Ai-based data sharing and access control system and method

Abstract

This invention discloses an artificial intelligence-based data sharing and access control system and method. After generating verified data records, the system separates them into field data and annotation data and writes them into a vector index database. Each semantic vector corresponds to a vector record, encapsulating a policy identification code, data source type field, and personal data tag. The access control policy engine obtains the access control policy object's output authorization determination result, enabling the authorization awareness retrieval and response generation module to first obtain authorization candidate content through authorization filtering before generation, then perform content masking or watermarking according to additional constraints, and refuse output when access time expires, and restrict export when export permission is prohibited.

Claims

1. An AI-based data sharing and access control system, comprising: a client application providing a conversational user interface to receive data items uploaded by a user and natural language input; an API gateway communicating with the client application to receive the data items, user identification information, and natural language input, and route them to a back-end processing module; a data retrieval and verification module connected to the API gateway to perform text recognition on the data items to generate structured field data, and output a verified data record after user confirmation or correction; a data separation module connected to the data retrieval and verification module to separate the verified data record into field data and annotation data; a vectorization module connected to the data separation module to generate semantic vectors for the field data and the annotation data respectively; and a vector index database for storing multiple semantic vectors and their corresponding vector records, wherein each vector record includes: a policy identifier, a data source type field, and a personal data tag. A vector writing interface is used to enable the vectorization module to write the generated semantic vectors and corresponding vector records into the vector index database; a policy object store is used to store multiple access control policy objects, wherein each access control policy object includes: (a) group tags; (b) permission types, including: view, edit, share and export permissions; and (c) additional constraints, including: access duration, content masking and watermarking; an access control policy engine is connected to the policy object store to obtain the corresponding access control policy object according to the policy identifier and perform authorization determination to output the authorization determination result; an authorization-aware retrieval and response generation module is connected to the API gateway and the access control policy engine, and performs similarity retrieval on the vector index database through a vector retrieval interface, and operates in the following data flow order: (i) before generating response content, the vector records in the vector index database are first authorized according to the authorization determination result to obtain authorization candidate content; (ii) The authorized candidate content is then used as the input to generate response content; and (iii) The response content is masked and / or watermarked according to the additional constraints, and output is rejected when the access time expires; A dialogue intent analysis engine, connected to the API gateway, is used to classify the natural language input as an information query intent, an action request intent, or a permission change intent; and an action execution unit, connected to the access control policy engine, performs the corresponding system operation when the natural language input is classified as an action request intent and the authorization determination result is allowed.

2. The AI-based data sharing and access control system as described in claim 1, wherein each vector record includes: (a) a policy identifier for associating with a corresponding access control policy object; (b) a data source type field for indicating whether the vector record corresponds to field data, annotation data, or summary data; and (c) a data tag for indicating the personal data sensitivity level of the content corresponding to the vector record.

3. The AI-based data sharing and access control system as described in claim 1, wherein the access control policy engine encodes the group tags and permission types into a permission bit vector, and determines whether a user or group has access rights by bit-level comparison, so as to exclude unauthorized vector records before similarity retrieval.

4. The AI-based data sharing and access control system as described in claim 1, wherein the authorization perception retrieval and response generation module is configured to: perform authorization filtering based on the access control policy object associated with the policy identifier before any response generation step, and use only authorized candidate content as generation input to avoid unauthorized content being input into the generation model.

5. The AI-based data sharing and access control system as described in Request 1, wherein the authorization perception retrieval and response generation module, when outputting response content: when the additional constraint includes access expiration, refuses to output expired content; when the additional constraint includes content masking, performs masking on the corresponding personal data field or fragment in the response content; when the additional constraint includes watermarking, adds traceable watermark information to the output response content.

6. The AI-based data sharing and access control system as described in claim 1, wherein when the access control policy object defines export permission as prohibited, the system prohibits outputting exportable response formats and / or prohibits performing export-related system operations.

7. The AI-based data sharing and access control system described in claim 1, wherein when the dialogue intent analysis engine determines that the natural language input is an action request intent, the system first completes the authorization determination by the access control policy engine, and then the action execution unit performs the corresponding operation, and the corresponding operation includes one of: establishing a contact, updating a contact, synchronizing contact information to an external address book, or triggering a communication process.

8. The AI-based data sharing and access control system as described in claim 1, further comprising a local model personalized database storing: a prompt template for restricting response format or wording; and / or a summary index for providing summary rules or summary content for a specific organization; and / or an adapter parameter for adjusting response generation behavior without altering the master model parameters.

9. The AI-based data sharing and access control system as described in claim 8, wherein the authorization perception retrieval and response generation module selects loadable prompt templates, summary indexes and / or adapter parameter sets from the local model personalized database based on user identification information and group tags, and loads the selected set when generating response content.

10. The AI-based data sharing and access control system as described in claim 1, further comprising an image retention and de-identification control unit configured to perform deletion or de-identification storage of the original image in accordance with an image retention policy after the verified data record is generated.

11. The AI-based data sharing and access control system as described in claim 10, wherein the de-identification storage includes one of the following: (1) removing identifiable text blocks from the original image; (2) masking sensitive field areas in the original image; or (3) encrypting the original image and restricting access to only those with auditing privileges.

12. The AI-based data sharing and access control system as described in claim 1, wherein when the dialogue intent analysis engine determines that the natural language input is an intent to change permissions, the system generates a permission change proposal and requests confirmation from the user through a conversational user interface, and after the user confirms, updates the group label, permission type and / or additional constraints of the access control policy object.

13. The AI-based data sharing and access control system as described in claim 1, further comprising an audit record module for recording events such as retrieval events, permission change events, and image processing events, wherein the audit record module stores the timestamps of each event, operator identification information, and corresponding data item identification information in a hash chain or equivalent immutable data structure to provide traceability.

14. A data sharing and access control method based on artificial intelligence, comprising: (a) receiving a data item uploaded by a user, user identification information, and natural language input through a conversational user interface of a client application, and routing it to a back-end processing module through an API gateway; (b) performing text recognition on the data item by a data retrieval and verification module to generate structured field data, and providing user confirmation or correction to output a verified data record; (c) separating the verified data record into field data and annotation data by a data separation module; (d) generating semantic vectors for the field data and the annotation data respectively by a vectorization module; (e) writing the semantic vectors and their corresponding vector records into a vector index database through a vector writing interface, wherein each vector record includes: a policy identifier, a data source type field, and a personal data tag; (f) obtaining the corresponding access control policy object according to the policy identifier by an access control policy engine, and performing authorization determination on the user identification information to output the authorization determination result. (g) An authorization-aware retrieval and response generation module performs a similarity retrieval on the vector index database through a vector retrieval interface, and operates in the following data flow order: (g1) Before generating response content, authorization filtering is performed based on the authorization determination result to obtain authorization candidate content; (g2) The authorization candidate content is then used as the generation input to generate response content; and (g3) The response content is masked and / or watermarked according to the additional constraints of the access control policy object, and output is rejected when the access time expires; (h) A dialogue intent analysis engine classifies the natural language input into information query intent, action request intent, or permission change intent; and (i) When the natural language input is classified as an action request intent and the authorization determination result is allowed, an action execution unit performs the corresponding system operation.

15. The AI-based data sharing and access control method as described in claim 14, wherein each vector record includes: (a) a policy identifier for associating with a corresponding access control policy object; (b) a data source type field for indicating whether the vector record corresponds to field data, annotation data, or summary data; and (c) a data tag for indicating the personal data sensitivity level of the content corresponding to the vector record.

16. The AI-based data sharing and access control method as described in claim 14, wherein the authorization determination includes: encoding the group tag and permission type of the access control policy object into a permission bit vector, and determining whether a user or group has access rights by bit-level comparison, so as to exclude unauthorized vector records before similarity retrieval.

17. The AI-based data sharing and access control method as described in claim 14, wherein before any response generation step, authorization filtering is performed based on the access control policy object associated with the policy identifier, and only authorized candidate content is used as generation input to avoid unauthorized content being input into the generation model.

18. The AI-based data sharing and access control method as described in claim 14, wherein the additional constraint includes one or more of the following: (a) access expiration: refusing to output expired content; (b) content masking: masking the fields or segments of corresponding personal data in the response content; (c) watermarking: adding traceable watermark information to the output response content.

19. The AI-based data sharing and access control method as described in claim 14, wherein when the access control policy object defines export permission as prohibited, the output of exportable response formats and / or the execution of export-related system operations are prohibited.

20. The AI-based data sharing and access control method as described in claim 14, wherein when the natural language input is classified as an action request intent, an authorization determination is first performed, and when the authorization determination result is allowed, the corresponding operation is executed, and the corresponding operation includes one of: establishing a contact, updating a contact, synchronizing contact information to an external address book, or triggering a communication process.

Images