Vector-level data access control system

Abstract

A vector-level data access control system includes a vector database and a computing device connected to the vector database. The computing device performs pre-retrieval masking operations on the index structure of the vector database, marking the index nodes corresponding to feature vectors for which the user's access level is insufficient as disabled. The feature vectors corresponding to unmarked index nodes are defined as a set of compliant vectors. Vector similarity retrieval is performed on the compliant vector set to calculate the spatial distance between the query semantic vector and the feature vectors and filter out multiple candidate vectors. This achieves the technical effect of excluding feature vectors without access permissions during the vector similarity calculation stage, thereby improving the data access security of the vector database.

Claims

1. A vector-level data access control system, the system comprising: a vector database having an index structure and storing multiple feature vectors and multiple access tokens, wherein, Each of the aforementioned feature vectors is bound to one of the corresponding plurality of permission tags. The index structure includes a plurality of index nodes, each of which is associated with at least one of the plurality of feature vectors. A computing device is also provided for connecting to the vector database. The computing device is configured to: receive a query request from a user and the user's identity information; and identify a permission level of the user based on the identity information. A pre-retrieval masking operation is performed, comparing the permission level with the permission markers in the vector database. Based on the comparison result, in the index structure of the vector database, the index nodes corresponding to the feature vectors for which the permission level does not have access permissions are marked as disabled, forming a set of non-compliant index nodes. The index nodes not marked as disabled are defined as a set of compliant index nodes. The query request is converted into a query semantic vector, and the feature vectors corresponding to the set of compliant index nodes are regarded as a set of compliant vectors. A vector similarity search is performed in the set of compliant vectors to calculate the spatial distance between the query semantic vector and the feature vectors in the set of compliant vectors, and multiple candidate vectors are selected as a final retrieval result.

2. The vector-level data access control system as described in Request 1, wherein the computing device is configured to execute a data writing procedure, the data writing procedure comprising: receiving raw data and a confidentiality level corresponding to the raw data; converting the raw data into a feature vector to be written; generating a write permission tag corresponding to the feature vector to be written based on the confidentiality level, and synchronously writing the feature vector to be written and its corresponding write permission tag to the vector database.

3. In the vector-level data access control system of request item 1, when the computing device performs the pre-retrieval masking operation, it dynamically generates a retrieval mask based on the access level before performing the calculation of the spatial distance of the vector similarity retrieval, and uses the retrieval mask to block the index nodes in the vector database that correspond to the set of non-compliant index nodes.

4. The vector-level data access control system as requested in item 1, wherein the computing device is further configured to perform a post-retrieval filtering operation after the vector similarity retrieval is completed, wherein the post-retrieval filtering operation further filters the content paragraph corresponding to each candidate vector according to the user's access level, so as to exclude the content paragraph that does not meet the access level, and updates the final retrieval result accordingly.

5. As in Request 1, the vector-level data access control system, wherein each access marker includes a data level field, the data level field records a confidentiality level of the original data corresponding to the feature vector, and when the computing device performs the pre-retrieval masking operation, it compares the access level with the confidentiality level in the data level field, and only when the access level is not lower than the confidentiality level, the corresponding feature vector is included in the compliance vector set.

6. The vector-level data access control system as described in Request 1, wherein each access token includes an access control list, the access control list records multiple access rules, each access rule includes a role identification code and an operation permission flag, the operation permission flag defines at least one operation permission of reading, retrieving and referencing, and the computing device determines the user's operation permission range for each feature vector based on the role identification code corresponding to the user's identity information and the operation permission flag.

Images