context building module includes:

[0012] The request parsing unit is used to determine the data fields, record range, and time range to be accessed from the government data access request;

[0013] The associated retrieval unit is used to determine the association path between the data to be accessed and the historically acquired data based on the data entity identifier, business object identifier, and time index.

[0014] A historical data filtering unit is used to filter historically acquired data located on the associated path within the preset historical window;

[0015] The set building unit is used to combine the filtered results with the data to be accessed in this session into a set of data to be evaluated, based on entity relationships, time relationships, status relationships, and business relationships.

[0016] Furthermore, the sensitive fact deduction module is configured as follows:

[0017] The data items in the dataset to be evaluated are converted into entity relationship features, time relationship features, state relationship features, and business relationship features.

[0018] The relational features are input into the artificial intelligence sensitive fact inference model to obtain candidate sensitive facts inferred from the data items and their relational combinations.

[0019] For each candidate sensitive fact, output the sensitivity level and recoverability, and compare the recoverability with the recovery threshold corresponding to the sensitivity level;

[0020] Candidate sensitive facts whose recoverability exceeds the recovery threshold and their associated data items are sent to the sensitive subset identification module.

[0021] Furthermore, the sensitive subset identification module includes a counterfact generation unit and a subset determination unit, and identifies candidate sensitive facts whose recoverability exceeds the recovery threshold as target sensitive facts;

[0022] The counterfact generation unit performs removal, precision reduction replacement, or semantic masking on the associated data items of the target sensitive fact, respectively, and forms a counterfact data set while keeping the remaining data items unchanged, and calls the sensitive fact inference module to recalculate the recoverability of the target sensitive fact;

[0023] The subset determination unit performs counterfactual verification on the combination of associated data items in order of increasing number of data items. The combination of data items that can reduce the recoverability of the target sensitive fact from exceeding the recovery threshold to no more than the recovery threshold, and whose recoverability of the target sensitive fact exceeds the recovery threshold again after removing any data item, is determined as the minimum sensitive data subset.

[0024] Furthermore, the access result control module determines the desensitization processing path based on the counterfactual verification results of data items in the minimum anonymized data subset:

[0025] When sensitive facts are restored to depend on data precision, the granularity of the corresponding data items is reduced or ranged.

[0026] When sensitive facts restore the relationships between dependent data items, the corresponding associations are severed;

[0027] When the release sequence of data that the sensitive facts depend on is restored, a delayed release is performed on the corresponding data items;

[0028] When the recovery of sensitive facts depends on individual records, the corresponding data items are converted into aggregate results;

[0029] After each desensitization process, the recoverability of the target sensitive facts is recalculated, and the access result is generated using the minimum processing intensity that ensures the recoverability is not higher than the recovery threshold corresponding to the current access permission for the first time.

[0030] Furthermore, the derived data classification module includes a source association unit and a residual contribution calculation unit;

[0031] The source association unit records the source data and processing relationships involved in the processing of access results into derived data through statistics, association, filtering, feature extraction, model reasoning, or report generation.

[0032] The residual contribution calculation unit generates a first derivative result for the target source data that participates in the processing normally, and generates a second derivative result after removing, replacing or isolating the target source data while keeping other source data and processing unchanged. It calculates the recoverability of the same candidate sensitive fact in the two types of derivative results respectively, and determines the residual contribution of sensitive information of the target source data based on the difference between the two.

[0033] Furthermore, the derived data grading module determines the actual sensitivity level of the derived data according to the highest sensitivity level among the candidate sensitive facts whose recoverability exceeds the corresponding recovery threshold;

[0034] When the recoverability of a candidate sensitive fact is reduced from exceeding the recovery threshold to not exceeding the recovery threshold after the target source data is processed by counterfactual methods, the target source data is determined as the effective source of residual sensitive information for that candidate sensitive fact.

[0035] When the recoverability before and after counterfactual processing is on the same side of the recovery threshold, the actual sensitivity level of the derived data is not increased separately based on the preset sensitivity level of the target source data.

[0036] Furthermore, the cumulative monitoring module includes a historical output retrieval unit, a combined recovery unit, and a strategy feedback unit;

[0037] The historical output retrieval unit extracts historical associated output results within a preset historical window that have entity, time, status, or business relationships with the current output result, based on the access subject identifier.

[0038] The combined recovery unit calculates the recoverability of the current output result alone and the recoverability of the current output result combined with historical associated output results, respectively.

[0039] When the recoverability of the current output result individually is not higher than the recovery threshold and the recoverability of the combined result exceeds the recovery threshold, a cumulative sensitivity level transition is determined, and the policy feedback unit generates subsequent access control parameters.

[0040] Furthermore, the subsequent access control parameters include the upper limit of access level, the granularity of data fields allowed to be released, the data association dimensions allowed to be retained, and the result release method;

[0041] The strategy feedback unit determines the target field or target association relationship to participate in the combined recovery based on the association path between the historical association output results that caused the cumulative sensitivity level jump and the current output results, and sends the corresponding control parameters to the access context construction module and the access result control module.

[0042] When a subsequent request for access to government data arrives, the access context construction module and the access result control module restrict the data granularity or target association of the target field according to the control parameters, and re-perform sensitive fact recovery verification to ensure that the subsequent access control matches the data status already obtained by the access subject.

[0043] An AI-based hierarchical access control method for government data is applied to the aforementioned AI-based hierarchical access control system for government data. The method includes:

[0044] Obtain government data access requests, and combine the data to be accessed this time with the related government data already obtained by the accessing subject within a preset historical window to form a data set to be evaluated;

[0045] Based on the entity relationships, time relationships, state relationships, and business relationships in the dataset to be evaluated, an artificial intelligence sensitive fact inference model implemented using a relational graph coding network is used to generate candidate sensitive facts, and the sensitivity level and recoverability of each candidate sensitive fact are determined.

[0046] For candidate sensitive facts whose recoverability exceeds the recovery threshold, counterfactual removal, precision reduction replacement, or semantic masking are performed on the associated data items, and the minimum sensitive data subset is determined based on the change in recoverability before and after processing.

[0047] Based on the minimum sensitive data subset, perform granularity reduction, intervalization, association severing, delayed release, or aggregation processing, and output the access result after recovery verification;

[0048] When the access results generate derivative data, the residual contribution of sensitive information and the access level of the derivative data are determined by comparing the recoverability of the two types of derivative results generated after normal processing of the target source data and after counterfactual processing.

[0049] The current output result is combined with the historical associated output results for recovery analysis. When the recoverability of the current output result alone is not higher than the recovery threshold and the recoverability of the combined result exceeds the recovery threshold, the cumulative sensitivity level jump is determined, and the subsequent access control parameters are adjusted accordingly.

[0050] The beneficial effects of this invention are as follows:

[0051] 1. This invention combines the data to be accessed with historically related government data that the accessing entity has actually obtained to construct an access context, thereby changing access supervision from a static judgment of the confidentiality level of a single field to a dynamic judgment of the ability to recover sensitive facts after data combination. It can identify the risk of recovering highly sensitive facts formed after multiple legitimate low-sensitivity accesses are combined.

[0052] 2. This invention performs counterfactual removal, precision reduction replacement, or semantic masking on candidate sensitive facts whose recoverability exceeds the recovery threshold. It determines the minimum sensitive data subset by verifying the recovery level and only performs granularity reduction, intervalization, relational severing, delayed release, or aggregation processing on data items that actually cause a sensitivity level jump, thereby reducing excessive restrictions on non-sensitive data.

[0053] 3. This invention addresses the derived data generated from access results through statistics, correlation, filtering, feature extraction, model reasoning, or report generation. By comparing the two types of derived results formed after normal processing and counterfactual processing of the target source data, it determines the residual contribution of sensitive information and dynamically determines the access level based on the sensitive facts that can actually be recovered from the derived results, avoiding mechanical inheritance based solely on the highest preset level of the source data.

[0054] 4. This invention performs combined recovery analysis on the current output results and the historical associated output results of the same access subject. When the combined output exceeds the recovery threshold but the single output does not meet the sensitive recovery conditions, the cumulative sensitivity level jump is determined, and the determination result is fed back to the subsequent access control process to realize closed-loop adjustment of access level, field granularity, association dimension and result release method. Attached Figure Description

[0055] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0056] Figure 1 This is a flowchart illustrating the overall method of the present invention;

[0057] Figure 2 This is a schematic diagram of the key processing flow of the present invention, including sensitive fact deduction, identification of the minimum sensitive data subset, classification of derived data, and determination of cumulative sensitivity level transition.

[0058] Figure 3 This is a schematic diagram of the system structure of the present invention. Detailed Implementation

[0059] The technical solution of the present invention will be further described below with reference to the accompanying drawings and specific embodiments. It should be noted that the following embodiments are used to illustrate the technical concept and implementation process of the present invention, and are not intended to limit the scope of protection of the present invention. Those skilled in the art can adapt the implementation parameters according to specific government data types, business update cycles, and regulatory requirements without departing from the technical concept of the present invention.

[0060] Example 1:

[0061] like Figures 1 to 3 As shown, this embodiment provides an AI-based hierarchical access supervision system for government data, including an access context construction module, a sensitive fact inference module, a sensitive subset identification module, an access result control module, a derived data classification module, and a cumulative supervision module. Each module interacts with the government data supervision platform through its data interface to complete tasks such as receiving access requests, associating historical data, inferring sensitive facts, identifying key sensitive data, controlling access results, reclassifying derived data, and accumulating historical output supervision.

[0062] The access context construction module receives government data access requests submitted by the accessing entity, parses the requests, and obtains the data fields to be accessed, record range, time range, and data relationships corresponding to this request. The data fields to be accessed are used to limit the accessed content, the record range is used to limit the accessed objects, the time range is used to limit the data formation time or business occurrence time, and the relationships are used to characterize the entity relationships, time relationships, status relationships, and business relationships that can be formed between the data to be accessed and other government data.

[0063] After the accessing entity completes identity authentication, a unique entity identifier is configured for that entity, and the data content that has been actually released to that entity is recorded according to the entity identifier. When the accessing entity sends another access request, the historical access records in the preset history window are retrieved based on the entity identifier, and historically acquired data that can establish a path to the currently accessed data is extracted from them.

[0064] The historical window is determined based on the business update cycle of the regulated government data. One complete update cycle of the corresponding dataset is considered a business cycle, and the historical window must cover at least three complete business cycles. When the three business cycles are less than 30 days, the historical window is set to 30 days; when the three business cycles exceed 180 days, the historical window is set to 180 days. For continuous business records with a unified item number that have not yet ended, the corresponding relationship is retained until the item ends, and they are not prematurely truncated due to the general historical window boundary.

[0065] For example, if a certain type of business status data is updated every 30 days, the historical window is set to 90 days; if three business cycles of a certain type of daily updated data are less than 30 days, the historical window is set to 30 days. This rule ensures that the historical window covers multiple business cycles that can form continuous state extrapolation, while avoiding the continuous expansion of the calculation scope caused by the indefinite accumulation of historical data.

[0066] The access context construction module determines whether there is a relationship between the currently accessed data and historically acquired data based on the data entity identifier, business object identifier, item number, and time index. An entity relationship is established when two data items point to the same natural person, legal person, item, or business object; a time relationship is established when the formation times of two data items have a sequential, inclusive, or adjacent relationship; a status relationship is established when multiple data items reflect the processing status of the same business object at different stages; and a business relationship is established when multiple data items belong to different processing stages of the same government matter.

[0067] The data to be accessed this time will be combined with the historical data already acquired on the aforementioned associated paths to form a data set to be evaluated. This will enable subsequent sensitive fact analysis to not only be based on this request, but also to identify the risk of sensitive fact recovery formed by combining the newly added data with historical results.

[0068] Before inputting the dataset to be evaluated into the AI-powered sensitive fact inference model, the input data undergoes unified processing. For continuous numerical fields, the upper and lower boundaries of valid values ​​are determined based on training samples, and the valid range is linearly mapped to 0–1; data below the valid lower boundary is mapped to 0, and data above the valid upper boundary is mapped to 1. Time intervals are uniformly converted to hours and then normalized to 0–1; categorical fields use discrete encoding; relation types are encoded as entity relations, time relations, state relations, and business relations, respectively. After the above processing, the numerical features input into the AI-powered sensitive fact inference model are all dimensionless parameters.

[0069] The sensitive fact inference module transforms the dataset to be evaluated into a relational graph structure, where government data items are set as data nodes, and entity relationships, temporal relationships, state relationships, and business relationships are set as corresponding types of relational edges. In one specific implementation, the AI ​​sensitive fact inference model is implemented using a relational graph encoding network, with four layers of relational graph encoding, a hidden feature dimension of 128, eight attention heads per layer, and a random inactivation rate of 0.1.

[0070] The model parameters mentioned above are determined using training and validation sets. Specifically, candidate parameter combinations are formed using hidden feature dimensions of 64, 128, and 256, network layers of 2, 4, and 6, and attention heads of 4 and 8. These combinations are then trained and validated separately under the same training set conditions. When the difference between the macro-average classification evaluation value and the highest value of multiple candidate parameter combinations on the validation set does not exceed 1 percentage point, the parameter combination with lower computational resource consumption is selected. In this embodiment, the hidden feature dimension is determined to be 128, the network layer number is 4, and the attention head number is 8, based on this rule.

[0071] The model training employs an adaptive moment estimation optimizer, with an initial learning rate set to 10 to the power of negative 4, a batch size of 64, and a maximum number of training epochs of 100. Training stops when the validation set loss does not decrease after 10 consecutive training epochs. The impact of entity relationships, temporal relationships, state relationships, and business relationships on the recovery of candidate sensitive facts is learned during model training, without manually assigning relation weights for linear weighting.

[0072] The AI-powered sensitive fact inference model outputs recoverable and unrecoverable state values ​​corresponding to candidate sensitive facts based on the dataset to be evaluated, and determines the recoverability of candidate sensitive facts accordingly, as shown in formula (1):

[0073]

[0074] In the formula, Indicates the use of the dataset to be evaluated Restore candidate sensitive facts The degree to which sensitive facts can be recovered; This represents the output value of the AI-powered sensitive fact inference model for the recoverable state of candidate sensitive facts; This represents the output value for the unrecoverable state of a candidate sensitive fact.

[0075] In the formula, the recoverability ranges from 0 to 1 and is a dimensionless value. A larger value indicates a higher degree of recovery of the corresponding candidate sensitive fact from the current dataset to be evaluated. After the model training is completed, the output probability is calibrated using independent validation data that did not participate in the model training, so that the recoverability corresponding to different batches of data is comparable.

[0076] This implementation classifies candidate sensitive facts into four sensitivity levels: first, second, third, and fourth, with the sensitivity increasing sequentially. Each sensitivity level corresponds to a recovery threshold, which is determined by independent validation data rather than directly using fixed empirical values ​​lacking sample support.

[0077] Specifically, for each sensitivity level, verification samples with real recoverable and unrecoverable markers are established. Candidate recovery thresholds are searched within the range of 0.30 to 0.95 with a step size of 0.01. First, candidate thresholds that ensure the missed detection rate of the corresponding sensitive facts does not exceed 1% are selected. Then, the threshold with the largest value among the candidate values ​​that meet this condition is chosen as the recovery threshold for the current sensitivity level. This approach controls the risk of missed detection of highly sensitive facts while reducing unnecessary access restrictions. The higher the sensitivity level, the higher the corresponding recovery threshold should be compared to the recovery threshold of lower sensitivity levels.

[0078] For example, if the recovery thresholds for the first, second, third, and fourth sensitivity levels are 0.80, 0.70, 0.60, and 0.50 respectively based on verification samples in a certain regulatory cycle, then these thresholds will be used in the current regulatory cycle. When the number of newly added valid verification samples for a certain sensitivity level reaches 1000 in the next regulatory cycle, the corresponding threshold will be re-determined according to the same rules; if the number of newly added valid verification samples is less than 1000, the recovery threshold already verified in the previous regulatory cycle will be used. The above values ​​are the results of an example obtained according to the threshold determination rules and are not fixed limitations.

[0079] When the recoverability of a candidate sensitive fact is not higher than the corresponding recovery threshold, the current access processing status is maintained; when the recoverability exceeds the corresponding recovery threshold, the candidate sensitive fact is identified as the target sensitive fact, and the data items related to the target sensitive fact are sent to the sensitive subset identification module.

[0080] Example 2:

[0081] This embodiment further illustrates the working process of the sensitive subset identification module and the access result control module based on Embodiment 1. After receiving the target sensitive fact, the sensitive subset identification module extracts data items from the data set to be evaluated that can reach the target sensitive fact through entity relationships, time relationships, state relationships, or business relationships, and uses the extracted data items as candidate data items for counterfactual processing.

[0082] Counterfactual processing is performed on each candidate data item. Counterfactual processing includes removal, precision reduction replacement, or semantic masking. Removal means excluding the current target data item from the sensitive fact inference while keeping other data items and relational structures unchanged; precision reduction replacement means replacing the target data item with data of lower precision, such as replacing a specific date with a month, or replacing a precise value with a numerical range; semantic masking means retaining the data position of the target data item in the business process, but masking the specific semantic content that can directly represent the sensitive fact.

[0083] After performing counterfactual processing on any candidate data item, a corresponding counterfactual data set is formed. This counterfactual data set is then re-input into the sensitive fact deduction module to obtain the degree of recoverability of the sensitive fact after counterfactual processing. The degree of sensitization effect of the candidate data item on the target sensitive fact is determined according to formula (2):

[0084]

[0085] In the formula, Indicates the first The data item is sensitive to the target fact The degree of sensitization effect; Indicates the degree of recoverability of the target sensitive facts before counterfactual processing; Indicates the first The recoverability of each data item after counterfactual processing. The degree of sensitization effect ranges from 0 to 1 and is a dimensionless value; when the recoverability after counterfactual processing is not reduced, the corresponding degree of sensitization effect is recorded as 0 to avoid local fluctuations in the model being interpreted as positive sensitization effects.

[0086] When determining the minimum subset of sensitized data, instead of manually weighting multiple sensitization impacts to form a comprehensive risk score, a combined verification is performed based on whether the recoverability of the sensitive fact crosses the corresponding recovery threshold. First, counterfactual verification is performed on each candidate data item individually. If no single data item can reduce the recoverability of the target sensitive fact to no more than the recovery threshold, counterfactual verification is performed on the combination of two data items. If the condition still cannot be met, the number of data items in the combination is increased sequentially.

[0087] When a combination of data items first appears that reduces the recoverability of the target sensitive fact to no higher than the recovery threshold, the number of data items in the current combination is determined as the minimum cardinality. When multiple combinations of data items with the same minimum cardinality exist, the combination of data items with the lowest recoverability of the target sensitive fact after counterfactual processing is selected as the minimum sensitized data subset; further verification is performed by removing any data item from the subset. If the recoverability exceeds the recovery threshold again, the combination is confirmed to satisfy the minimumity requirement.

[0088] For example, a certain sensitive fact belongs to the third sensitivity level, with a recovery threshold of 0.60. The recoverability of the dataset to be evaluated is 0.74. After counterfactual processing of data item A, the recoverability decreases to 0.67; after counterfactual processing of data item B, it decreases to 0.65; and after counterfactual processing of data item C, it decreases to 0.69. Processing any of the three data items individually does not reduce the recoverability to no higher than 0.60. Continuing with the combined verification of two data items, processing A and B simultaneously reduces the recoverability to 0.54; processing A and C simultaneously reduces it to 0.63; and processing B and C simultaneously reduces it to 0.61. Therefore, the combination of data items A and B is the first to change the sensitive fact from exceeding the recovery threshold to no higher than the recovery threshold, and no single data item processing can achieve this result. Based on this, the combination of data items A and B is determined as the minimum sensitive data subset.

[0089] The access result control module only performs desensitization processing on the smallest subset of sensitive data, and does not perform uniform desensitization on all fields in the dataset to be evaluated. For date fields, a four-level granularity is formed according to the specific date, month, quarter, and year, from fine to coarse; for address fields, a four-level granularity is formed according to the specific house number, street, district, and city; for continuous numerical fields, the interval width is determined according to the business-valid value range of the corresponding dataset, with the initial interval width set to 5% of the valid value range. If the recovery verification still fails after processing, it is adjusted to 10%, 20%, and 40% respectively.

[0090] For aggregation processing, the number of aggregated records is verified sequentially at 5, 10, 20, and 50 records; for delayed release, the candidate delay time is verified sequentially at 24 hours, 72 hours, and 7 days. The above values ​​are candidate processing parameters and are not directly used as thresholds for sensitivity level judgment. The access result control module determines the actual processing parameters based on the minimum processing intensity required to ensure that the recoverability of the target sensitive fact does not initially exceed the corresponding recovery threshold.

[0091] For example, if reducing the specific date to a month lowers the recoverability of the target sensitive fact from 0.74 to 0.57, which is already below 0.60, then further reducing the data precision should be stopped and monthly granularity should be used for output. If the monthly granularity is still 0.64, then the precision should be further reduced to quarterly granularity and recovery verification should be performed again. For severing associations, starting from the association paths involved in the recovery of the target sensitive fact in the smallest sensitive data subset, the connection identifiers used for result association are canceled one by one. The recoverability is recalculated after each association is canceled, and the severing of associations stops once the recovery conditions are met for the first time.

[0092] After the desensitization process is completed, the processed dataset is input into the sensitive fact deduction module again. If the recoverability of the target sensitive fact is not higher than the recovery threshold corresponding to the current access permission, the access result is output; if it still exceeds the recovery threshold, the processing intensity continues to increase according to the above rules until the sensitive fact recovery verification is passed. This forms a closed-loop processing procedure: target sensitive fact identification, counterfactual data item verification, minimum sensitive data subset determination, minimum sufficient desensitization, and re-recovery verification.

[0093] Example 3:

[0094] This embodiment further illustrates the process of sensitive information residue analysis and dynamic classification of derived data based on the aforementioned embodiments. In actual business processes, the results of government data access can be further processed through statistics, correlation, filtering, feature extraction, model inference, or report generation to form derived data.

[0095] When derived data is generated, the derived data classification module records the source data, source fields, and data processing paths involved in this data processing, establishing the source association between the derived data and the source data. For target source data that requires residual analysis of sensitive information, when the target source data participates in data processing normally, the first derived result is generated according to the original data processing procedure. Subsequently, while keeping other source data, data processing logic, and model parameters unchanged, the target source data is removed, replaced, or isolated, and the same data processing procedure is re-executed to generate the second derived result.

[0096] Here, "removal" means canceling the target source data from participating in the current data processing; "replacement" means using alternative data that does not carry the target sensitive information to participate in the processing; and "isolation" means blocking the data association between the target source data and other source data, but keeping other processing conditions unchanged. The first and second derived results are input into the sensitive fact inference module to determine the recoverability of their corresponding candidate sensitive facts. The residual contribution of the target source data to the sensitive information in the current derived data is determined according to formula (3):

[0097]

[0098] In the formula, Indicates the source data of the target The residual contribution of sensitive information in the current derived data; This represents the set of candidate sensitive facts that can be associated with the current derived data; This indicates that the first derived result addresses candidate sensitive facts. The degree of recoverability; This indicates the degree of recoverability of the second derived result formed after counterfactual processing of the target source data for the same candidate sensitive fact. The residual contribution of sensitive information ranges from 0 to 1 and is a dimensionless value.

[0099] This implementation determines the residual contribution of sensitive information by using the maximum absolute value of the change in the recoverability of candidate sensitive facts, rather than by weighting and summing the recovery results of multiple sensitive facts. This ensures that the significant residual impact of the target source data on any highly sensitive fact is not weakened by the participation of other low-contribution sensitive facts in the averaging calculation. The residual contribution of sensitive information is used to determine whether the target source data retains information in the derived data that can affect the recovery of sensitive facts. The final access level of the derived data is still determined based on whether the candidate sensitive facts reach the corresponding recovery threshold, rather than directly mapping multiple residual contributions to a sensitivity level.

[0100] For example, for a candidate sensitive fact at the third sensitivity level, the recoverability of the first derived result is 0.63. After isolating the target source data, the recoverability of the second derived result decreases to 0.44, and the residual contribution of the sensitive information corresponding to the target source data is 0.19. Since the first derived result's 0.63 is higher than the third sensitivity level recovery threshold of 0.60, while the second derived result's 0.44 is lower than 0.60, the target source data is determined to be a valid residual source of the third sensitivity level sensitive fact.

[0101] For source data with a high original preset sensitivity level, if after aggregation, the recoverability of the first and second derived results for the corresponding sensitive facts is 0.35 and 0.33 respectively, and neither exceeds the corresponding recovery threshold, then the derived data will not be directly determined to the same level simply because the original sensitivity level of the source data is high. Conversely, even if the original sensitivity levels of multiple source data involved in the processing are low, if the derived data formed by association, filtering, or model inference can make the recoverability of a candidate sensitive fact with a higher sensitivity level exceed the corresponding recovery threshold, the derived data will still be adjusted to the access level corresponding to that sensitive fact.

[0102] Therefore, the access level of derived data is determined based on the sensitive facts that can actually be recovered after data processing, rather than directly inheriting the highest preset level of the source data.

[0103] Example 4:

[0104] This embodiment further illustrates the cumulative sensitivity level transition judgment process of the cumulative monitoring module when the same access subject continuously obtains multiple access results. For each piece of data actually released by the access result control module, the cumulative monitoring module records the access subject identifier, output fields, data range, formation time, business object, associated identifier, and actual output result, and maintains the historical output set corresponding to the access subject according to the same historical window determination rules as in Embodiment 1.

[0105] When the same accessing subject obtains the current output result again, the historical output set is retrieved according to the subject identifier, and historical associated output results with entity relationship, time relationship, status relationship or business relationship with the current output result are selected to form a historical associated output set. First, the current output result is input into the sensitive fact inference module to obtain the recoverability of the candidate sensitive facts; then the current output result is combined with the historical associated output set to form a combined output data set, and re-input into the sensitive fact inference module to obtain the recoverability of the combined sensitive facts. In order to characterize the increment caused by the addition of historical associated outputs to the recovery of candidate sensitive facts, the cumulative recovery increment is determined according to formula (4):

[0106]

[0107] In the formula, This indicates that adding historical correlation outputs affects candidate sensitive facts. The resulting cumulative recovery increment; This indicates the degree to which sensitive facts obtained solely from the current output are recoverable; This indicates the degree to which sensitive facts can be recovered after combining the current output with the set of historical related outputs. The cumulative recovery increment ranges from 0 to 1 and is a dimensionless value. It is only used to characterize the recovery increment brought about by historical related outputs and to locate key related paths. No additional manual risk threshold is set separately.

[0108] The cumulative sensitivity level transition is uniformly determined by the recovery threshold of the corresponding candidate sensitive fact. When the recoverability of the current output result alone is not higher than the recovery threshold, but the recoverability of the current output result combined with the historical associated output results exceeds the recovery threshold, it is determined that the current access has caused a cumulative sensitivity level transition for the candidate sensitive fact.

[0109] For example, for a candidate sensitive fact at the third sensitivity level, the recovery threshold is 0.60. The recoverability of the current output result alone is 0.42, which does not exceed the recovery threshold. However, after combining the current output result with historical output results from the access subject that have business relevance within the last 90 days, the recoverability reaches 0.68, corresponding to a cumulative recovery increment of 0.26. Since the current result is not higher than 0.60 while the combined result exceeds 0.60, a cumulative sensitivity level transition to the third sensitivity level is determined to have occurred.

[0110] After determining the cumulative sensitivity level jump, the cumulative monitoring module performs a backtracking of the associated path to identify the historical associated outputs that caused the combined result to cross the recovery threshold, as well as the target fields and target associations in the current output, and generates subsequent access control parameters accordingly. These subsequent access control parameters include the access level cap, the granularity of data fields allowed to be released, the data association dimensions allowed to be retained, and the result release method.

[0111] If the cumulative recovery is mainly caused by the precision of the current field, the precision of the corresponding field is reduced step by step according to the granularity level of Example 2; if it is mainly caused by the direct relationship between the current data and the historical data, the corresponding association identifier is cut off first; if it is mainly caused by multiple accesses in a short period of time, 24 hours, 72 hours and 7 days are used as candidate delayed release parameters in sequence, and the combined recovery verification is re-executed after each adjustment.

[0112] For example, if reducing the specific date to a month lowers the recoverability of combined sensitive facts from 0.68 to 0.57, then the month will be used as the subsequent allowable release granularity, and it will not be further reduced to a quarter or year. If the recoverability at the month granularity is still 0.63, then it will be further reduced to a quarter granularity and re-verified. This allows the access control policy to dynamically adjust based on the actual state of the information already obtained by the accessing subject, rather than configuring fixed permissions solely based on the accessing subject's identity.

[0113] Example 5:

[0114] This embodiment illustrates the collaborative relationship between the aforementioned modules using a complete government data access process. Assume the update cycle for a certain government business data is 30 days. Based on the three complete business cycle rules in Embodiment 1, the corresponding access history window is set to 90 days. The accessing entity has already obtained several status data related to the target business object within the last 90 days, and is now requesting data item A, data item B, and other business result fields again.

[0115] The access context construction module determines the entity relationship, temporal relationship, and business relationship between the data to be accessed and the historically acquired data based on the business object identifier, event number, and time index. It then combines these two data sets to form the data set to be evaluated. The AI-powered sensitive fact inference model analyzes the data set to be evaluated and identifies a candidate sensitive fact at the third sensitivity level. Its recoverability is 0.74, which is higher than the recovery threshold of 0.60 for the third sensitivity level determined through independent verification data in the current regulatory cycle. Therefore, this candidate sensitive fact is identified as the target sensitive fact.

[0116] The sensitive subset identification module performs counterfactual verification on the relevant data items. After removing or reducing the precision of data item A, the recoverability of the target sensitive fact decreases from 0.74 to 0.67; after processing data item B, the recoverability decreases to 0.65; processing either data item individually does not allow the target sensitive fact to exit the recovery state. After simultaneously counterfactually processing data items A and B, the recoverability decreases to 0.54, which is lower than 0.60, and processing either data item A or B individually cannot achieve the threshold crossing. Therefore, the combination of data items A and B is determined as the minimum sensitive data subset.

[0117] The access result control module further analyzes how data item A and data item B participate in the sensitive fact recovery. If data item A is sensitive due to date precision, the granularity of data item A is first reduced from a specific date to a month. If the association between data item B and the historical status field directly participates in the target sensitive fact recovery, the direct association identifier corresponding to data item B is removed. After processing, the recovery verification is performed again. The recoverability of the target sensitive fact decreases to 0.48, which is lower than the third sensitivity level recovery threshold of 0.60. Therefore, further reduction of data precision is stopped, and the processed access result is output.

[0118] When the access results are further processed into report generation to form derived data, the derived data classification module establishes the source association between the report results and the source data. When the target source data participates normally in report generation, it forms the first derived result; after isolating the target source data, keeping the remaining data and report generation rules unchanged, it forms the second derived result. The recoverability of the first derived result for the target's third-level sensitive facts is 0.63, and the second derived result is 0.44, corresponding to a sensitive information residual contribution of 0.19. Since the target sensitive facts exceed 0.60 when the target source data participates normally, but fall below 0.60 after isolation, this source data is identified as a valid source of sensitive information residuals, and access control is implemented on the current derived result according to the third-level sensitivity requirements.

[0119] During a subsequent access, the same accessing entity obtained another current output result. This result, on its own, showed a recoverability of 0.42 for a sensitive fact at the third sensitivity level, which did not exceed the recovery threshold of 0.60. The cumulative monitoring module combined the current output result with the accessing entity's historical associated output results from the past 90 days, resulting in a combined recoverability of 0.68 and a cumulative recovery increment of 0.26. Furthermore, the combined result increased from not exceeding the recovery threshold to exceeding it, thus indicating a cumulative sensitivity level jump. The system then traced back the target field and associated relationships that caused the jump, feeding back the corresponding results to the access context construction module and the access result control module. When the accessing entity made another data request, the system restricted the data granularity of the identified target fields or severed the corresponding associated dimensions based on the feedback results, and then re-performed the sensitive fact recovery verification.

[0120] Through the above implementation process, the present invention forms a continuous closed loop from combining current and historical access data, artificial intelligence sensitive fact deduction, identification of counterfactual minimum sensitive data subset, targeted desensitization, analysis of residual sensitive information in derived data, to the supervision of the cumulative sensitivity level leap of multiple accesses.

[0121] For fields such as amount, time, age, distance, or quantity, normalization is performed according to the corresponding field type before entering the AI-powered sensitive fact inference model to avoid different physical dimensions directly participating in the same numerical calculation. The influence parameters of relational features are obtained through model training; the recovery threshold is determined by independent validation data under the constraint of the false negative rate; granularity, interval width, aggregation quantity, and delayed release time are determined according to the minimum processing intensity that enables the degree of recovery of sensitive facts to first meet the access permission conditions. Thus, the model parameters, recovery threshold, and access control parameters all have clear determination rules and correspond to the technical characteristics of historical related data combination, minimum sensitive data subset identification, derivative data reclassification, and cumulative sensitivity level transition.

[0122] Based on the same inventive concept, this embodiment also provides an artificial intelligence-based method for hierarchical access supervision of government data. The method sequentially performs access request parsing and historical associated data combination, candidate sensitive fact deduction, identification of the minimum sensitive data subset of counterfactual data, targeted desensitization and recovery verification, residual analysis of sensitive information in derived data, recovery of historical output combination, and subsequent adjustment of access control parameters. Each processing step is executed by the corresponding module in the above system, and the specific parameter determination rules are consistent with the aforementioned embodiments.

[0123] Those skilled in the art will understand that the above modules can be implemented as software programs, processor-executed program instructions, or a combination of software and hardware. Each module can be deployed on the same government data supervision platform, or it can be distributed according to the deployment structure of government data catalog management, access gateway, model service, and audit service. It can also exchange the set of data to be evaluated, the results of sensitive fact inference, the minimum sensitive data subset, access results, the access level of derived data, and the cumulative sensitivity level transition judgment results through a secure data interface.

Claims

1. A government data hierarchical access supervision system based on artificial intelligence, characterized in that: The system includes: The access context building module is used to obtain government data access requests, parse the fields to be accessed, record range, time range and relationship, and combine the related government data already obtained in the preset history window of the access subject with the data to be accessed this time to form a data set to be evaluated; The sensitive fact inference module is used to input the dataset to be evaluated into an AI-powered sensitive fact inference model. This model employs a relational graph encoding network to generate candidate sensitive facts based on entities, time, state, and business relationships, determining the sensitivity level and recoverability. Specifically, the recoverable and unrecoverable state values ​​output by the relational graph encoding network for the candidate sensitive facts are subjected to exponential transformations. The ratio of the exponential value corresponding to the recoverable state value to the sum of the exponential values ​​corresponding to the two state values ​​is used as the recoverability level. The recoverability level ranges from 0 to 1; a larger value indicates a higher degree of recovery of the corresponding candidate sensitive fact from the dataset to be evaluated. The sensitive subset identification module is used to perform counterfactual processing on candidate sensitive facts whose recoverability exceeds the recovery threshold, and determine the minimum sensitive data subset based on the change in recoverability before and after processing; The access result control module is used to perform desensitization processing based on the minimum sensitive data subset, and output the access result after recovery verification; The derived data classification module is used to determine the residual contribution of sensitive information based on the difference in the recoverability of derived results before and after counterfactual processing of source data, and to determine the level of derived data accordingly. The cumulative monitoring module is used to combine the current output results with historical associated output results for recovery analysis. When the recoverability of the current output is not higher than the recovery threshold and the recoverability of the combined output exceeds the recovery threshold, the cumulative sensitivity level is determined to jump, and the access control parameters are adjusted.

2. The government data hierarchical access supervision system based on artificial intelligence according to claim 1, characterized in that, The access context construction module includes: The request parsing unit is used to determine the data fields, record range, and time range to be accessed from the government data access request; The associated retrieval unit is used to determine the association path between the data to be accessed and the historically acquired data based on the data entity identifier, business object identifier, and time index. A historical data filtering unit is used to filter historically acquired data located on the associated path within the preset historical window; The set building unit is used to combine the filtered results with the data to be accessed in this session into a set of data to be evaluated, based on entity relationships, time relationships, status relationships, and business relationships.

3. The government data hierarchical access supervision system based on artificial intelligence according to claim 1, characterized in that, The sensitive fact deduction module is configured as follows: Convert the data items in the dataset to be evaluated into entity relationship features, time relationship features, state relationship features, and business relationship features; The relational features are input into the artificial intelligence sensitive fact inference model to obtain candidate sensitive facts inferred from the data items and their relational combinations. For each candidate sensitive fact, output the sensitivity level and recoverability, and compare the recoverability with the recovery threshold corresponding to the sensitivity level; Candidate sensitive facts whose recoverability exceeds the recovery threshold and their associated data items are sent to the sensitive subset identification module.

4. The AI-based hierarchical access monitoring system for government data according to claim 2, characterized in that, The sensitive subset identification module includes a counterfact generation unit and a subset determination unit, and identifies candidate sensitive facts whose recoverability exceeds the recovery threshold as target sensitive facts. The counterfact generation unit performs removal, precision reduction replacement, or semantic masking on the associated data items of the target sensitive fact, respectively, and forms a counterfact data set while keeping the remaining data items unchanged, and calls the sensitive fact inference module to recalculate the recoverability of the target sensitive fact; The subset determination unit performs counterfactual verification on the combination of associated data items in order of increasing number of data items. The combination of data items that can reduce the recoverability of the target sensitive fact from exceeding the recovery threshold to no more than the recovery threshold, and whose recoverability of the target sensitive fact exceeds the recovery threshold again after removing any data item, is determined as the minimum sensitive data subset.

5. The government data hierarchical access supervision system based on artificial intelligence according to claim 1, characterized in that, The access result control module determines the desensitization processing path based on the counterfactual verification results of data items in the minimum anonymized data subset: When sensitive facts are restored to depend on data precision, the granularity of the corresponding data items is reduced or ranged. When sensitive facts restore the relationships between dependent data items, the corresponding associations are severed; When the release sequence of data that the sensitive facts depend on is restored, a delayed release is performed on the corresponding data items; When the recovery of sensitive facts depends on individual records, the corresponding data items are converted into aggregate results; After each desensitization process, the recoverability of the target sensitive facts is recalculated, and the access result is generated using the minimum processing intensity that ensures the recoverability is not higher than the recovery threshold corresponding to the current access permission for the first time.

6. The AI-based hierarchical access monitoring system for government data according to claim 5, characterized in that, The derived data classification module includes a source association unit and a residual contribution calculation unit; The source association unit records the source data and processing relationships involved in the processing of access results into derived data through statistics, association, filtering, feature extraction, model reasoning, or report generation; The residual contribution calculation unit generates a first derivative result for the target source data that participates in the processing normally, and generates a second derivative result after removing, replacing or isolating the target source data while keeping other source data and processing unchanged. It calculates the recoverability of the same candidate sensitive fact in the two types of derivative results respectively, and determines the residual contribution of sensitive information of the target source data based on the difference between the two.

7. The AI-based hierarchical access monitoring system for government data according to claim 3, characterized in that, The derived data classification module determines the actual sensitivity level of the derived data according to the highest sensitivity level among the candidate sensitive facts whose recoverability exceeds the corresponding recovery threshold. When the recoverability of a candidate sensitive fact is reduced from exceeding the recovery threshold to not exceeding the recovery threshold after the target source data is processed by counterfactual methods, the target source data is determined as the effective source of residual sensitive information for that candidate sensitive fact. When the recoverability before and after counterfactual processing is on the same side of the recovery threshold, the actual sensitivity level of the derived data is not increased separately based on the preset sensitivity level of the target source data.

8. The AI-based hierarchical access monitoring system for government data according to claim 6, characterized in that, The cumulative monitoring module includes a historical output retrieval unit, a combined recovery unit, and a strategy feedback unit; The historical output retrieval unit extracts historical associated output results within a preset historical window that have entity, time, status, or business relationships with the current output result, based on the access subject identifier. The combined recovery unit calculates the recoverability of the current output result alone and the recoverability of the current output result combined with historical associated output results, respectively. When the recoverability of the current output result individually is not higher than the recovery threshold and the recoverability of the combined result exceeds the recovery threshold, a cumulative sensitivity level transition is determined, and the policy feedback unit generates subsequent access control parameters.

9. The government data hierarchical access supervision system based on artificial intelligence according to claim 8, characterized in that, The subsequent access control parameters include the upper limit of access level, the granularity of data fields allowed to be released, the data association dimensions allowed to be retained, and the result release method; The strategy feedback unit determines the target field or target association relationship to participate in the combined recovery based on the association path between the historical association output results that caused the cumulative sensitivity level jump and the current output results, and sends the corresponding control parameters to the access context construction module and the access result control module. When a subsequent request for access to government data arrives, the access context construction module and the access result control module restrict the data granularity or target association of the target field according to the control parameters, and re-perform sensitive fact recovery verification to ensure that the subsequent access control matches the data status already obtained by the access subject.

10. A method for hierarchical access supervision of government data based on artificial intelligence, characterized in that: The method, applied to the AI-based hierarchical access monitoring system for government data as described in any one of claims 1-9, comprises: Obtain government data access requests, and combine the data to be accessed this time with the related government data already obtained by the accessing subject within a preset historical window to form a data set to be evaluated; Based on the entity relationships, time relationships, state relationships, and business relationships in the dataset to be evaluated, an artificial intelligence sensitive fact inference model implemented using a relational graph coding network is used to generate candidate sensitive facts, and the sensitivity level and recoverability of each candidate sensitive fact are determined. For candidate sensitive facts whose recoverability exceeds the recovery threshold, counterfactual removal, precision reduction replacement, or semantic masking are performed on the associated data items, and the minimum sensitive data subset is determined based on the change in recoverability before and after processing. Based on the minimum sensitive data subset, perform granularity reduction, intervalization, association severing, delayed release, or aggregation processing, and output the access result after recovery verification; When the access results generate derivative data, the residual contribution of sensitive information and the access level of the derivative data are determined by comparing the recoverability of the two types of derivative results generated after normal processing of the target source data and after counterfactual processing. The current output result is combined with the historical associated output results for recovery analysis. When the recoverability of the current output result alone is not higher than the recovery threshold and the recoverability of the combined result exceeds the recovery threshold, the cumulative sensitivity level jump is determined, and the subsequent access control parameters are adjusted accordingly.

Images