In both real life and social networks, the relationship between people is built on the foundation of trust. An essential prerequisite for a person to decide to interact with others is that they can establish enough trust with them [3]. Voloch et al. [4] proposed a trust-based access control model. This model classifies the direct connections between users into roles according to the user network. Meanwhile, it relies on the total number of friends, user account age, friendship duration and other public information to represent the network connection quality, and is used to evaluate the degree of trust between users and network members, so as to achieve access control. Wang et al. [5] proposed a trust-based access management framework (TBAF), that incorporates privacy awareness and access control. Access control modeling is carried out according to the relationship between individuals, sticky strategies in social networks, fine-grained format and degree of trust. The model supports the generation of highly complex privacy-related policies, so as to support privacy-protecting access control.

In view of the system complexity faced by cloud computing, Aparna et al. [6] proposed a trust-RBAC access control model, which integrates non-security oriented Trust of role-based access control (RBAC). Before granting authorization to the requested data unit, the user trust value is considered to improve the effectiveness of the authentication and authorization process in cloud computing. This provides a new dimension to prevent unauthorized access to cloud resources. Susan et al. [7] proposed an initial trust authorization access control model for unknown users in social networks based on the existence of relationships between them. A trust network is created based on existing relationships in the social network to evaluate the trustworthiness of users towards resources, and thereby restrict access to them. Xu et al. [8] proposed a trust-based access control mechanism Trust2Privacy, which defines trust directions between users based on their attention states and calculates trust values by considering the similarities, correlations, and interactions between users. The model protects user-generated social data and effectively transforms trust calculations into privacy protection. However, the calculation of trust values in the trust-based access control model mainly relies on the trust model, and the consideration of user attribute information and authorization context environment was lacking in the calculation process.

This type of access control primarily operates on a predefined set of access management policies. If certain policies or rules within this set are satisfied, the user can access specific resources [9]. To address privacy and security issues related to the sharing of jointly owned data in social networks, Ma et al. [10] proposed a privacy protection policy rule fusion method. The method defines the scope of information protection based on the content of privacy data, abstracts natural language descriptions of privacy protection using predicate logic formulas, constructs a logical model for privacy protection rules, defines heterogeneous privacy protection rules, and provides a rule fusion algorithm to restrict data access permissions, thereby avoiding conflicts in privacy protection requirements and privacy data leakage in different application scenarios of social networks. Masoumzadeh et al. [11] proposed a theory to capture the semantics of rule-based access control policies. The method captures the semantics of access control policies in a formal manner, has a simple representation, and allows for intuitive policy descriptions, thereby enabling better selection of access control policies.

Dundua et al. [12] developed a rule-based unified framework for specifying and analyzing entity attributes in social networks, and allocated specific text control policies based on these attributes. Ma et al. [13] proposed a distributed logical social network access control model (DUD_RuleSN), based on active rules and trigger mechanisms, which incorporates relationships between entities into authorization, providing the model with strong authorization expression capabilities and updateability. Marin et al. [14] proposed a rule-based normative configuration and programming system semantic framework, which transforms norms into attribute-based access control executable code for access control. However, the biggest disadvantage of rule-based access control is that it cannot satisfy everyone’s interests, as different people have different personal preferences. Therefore, personalized access control mechanisms become increasingly important. At the same time, rule-based access control lacks flexibility. If it is necessary to adjust new resources or access control policies, they must be modified in the access management policy set, which may cause conflicts or result in access being denied.

Attribute-based access control is a classic type of access control model and also a type of access control technology suitable for open environments. Defining authorization with security attributes can effectively protect users’ privacy information. Karimi et al. [15] proposed a method for automatically learning ABAC policy rules from system access logs, using an unsupervised learning algorithm to detect patterns in access logs and extract ABAC authorization rules from them. Two improved algorithms for rule pruning and policy refinement were also proposed to generate higher-quality mining strategies. Yahiatene et al. [16] proposed a framework called CloudSN to mitigate privacy issues in OSNs. Using a distributed multi-authority ABE scheme, it provides flexible access to private data, which can only be accessed by users with the correct keys. Wei et al. [17] proposed an intelligent privacy protection method to solve privacy protection issues in social networks, combining neural networks with a hybrid hierarchical genetic algorithm to construct a social network security prediction model. The social network information was preprocessed using SVM and encrypted using an attribute-based encryption scheme, and finally, the particle swarm optimization algorithm was used to improve the security and privacy protection of the social network.

Li et al. [18] proposed a privacy-aware ABE scheme with an accountability mechanism for multi-authority ciphertext policies, hiding attribute information in ciphertext and allowing tracking of the identities of dishonest users who share decryption keys. It was applied to cloud computing to construct a reliable fine-grained access control system. Safi et al. [19] proposed a fully encrypted privacy protection scheme based on mobile social networks, using ciphertext policy attribute-based encryption (CP-ABE) and advanced encryption standard (AES) to encrypt user data end-to-end. In the CP-ABE encryption scheme, access control is applied to other users’ access to shared data in addition to data confidentiality, and unauthorized users cannot access or violate data privacy. However, when facing users with multiple attributes, attribute-based access control methods need to consider attribute weights, and as the number of user attributes increases, the algorithm’s processing speed will slow down, and the response time for users will increase.

In response to the shortcomings of large granularity and poor flexibility in access control policies, Hou et al. [20] proposed a multi-layer access control mechanism based on blockchain called BMAC. They designed an algorithm based on InfoMap to implement user grouping based on credibility and combined it with a multi-blockchain to establish a flexible and fine-grained trusted data access control mechanism. Ma et al. [21] proposed a content-based access control model (RCBAC) that is risk-aware. RCBAC uses the user’s responsibilities and the content of the requested file to determine whether to grant access, and also divides user risks into access behavior risks and access history risks, dynamically adjusting the user’s access capabilities through risk quantification and management. Li et al. [22] proposed a control framework called PrivacyJPEG for privacy protection of photo sharing across different social networks. They first encrypt several privacy areas of the photos and bind the access control policies before users upload the photos, which can limit any user on the same transmission chain from accessing any privacy area of the photo, even if they are in different social networks and not affected by unwanted viewers. Sun et al. [23] proposed a blockchain-based encrypted gradient auditing method to defend against attacks. It utilizes a behavior chain to record the encrypted gradients of data owners and employs an auditing chain to evaluate the quality of the gradients. This method adopts a privacy-preserving homomorphic noise mechanism where the noise of each gradient gets canceled out after aggregation, ensuring the usability of the aggregated gradients.

Yin et al. [24] designed the training process of federated learning (FL) as a game model. They utilize an extensive game tree to analyze the key elements influencing decision-making in a single game and then find incentive mechanisms that align with social norms through repeated games. Through multiple rounds of games, the incentive mechanism can assist all participants in finding the optimal strategies for energy, privacy, and accuracy in FL within a distributed communication system. Akkuzu et al. [25] proposed a group decision-making model based on consensus. When a user wants to publish data that is collectively owned, they first ask for group decisions from all owners during the sharing process, and then make the final decision by respecting or disrespecting the group decision. Sharma et al. [26] proposed a blockchain based framework with encryption based on ciphertext policy attributes for access control and user revocation. Shan et al. [27] proposed a social network forwarding control mechanism based on game theory by analyzing the interests of both forwarding parties. They compared the historical data of forwarding operations with the threshold set by the publisher to determine whether to allow forwarding. Hu et al. [28] proposed group-based access control (oGBAC) to ensure data security when sharing information between friends in OSN by limiting the information flow between groups. It is used to prevent privacy leaks when sharing information within or between groups in online social networks. However, all the above access control models ignore the participation of user preferences in the access control policy when granting social access control.

There are two groups of entities in social network, which are user set U(|U|=m) and social data set D(|D|=z). Two graphs are constructed based on the user set U and the social data set D one is the user-user undirected heterogeneous graph GS=(U,S), and the other is the user-social data undirected homogenous graph GD=(U∨D,C). The user-user social relationship matrix S∈Rm×n represents the social relationship between social users in the social network. User node a is represented by ua and social data node i is represented by di. If ua and ub are friends, then Sab=Sba=1(b∈Sa), otherwise Sab=Sba=0(b∉Sa). Y∈Rm×z represents the user-social data matrix. If ua is associated with di, Cai=Cia=1, otherwise Cai=Cia=0. The feature vector matrix of all user nodes is P∈Rm×h1, and the feature vector of ua is represented by pa. The feature vector matrix of all social data nodes is Q∈Rz×h2, and the feature vector of di is qi.

This paper proposes a deep learning access control model based on user preferences and simulates user preferences using graph neural networks. When user ua generates a social data di, the model generates appropriate access control policies for the social data di based on user preferences.

As shown in Fig. 1, the homogenous graph and heterogeneous graph were constructed, and the graph nodes were embedded to obtain feature vectors as input. After the training and updating of the graph neural network and linear neural network, the user node in the user-user graph is classified and output. The classified category is the user’s operation authority on the social data.

Specifically, user uj has two possible access rights to the social data di generated by user ua. If uj can access social data di, the node category of uj in the homogeneous graph is 1; otherwise, the node category of uj is 0. The access control problem of social data is transformed into the classification problem of user nodes in the homogenous graph.

The model consists of three parts: embedding layer, preference propagation fusion layer and access control output layer.

The embedding layer embeds social users and social data to obtain feature vectors, which are taken as the input of the model.

In the preference propagation fusion layer, there are homogenous graph and heterogeneous graph, which respectively simulate the propagation rules of user social preferences among social users and the propagation rules of user personal preferences in social data. According to displayed neighbor node, hidden neighbor node, social data node and high-order neighbor node, the attention mechanism is used to update the user node. The attention mechanism is used to update the social data node according to the user node.

In the access control output layer, the linear neural network is used to calculate the fusion coefficient, and the user nodes obtained after multiple preference propagation and fusion are aggregated, and the final representation of the user nodes with user preferences is obtained in the homogenous graph. After activation function processing, the final node of each user node in the homogenous graph is dichotomized (0 is to deny the user access, 1 is to allow the user access), and the access control list is output. The model structure is shown in Fig. 2.

The experiment used a custom dataset collected from the microblog social platform. Climb 50 users in the microblog social platform, each user has an average of 50 social friends, and 50 users climb to the 3 order social friends. Each user generates 20 pieces of social data, and each piece of social datasets access control policies for friends (allow access to this piece of social data or do not allow access to this piece of social data, because the social data is basically allowed to access other friends, after data collection, the experimenters in this group manually adjusted the data access control strategy). Based on each user’s interaction with their social friends and the historical access control policy set for each piece of data, a complete dataset is finally constructed. The dataset details are shown in Table 1.

This paper is based on the PyTorch framework to implement the model. The preference propagation depth (number of iterations) N of the model is set to 5. K in the K-order neighbor node selection module is set to 3. The model used SGD optimizer and the learning rate was set to 0.001. The early stop strategy is adopted during training. If the loss of verification set does not change during 100 consecutive iterations, the model training will be terminated.

In deep learning, binary classification problems commonly used important evaluation metrics are accuracy (Accuracy) and F1 score. They are calculated based on the confusion matrix. In experiments, we selected Accuracy and F1 score as indicators to evaluate the performance of the model. The meaning of accuracy mainly refers to the ratio of the number of samples that the model predicts correctly to the total number of samples. F1 score is a harmonic mean of the recall rate and precision rate of the model.

GCN [30]: This paper proposed a graph convolution neural network model. Based on the first order approximation derivation of spectral convolution, the convolution operation in image processing is successfully extended to the graph structure. The model takes the node feature information and the adjacency matrix of the graph as the input, and finally applies the output node representation to the node classification task on the homogeneous network.homogeneous network.

GraphSAGE [31]: The learning result in this article is not the feature vector of each node but rather an “aggregation function”. Based on the known features and neighbor relationships of each node, it is easily possible to obtain a representation of a new node.

LGCL [32]: After selecting initial nodes, this article uses dynamic random selection with width-based search to select a dynamic number of external nodes, and stops expanding when the required number is reached. After forming the sub-graph, LGCL constructs new neighbor feature vectors based on the original ranking of neighbor node features. The dimension of the feature vector is equal to the number of channels, and convolution operations are performed through a one-dimensional convolutional neural network to compress the multi-dimensional features of the central node and neighbor nodes into a one-dimensional format.

HAN [33]: This paper uses a hierarchical attention mechanism, which uses node-level attention to learn the weights between nodes and their neighbor nodes based on meta-paths, and then uses semantic-level attention to aggregate different weights between multiple meta-paths.

The model proposed in this paper achieved good experimental results on the dataset, as did the baseline models. As shown in Table 2, the accuracy of the model proposed in this paper improved by 2.18% compared to the baseline models, and the F1 score improved by an average of 1.45% compared to the best benchmark method.

As a deep learning model, GCN has achieved good performance on datasets by leveraging homogeneous graph extraction to enhance the classification of heterogeneous nodes. However, this approach fails to capture comprehensive information. GraphSAGE randomly selects nodes for aggregation, which can lead to the omission of important neighbor nodes, resulting in insufficient information. LGCL selects an initial node and dynamically and randomly picks peripheral nodes through a breadth-first search. It constructs new neighbor feature vectors based on the ranking of original neighbor node features and performs convolutional operations using a one-dimensional convolutional neural network. This compresses the multi-dimensional features aggregated from central and neighbor nodes into a one-dimensional format. LGCL improves network coverage by increasing the number of randomly selected nodes, but its performance relies on the manually set quantity. HAN aggregates nodes using node-level attention based on adjacent nodes through meta-paths. It further aggregates the representations of multiple meta-paths using semantic-level attention. However, HAN is limited by the capability of meta-paths to model higher-order structures and semantic information, which prevents it from obtaining higher-quality representations. In this paper, when aggregating and updating user nodes, we consider the complex relationships among hidden neighbor nodes and higher-order neighbor nodes. We employ an attention mechanism for importance selection. Consequently, our proposed model achieves promising classification results on the dataset.

The preference propagation fusion layer consists of three main components: the K-order neighbor node selection module, the hidden neighbor node selection module, and the preference propagation depth. Three sets of ablation experiments were designed to demonstrate the importance of these three components in the model. The results of the ablation experiments are shown in Table 3. In the first set of ablation experiments, the K-order neighbor node selection module was removed from the original model while keeping the other functionalities intact. The K-order neighbor node selection module enhances the higher-order structure of nodes and increases the social depth of users during node updates. The second set of ablation experiments builds upon the first set by removing the implicit neighbor node selection module. This module calculates implicit neighbor nodes based on similarity and aims to incorporate important information during node fusion, thereby improving the social breadth of users. The third set of ablation experiments further removes the preference propagation depth module. An appropriate preference propagation depth N can effectively simulate user social preferences and improve the overall performance of the model. This section’s ablation experiments further demonstrate the effectiveness of the model’s performance and the formulation of access control policies.