Functional authority management method and system based on role control and combination conditions

Abstract

The present invention discloses a method and system for function permission management based on role control and combined conditions, and belongs to the technical field of access control and permission management. The method comprises the following steps: defining user type, role type, operation type and data type; defining the permissions of users and roles; defining the role type of users, and superimposing the permissions corresponding to the corresponding users and role types; defining the permissions and conditions required to operate the data type according to the data type and operation type; when the user requests an operation, verifying whether the user's permissions and conditions meet the requirements according to the permissions and conditions corresponding to the operation type and data type; when the verification fails, returning the reason for the failure; when the user fails to verify and then applies for permissions, the system automatically approves the application. The present invention can effectively improve the situation that the prior art lacks support for combined conditions and lacks fine-grained control.

Description

Technical Field

[0001] The present invention relates to the technical field of access control and authority management, and in particular to a method and system for function authority management based on role control and combination conditions. Background Art

[0002] In modern information systems, permission management is an important part of ensuring secure access to data and resources. The main goal of permission management is to ensure that users can perform corresponding operations at specific times, locations, and conditions without unauthorized access to other resources.

[0003] In the access control list (ACL), each resource has a list of which users or groups can perform which operations. This method is more effective in small systems because the number of resources and users is small and the ACL list is easy to manage. As the system scale expands and the number of resources and users increases, the ACL becomes difficult to manage and maintain. In a dynamic and complex business environment, the ACL is not flexible enough to cope with frequent permission changes. It lacks support for combined conditions and is difficult to meet complex security requirements. Role-based access control cannot handle multi-dimensional permission control requirements, and it is difficult to dynamically adjust permissions and verify complex conditions in real time, and lacks fine-grained control. Summary of the invention

[0004] The purpose of the present invention is to provide a method and system for managing functional rights based on role control and combination conditions, so as to solve the problems raised in the above-mentioned background technology.

[0005] In order to solve the above technical problems, the present invention provides the following technical solution: a function permission management method based on role control and combination conditions, the method comprising the following steps:

[0006] S1. Define user type, role type, operation type, and data type;

[0007] S2. Define the permissions of users and roles; define the role types of users, and add permissions corresponding to the corresponding users and role types;

[0008] S3. Define the permissions and conditions required to operate the data type according to the data type and operation type;

[0009] S4. When a user requests an operation, the user's permissions and conditions are verified based on the permissions and conditions corresponding to the operation type and data type to see if they meet the requirements; if the verification fails, the failure reason is returned;

[0010] S5. When the user fails verification and then applies for permission, the system automatically approves the application.

[0011] In step S1, the user type is defined as: [user1, user2, ..., user p ];

[0012] Define the role type as: [role1, role2, ..., role q ];

[0013] Define the operation type as: [oper1,oper2,…,oper r ];

[0014] Define the data type as: [data1, data2,…, data s ];

[0015] p, q, r, s are positive integers; user p Indicates the pth user type; role q Indicates the qth role type; oper r Indicates the rth operation type; data s Indicates the sth data type.

[0016] In step S2, the permission is permission to operate the data;

[0017] There are r types of operation and s types of data, so there are r·s permissions in total;

[0018] The total user permissions are expressed as: [per1,per2,…,per r·s ], where among the r·s permissions, the permissions assigned to the user are marked as 1, and the permissions not assigned to the user are marked as 0;

[0019] The total permissions of a role are expressed as: [Per1, Per2,…, Per r·s ], where among the r·s permissions, the permissions assigned to the role are marked as 1, and the permissions not assigned to the role are marked as 0;

[0020] Define the user's role type: assign the role type to the user;

[0021] Superimpose the permissions corresponding to the corresponding user and role types: among the permissions assigned to the user and the permissions assigned to the role, the permissions with the user or role permissions marked as 1 in the corresponding permissions will remain 1 after superposition, and the permissions with the user or role permissions marked as 0 in the corresponding permissions will become 0 after superposition; perform an OR operation on the corresponding permission marks to complete the permission superposition;

[0022] The superimposed permissions are expressed as [perm1, perm2,…, perm r·s ] and the corresponding marks.

[0023] In step S3, the permissions and conditions required to operate the data type are defined according to the data type and operation type. The specific method is as follows:

[0024] Mark the permissions required by users to operate this data type as 1;

[0025] Set up the required conditions:

[0026] Role conditions: the role requirements that must be met to operate on this type of data, and the data can be operated within the specified role scope;

[0027] Time condition: the time requirement that needs to be met to operate on this type of data, and the data must be operated within the specified time range;

[0028] Spatial conditions: the spatial requirements that must be met to operate on this type of data, and the data must be operated within a specified geographical range;

[0029] In step S4, the permissions and conditions required to operate the data type are defined according to the data type and the operation type. The specific method is as follows:

[0030] Mark the permissions required by users to operate this data type as 1;

[0031] Set up the required conditions:

[0032] Role conditions: the role requirements that must be met to operate on this type of data, and the data can be operated within the specified role scope;

[0033] Time condition: the time requirement that needs to be met to operate on this type of data, and the data must be operated within the specified time range;

[0034] Spatial conditions: the spatial requirements that must be met to operate on this type of data, and the data must be operated within a specified geographical range;

[0035] In step S4, when the user requests an operation, the verification specifically includes: authority verification and condition verification;

[0036] Permission verification: select the permission tag corresponding to the operation type and data type requested by the user from the permissions and their corresponding tags superimposed in step S2, and perform an XOR operation with the permission tag required for operating the type of data defined in step S3. If the result is 0, it means the verification is passed, and if the result is 1, it means the verification fails and the reason is returned;

[0037] Condition verification: including role condition verification, space condition verification and time condition verification;

[0038] Role condition: define the degree of satisfaction of the role condition as G1; when a user requests the operation, verify whether the user belongs to the defined role type range based on character matching; if it matches, it passes and the degree of satisfaction is marked as 100%; if it does not match, it fails and the degree of satisfaction is marked as 0;

[0039] Spatial conditions: define the degree of satisfaction of spatial conditions as G2; determine whether the requested operation location belongs to the defined operable location range; obtain the user's IP data and GPS data; when the user accesses WiFi, obtain WiFi data, otherwise obtain base station data;

[0040] Estimate the approximate geographic location based on the IP address; obtain the user's precise geographic location from GPS data; infer the location based on the basic service set identifier (BSSID) of the WiFi network and the received signal strength indicator (RSSI); infer the location based on the base station ID and signal strength;

[0041] Set a threshold a. When the location difference between any two of the IP data, GPS data, WiFi data, and base station data is not less than a, use the GPS data as the location information and verify whether it belongs to the operable location interval. When the verification is passed, the satisfaction degree is marked as 100%;

[0042] If the verification fails, the GPS data is used as the location information, the boundary of the operable range is divided into different line segments, the distance from the point to each line segment is calculated, and the minimum value Po is taken. min ; Calculate the distance d1 between the position information and the centroid of the operable range. The degree of satisfaction is When the operable range is a concave polygon, divide the operable range into multiple convex polygons, find the centroid of each polygon, and then calculate the average value d2 of the distance between the position information and the centroid of each convex polygon. At this time, the satisfaction degree is

[0043] When the position difference between any two of the IP data, GPS data, WiFi data and base station data is greater than a, the Kalman filter is used to smooth and fuse the position data between multiple data sources; the fused position is used as the position information, the boundary of the operable range is divided into different line segments, the distance from the point to each line segment is calculated, and the minimum value Pos min ; Calculate the distance d3 between the position information and the centroid of the operable range. At this time, the degree of satisfaction is When the operable range is a concave polygon, divide the operable range into multiple convex polygons, find the centroid of each polygon, and then calculate the average value d4 of the distance between the position information and the centroid of each convex polygon. At this time, the satisfaction degree is

[0044] Time condition: define the degree of satisfaction of the time condition as G3; determine whether the requested operation time falls within the defined operable time range;

[0045] Determine the time zone where the user is located based on the location obtained by spatial condition verification; convert the operation time requested by the user into the time zone time required for the operation data; check whether the converted time point is within the specified operable time range;

[0046] The satisfaction degree is marked as 100% within the operable time range; when the time point does not belong to the operable time range, the time distance D1 between the time point and the midpoint of the operable time range and the time distance D2 between the time point and the border of the operable time range closest to the time point are calculated; at this time, the satisfaction degree is 1-(D2 / D1);

[0047] According to the historical application records, user type, role type, user authority, application operation type, application operation data type, role condition, spatial condition and time condition are used as feature variables; approval result is used as target variable; training set and data set are divided, random forest model is trained, and based on information gain, the information gain brought by each feature during splitting is calculated to determine the importance of different features; the feature importance I1, I2 and I3 of the feature variables role condition, spatial condition and time condition are obtained;

[0048] Set the combination condition verification threshold A; calculate the value of G1·I1 / (I1+I2+I3)+G2·I2 / (I1+I2+I3)+G3·I3 / (I1+I2+I3); when it is not less than A, the combination condition verification is considered to have passed; otherwise, it fails.

[0049] In step S5, based on historical application records and approval results, a random forest algorithm is used to implement automated approval of user applications;

[0050] In the application history, the application record includes user type, role type, user authority, type of operation applied for, data type of the operation applied for, authority to be applied for, reason for application, and application result;

[0051] Select user type, role type, user authority, applied operation type, applied operation data type, applied authority, and application reason as feature variables; the application result is the target variable, including approval and rejection;

[0052] Process the application record data, including removing missing values ​​and outliers to ensure data quality; perform natural language processing on text features and convert them into numerical feature TF-IDF values; perform one-hot encoding on categorical features and convert them into binary features;

[0053] The sample data is used as a data set and divided into a training set and a test set. The training set is used to build a random forest model and the hyperparameters are adjusted to optimize the model performance.

[0054] Input new applications into the model and output approval results.

[0055] A functional authority management system based on role control and combination conditions, the system includes: a role control module, an authority definition module, a combination condition module and an authority application module;

[0056] The role control module is used to define the types and permissions of users and roles, as well as the superposition of permissions; the permission definition module is used to define the types of operations and data and the permissions for operating data types; the combined condition module is used to verify permissions and conditions; the permission application module is used to apply for permissions when verification fails and to automatically approve applications;

[0057] The output end of the role control module is connected to the input end of the combination condition; the output end of the authority definition module is connected to the input end of the combination condition module; the output end of the combination condition module is connected to the input end of the authority application module.

[0058] The role control module includes: a user type unit, a user authority unit, a role type unit, a role authority unit and a authority superposition unit;

[0059] The user type unit is used to define the type of user; the user permission unit is used to assign user permissions; the role type unit is used to define the type of role; the role permission unit is used to assign role permissions; the permission superposition unit is used to superimpose the permissions of users and roles;

[0060] The output end of the user type unit is connected to the input end of the user permission unit; the output end of the user permission unit is connected to the input end of the permission superposition unit; the output end of the role type unit is connected to the input end of the role permission unit; the output end of the role permission unit is connected to the input end of the permission superposition unit; the output end of the permission superposition unit is connected to the input end of the combination condition module.

[0061] The permission definition module includes an operation type unit, a data type unit and a data operation permission unit;

[0062] The operation type unit is used to define the type of operation; the data type unit is used to define the type of data; the data operation permission unit is used to define the permission required for operating the data type;

[0063] The output end of the operation type unit is connected to the input end of the data operation permission unit; the output end of the data type unit is connected to the input end of the data operation permission unit; the output end of the data operation permission unit is connected to the input end of the combination condition module.

[0064] The combination condition module includes an authority verification unit, a role verification unit, a space verification unit, a time verification unit, a combination verification unit and an operation unit;

[0065] The permission verification unit is used to verify the matching degree between the superposition permission and the data operation permission; the role verification unit is used to verify whether the user role meets the operation condition requirements; the space verification unit is used to verify whether the user space condition meets the operation condition requirements; the time verification unit is used to verify whether the user time condition meets the operation condition requirements; the combination verification unit is used to verify the combination conditions; the operation unit is used to operate the data after the user meets the permission and conditions;

[0066] The output end of the authority verification unit is connected to the input end of the role verification unit; the output end of the role verification unit is connected to the input end of the space verification unit; the output end of the space verification unit is connected to the input end of the time verification unit; the output end of the time verification unit is connected to the input end of the combination verification unit; the output end of the combination verification unit is connected to the input end of the operation unit and the authority application module.

[0067] The permission application module includes: a permission application unit, an application approval unit and an end operation unit;

[0068] The permission application unit is used to apply for permission when the user's permission or conditions are not met; the application approval unit is used to automatically approve the user's application; the end operation unit is used to end the operation on the data;

[0069] The output end of the permission application unit is connected to the input end of the application approval unit; the output end of the application approval unit is connected to the input end of the end operation unit and the combination condition module.

[0070] Compared with the prior art, the beneficial effects achieved by the present invention are: each step of the present invention is relatively independent, can be adjusted and optimized according to actual needs, and has strong adaptability and maintainability; the present invention reduces unauthorized access and improves the security of the system by verifying the role, time and space conditions of the user's requested operation; the present invention uses a random forest algorithm to learn historical application records, automatically processes permission applications, reduces the workload of manual approval, and improves approval efficiency and accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0072] Figure 1 It is a schematic diagram of the steps of the function authority management method based on role control and combination conditions of the present invention;

[0073] Figure 2 It is a flow chart of the function authority management system based on role control and combination conditions of the present invention. DETAILED DESCRIPTION

[0074] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0075] See also Figure 1-Figure 2 The present invention provides a technical solution: a function permission management method based on role control and combination conditions, the method comprising the following steps:

[0076] S1. Define user type, role type, operation type, and data type;

[0077] S2. Define the permissions of users and roles; define the role types of users, and add permissions corresponding to the corresponding users and role types;

[0078] S3. Define the permissions and conditions required to operate the data type according to the data type and operation type;

[0079] S4. When a user requests an operation, the user's permissions and conditions are verified based on the permissions and conditions corresponding to the operation type and data type to see if they meet the requirements; if the verification fails, the failure reason is returned;

[0080] S5. When the user fails verification and then applies for permission, the system automatically approves the application.

[0081] In step S1, the user type is defined as: [user1, user2, ..., userp];

[0082] Define the role type as: [role1, role2, …, roleq];

[0083] Define the operation type as: [oper1, oper2, ..., operr];

[0084] Define the data type as: [data1, data2,…, datas];

[0085] p, q, r, s are positive integers; user p Indicates the pth user type; role q Indicates the qth role type; oper r Indicates the rth operation type; data s Indicates the sth data type.

[0086] In step S2, the permission is permission to operate the data;

[0087] There are r types of operation and s types of data, so there are r·s permissions in total;

[0088] The total user permissions are expressed as: [per1,per2,…,per r·s ], where among the r·s permissions, the permissions assigned to the user are marked as 1, and the permissions not assigned to the user are marked as 0;

[0089] The total permissions of a role are expressed as: [Per1, Per2,…, Per r·s ], where among the r·s permissions, the permissions assigned to the role are marked as 1, and the permissions not assigned to the role are marked as 0;

[0090] Define the user's role type: assign the role type to the user;

[0091] Superimpose the permissions corresponding to the corresponding user and role types: among the permissions assigned to the user and the permissions assigned to the role, the permissions with the user or role permissions marked as 1 in the corresponding permissions will remain 1 after superposition, and the permissions with the user or role permissions marked as 0 in the corresponding permissions will become 0 after superposition; perform an OR operation on the corresponding permission marks to complete the permission superposition;

[0092] The superimposed permissions are expressed as [perm1, perm2,…, perm r·s ] and the corresponding marks.

[0093] In step S3, the permissions and conditions required to operate the data type are defined according to the data type and operation type. The specific method is as follows:

[0094] Mark the permissions required by users to operate this data type as 1;

[0095] Set up the required conditions:

[0096] Role conditions: the role requirements that must be met to operate on this type of data, and the data can be operated within the specified role scope;

[0097] Time condition: the time requirement that needs to be met to operate on this type of data, and the data must be operated within the specified time range;

[0098] Spatial conditions: the spatial requirements that must be met to operate on this type of data, and the data must be operated within a specified geographical range;

[0099] In step S4, the permissions and conditions required to operate the data type are defined according to the data type and the operation type. The specific method is as follows:

[0100] Mark the permissions required by users to operate this data type as 1;

[0101] Set up the required conditions:

[0102] Role conditions: the role requirements that must be met to operate on this type of data, and the data can be operated within the specified role scope;

[0103] Time condition: the time requirement that needs to be met to operate on this type of data, and the data must be operated within the specified time range;

[0104] Spatial conditions: the spatial requirements that must be met to operate on this type of data, and the data must be operated within a specified geographical range;

[0105] In step S4, when the user requests an operation, the verification specifically includes: authority verification and condition verification;

[0106] Permission verification: select the permission tag corresponding to the operation type and data type requested by the user from the permissions and their corresponding tags superimposed in step S2, and perform an XOR operation with the permission tag required for operating the type of data defined in step S3. If the result is 0, it means the verification is passed, and if the result is 1, it means the verification fails and the reason is returned;

[0107] Condition verification: including role condition verification, space condition verification and time condition verification;

[0108] Role condition: define the degree of satisfaction of the role condition as G1; when a user requests the operation, verify whether the user belongs to the defined role type range based on character matching; if it matches, it passes and the degree of satisfaction is marked as 100%; if it does not match, it fails and the degree of satisfaction is marked as 0;

[0109] Spatial conditions: define the degree of satisfaction of spatial conditions as G2; determine whether the requested operation location belongs to the defined operable location range; obtain the user's IP data and GPS data; when the user accesses WiFi, obtain WiFi data, otherwise obtain base station data;

[0110] Estimate the approximate geographic location based on the IP address; obtain the user's precise geographic location from GPS data; infer the location based on the basic service set identifier (BSSID) of the WiFi network and the received signal strength indicator (RSSI); infer the location based on the base station ID and signal strength;

[0111] Set a threshold a. When the location difference between any two of the IP data, GPS data, WiFi data, and base station data is not less than a, use the GPS data as the location information and verify whether it belongs to the operable location interval. When the verification is passed, the satisfaction degree is marked as 100%;

[0112] If the verification fails, the GPS data is used as the location information, the boundary of the operable range is divided into different line segments, the distance from the point to each line segment is calculated, and the minimum value Po is taken. min ; Calculate the distance d1 between the position information and the centroid of the operable range. The degree of satisfaction is When the operable range is a concave polygon, divide the operable range into multiple convex polygons, find the centroid of each polygon, and then calculate the average value d2 of the distance between the position information and the centroid of each convex polygon. At this time, the satisfaction degree is

[0113] When the position difference between any two of the IP data, GPS data, WiFi data and base station data is greater than a, the Kalman filter is used to smooth and fuse the position data between multiple data sources; the fused position is used as the position information, the boundary of the operable range is divided into different line segments, the distance from the point to each line segment is calculated, and the minimum value Pos min ; Calculate the distance d3 between the position information and the centroid of the operable range. At this time, the degree of satisfaction is When the operable range is a concave polygon, divide the operable range into multiple convex polygons, find the centroid of each polygon, and then calculate the average value d4 of the distance between the position information and the centroid of each convex polygon. At this time, the satisfaction degree is

[0114] Time condition: define the degree of satisfaction of the time condition as G3; determine whether the requested operation time falls within the defined operable time range;

[0115] Determine the time zone where the user is located based on the location obtained by spatial condition verification; convert the operation time requested by the user into the time zone time required for the operation data; check whether the converted time point is within the specified operable time range;

[0116] The satisfaction degree is marked as 100% within the operable time range; when the time point does not belong to the operable time range, the time distance D1 between the time point and the midpoint of the operable time range and the time distance D2 between the time point and the border of the operable time range closest to the time point are calculated; at this time, the satisfaction degree is 1-(D2 / D1);

[0117] According to the historical application records, user type, role type, user authority, application operation type, application operation data type, role condition, spatial condition and time condition are used as feature variables; approval result is used as target variable; training set and data set are divided, random forest model is trained, and based on information gain, the information gain brought by each feature during splitting is calculated to determine the importance of different features; the feature importance I1, I2 and I3 of the feature variables role condition, spatial condition and time condition are obtained;

[0118] Set the combination condition verification threshold A; calculate the value of G1·I1 / (I1+I2+I3)+G2·I2 / (I1+I2+I3)+G3·I3 / (I1+I2+I3); when it is not less than A, the combination condition verification is considered to have passed; otherwise, it fails.

[0119] In step S5, based on historical application records and approval results, a random forest algorithm is used to implement automated approval of user applications;

[0120] In the application history, the application record includes user type, role type, user authority, type of operation applied for, data type of the operation applied for, authority to be applied for, reason for application, and application result;

[0121] Select user type, role type, user authority, applied operation type, applied operation data type, applied authority, and application reason as feature variables; the application result is the target variable, including approval and rejection;

[0122] Process the application record data, including removing missing values ​​and outliers to ensure data quality; perform natural language processing on text features and convert them into numerical feature TF-IDF values; perform one-hot encoding on categorical features and convert them into binary features;

[0123] The sample data is used as a data set and divided into a training set and a test set. The training set is used to build a random forest model and the hyperparameters are adjusted to optimize the model performance.

[0124] Input new applications into the model and output approval results.

[0125] A functional authority management system based on role control and combination conditions, the system includes: a role control module, an authority definition module, a combination condition module and an authority application module;

[0126] The role control module is used to define the types and permissions of users and roles, as well as the superposition of permissions; the permission definition module is used to define the types of operations and data and the permissions for operating data types; the combined condition module is used to verify permissions and conditions; the permission application module is used to apply for permissions when verification fails and to automatically approve applications;

[0127] The output end of the role control module is connected to the input end of the combination condition; the output end of the authority definition module is connected to the input end of the combination condition module; the output end of the combination condition module is connected to the input end of the authority application module.

[0128] The role control module includes: a user type unit, a user authority unit, a role type unit, a role authority unit and a authority superposition unit;

[0129] The user type unit is used to define the type of user; the user permission unit is used to assign user permissions; the role type unit is used to define the type of role; the role permission unit is used to assign role permissions; the permission superposition unit is used to superimpose the permissions of users and roles;

[0130] The output end of the user type unit is connected to the input end of the user permission unit; the output end of the user permission unit is connected to the input end of the permission superposition unit; the output end of the role type unit is connected to the input end of the role permission unit; the output end of the role permission unit is connected to the input end of the permission superposition unit; the output end of the permission superposition unit is connected to the input end of the combination condition module.

[0131] The permission definition module includes an operation type unit, a data type unit and a data operation permission unit;

[0132] The operation type unit is used to define the type of operation; the data type unit is used to define the type of data; the data operation permission unit is used to define the permission required for operating the data type;

[0133] The output end of the operation type unit is connected to the input end of the data operation permission unit; the output end of the data type unit is connected to the input end of the data operation permission unit; the output end of the data operation permission unit is connected to the input end of the combination condition module.

[0134] The combination condition module includes an authority verification unit, a role verification unit, a space verification unit, a time verification unit, a combination verification unit and an operation unit;

[0135] The permission verification unit is used to verify the matching degree between the superposition permission and the data operation permission; the role verification unit is used to verify whether the user role meets the operation condition requirements; the space verification unit is used to verify whether the user space condition meets the operation condition requirements; the time verification unit is used to verify whether the user time condition meets the operation condition requirements; the combination verification unit is used to verify the combination conditions; the operation unit is used to operate the data after the user meets the permission and conditions;

[0136] The output end of the authority verification unit is connected to the input end of the role verification unit; the output end of the role verification unit is connected to the input end of the space verification unit; the output end of the space verification unit is connected to the input end of the time verification unit; the output end of the time verification unit is connected to the input end of the combination verification unit; the output end of the combination verification unit is connected to the input end of the operation unit and the authority application module.

[0137] The permission application module includes: a permission application unit, an application approval unit and an end operation unit;

[0138] The permission application unit is used to apply for permission when the user's permission or conditions are not met; the application approval unit is used to automatically approve the user's application; the end operation unit is used to end the operation on the data;

[0139] The output end of the permission application unit is connected to the input end of the application approval unit; the output end of the application approval unit is connected to the input end of the end operation unit and the combination condition module.

[0140] In this embodiment: user types are defined as: common user, administrator;

[0141] Define the role types as: reading role, writing role;

[0142] Define the operation types as: read, write;

[0143] Define the data types as: financial data, personnel data;

[0144] There are 2 types of operations and 2 types of data, so there are 4 types of permissions in total;

[0145] The total permissions are expressed as: read financial data, write financial data, read personnel data, write personnel data; ordinary users have the permissions to read financial data and read personnel data, 1010; administrators have all permissions, 1111; the reading role has the permissions to read financial data and read personnel data, 1010; the writing role has the permissions to write financial data and write personnel data, 0101;

[0146] Define the user's role type: assign the role type to the user;

[0147] Define the normal user role as the reading role and the administrator as the writing role;

[0148] Superimpose the permissions corresponding to the corresponding user and role types: among the permissions assigned to the user and the permissions assigned to the role, the permissions with the user or role permissions marked as 1 in the corresponding permissions will remain 1 after superposition, and the permissions with the user or role permissions marked as 0 in the corresponding permissions will become 0 after superposition; perform an OR operation on the corresponding permission marks to complete the permission superposition;

[0149] The permissions of ordinary users and reading roles are superimposed. The OR operation of 1010 and 1010 is 1010, which has the permission to read financial data and read personnel data. The permissions of administrators and writing roles are superimposed. The OR operation of 1111 and 0101 is 1111, which has all permissions.

[0150] Mark the permission required to write financial data as 1;

[0151] The conditions that need to be met to write financial data are:

[0152] Role conditions: Must be a writing role;

[0153] Spatial conditions: can only be operated within the city where the company is located;

[0154] Time conditions: Only during working hours, 9:00-18:00

[0155] If a normal user wants to write financial data data_1 at 20:00 during non-working hours, the system will perform the following steps:

[0156] Permission verification:

[0157] User permissions: [1,0,1,0]; permissions after superposition: [1,0,1,0];

[0158] Write financial data permissions: [0,1,0,0];

[0159] Result: 1 XOR 0 = 1, verification failed;

[0160] Return verification failure information and reason: the user does not have permission to write financial data;

[0161] User application permissions:

[0162] The system collects application records and performs automated approval:

[0163] User type: ordinary user; Role type: reading role; User permissions: [1,0,1,0]; Application operation type: write; Application operation data type: financial data; Requested permissions: write financial data; Application reason keywords: emergency update; The system uses a random forest model for approval and determines whether the application is approved based on historical data.

[0164] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0165] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for managing functional rights based on role control and combined conditions, characterized in that: The method comprises the following steps: S1. Define user type, role type, operation type, and data type; S2. Define the permissions of users and roles; define the role types of users, and add permissions corresponding to the corresponding users and role types; S3. Define the permissions and conditions required to operate the data type according to the data type and operation type; S4. When a user requests an operation, verify whether the user's permissions and conditions meet the requirements based on the permissions and conditions corresponding to the operation type and data type; S5. When the user fails the verification and then applies for permission, the system automatically approves the application; In step S1, the user type is defined as: [user1, user2, ..., user p ]; Define the role type as: [role1, role2, ..., role q ]; Define the operation type as: [oper1,oper2,…,oper r ]; Define the data type as: [data1, data2,…, data s ]; p, q, r, s are positive integers; user p Indicates the pth user type; role q Indicates the qth role type; oper r Indicates the rth operation type; data s Indicates the sth data type; In step S2, the permission is permission to operate the data; There are r types of operation and s types of data, so there are r·s permissions in total; The total user permissions are expressed as: [per1,per2,…,per r·s ], where among the r·s permissions, the permissions assigned to the user are marked as 1, and the permissions not assigned to the user are marked as 0; The total permissions of a role are expressed as: [Per1, Per2,…, Per r·s ], where among the r·s permissions, the permissions assigned to the role are marked as 1, and the permissions not assigned to the role are marked as 0; Define the user's role type: assign the role type to the user; Superimpose the permissions corresponding to the corresponding user and role types: among the permissions assigned to the user and the permissions assigned to the role, the permissions with the user or role permissions marked as 1 in the corresponding permissions will remain 1 after superposition, and the permissions with the user or role permissions marked as 0 in the corresponding permissions will become 0 after superposition; perform an OR operation on the corresponding permission marks to complete the permission superposition; The superimposed permissions are expressed as [perm1, perm2,…, perm r·s ] and corresponding marks; In step S3, the permissions and conditions required to operate the data type are defined according to the data type and operation type. The specific method is as follows: Mark the permissions required by users to operate this data type as 1; Set up the required conditions: Role conditions: the role requirements that must be met to operate on this type of data, and the data can be operated within the specified role scope; Time condition: the time requirement that needs to be met to operate on this type of data, and the data must be operated within the specified time range; Spatial conditions: the spatial requirements that must be met to operate on this type of data, and the data must be operated within a specified geographical range; In step S4, when the user requests an operation, the verification specifically includes: authority verification and condition verification; Permission verification: select the permission tag corresponding to the operation type and data type requested by the user from the permissions and their corresponding tags superimposed in step S2, and perform an XOR operation with the permission tag required for operating the type of data defined in step S3. If the result is 0, it means the verification is passed, and if the result is 1, it means the verification fails and the reason is returned; Condition verification: including role condition verification, space condition verification and time condition verification; Role condition: define the degree of satisfaction of the role condition as G1; when a user requests the operation, verify whether the user belongs to the defined role type range based on character matching; if it matches, it passes and the degree of satisfaction is marked as 100%; if it does not match, it fails and the degree of satisfaction is marked as 0; Spatial conditions: define the degree of satisfaction of spatial conditions as G2; determine whether the requested operation location belongs to the defined operable location range; obtain the user's IP data and GPS data; when the user accesses WiFi, obtain WiFi data, otherwise obtain base station data; Estimate the approximate geographic location based on the IP address; obtain the user's precise geographic location from GPS data; infer the location based on the basic service set identifier (BSSID) of the WiFi network and the received signal strength indicator (RSSI); infer the location based on the base station ID and signal strength; Set a threshold a. When the location difference between any two of the IP data, GPS data, WiFi data, and base station data is not less than a, use the GPS data as the location information and verify whether it belongs to the operable location interval. When the verification is passed, the satisfaction degree is marked as 100%; If the verification fails, the GPS data is used as the location information, the boundary of the operable range is divided into different line segments, the distance from the point to each line segment is calculated, and the minimum value Po is taken. min ; Calculate the distance d1 between the position information and the centroid of the operable range. The degree of satisfaction is When the operable range is a concave polygon, divide the operable range into multiple convex polygons, find the centroid of each polygon, and then calculate the average value d2 of the distance between the position information and the centroid of each convex polygon. At this time, the satisfaction degree is When the position difference between any two of the IP data, GPS data, WiFi data and base station data is greater than a, the Kalman filter is used to smooth and fuse the position data between multiple data sources; the fused position is used as the position information, the boundary of the operable range is divided into different line segments, the distance from the point to each line segment is calculated, and the minimum value Pos min ; Calculate the distance d3 between the position information and the centroid of the operable range. At this time, the degree of satisfaction is When the operable range is a concave polygon, divide the operable range into multiple convex polygons, find the centroid of each polygon, and then calculate the average value d4 of the distance between the position information and the centroid of each convex polygon. At this time, the satisfaction degree is Time condition: define the degree of satisfaction of the time condition as G3; determine whether the requested operation time falls within the defined operable time range; Determine the time zone where the user is located based on the location obtained by spatial condition verification; convert the operation time requested by the user into the time zone time required for the operation data; check whether the converted time point is within the specified operable time range; The satisfaction degree is marked as 100% within the operable time range; when the time point does not belong to the operable time range, the time distance D1 between the time point and the midpoint of the operable time range and the time distance D2 between the time point and the border of the operable time range closest to the time point are calculated; at this time, the satisfaction degree is 1-(D2 / D1); According to the historical application records, user type, role type, user authority, application operation type, application operation data type, role condition, spatial condition and time condition are used as feature variables; approval result is used as target variable; training set and data set are divided, random forest model is trained, and based on information gain, the information gain brought by each feature during splitting is calculated to determine the importance of different features; the feature importance I1, I2 and I3 of the feature variables role condition, spatial condition and time condition are obtained; Set the combination condition verification threshold A; calculate the value of G1·I1 / (I1+I2+I3)+G2·I2 / (I1+I2+I3)+G3·I3 / (I1+I2+I3); when it is not less than A, the combination condition verification is considered to have passed; otherwise, it fails.

2. The method for managing functional rights based on role control and combined conditions according to claim 1 is characterized in that: In step S5, based on historical application records and approval results, a random forest algorithm is used to implement automated approval of user applications; In the application history, the application record includes user type, role type, user authority, type of operation applied for, data type of the operation applied for, authority to be applied for, reason for application, and application result; Select user type, role type, user authority, type of operation applied for, data type of operation applied for, authority to be applied for, and reason for application as feature variables; The application result is the target variable, including approval and failure. Process the application record data, including removing missing values ​​and outliers to ensure data quality; perform natural language processing on text features and convert them into numerical feature TF-IDF values; One-hot encode the categorical features to convert them into binary features; The sample data is used as a data set and divided into a training set and a test set. The training set is used to build a random forest model and the hyperparameters are adjusted to optimize the model performance. Input new applications into the model and output approval results.

3. A function permission management system based on role control and combination conditions, applying the function permission management method based on role control and combination conditions as claimed in claim 1 or claim 2, characterized in that: The system includes: a role control module, a permission definition module, a combination condition module and a permission application module; The role control module is used to define the types and permissions of users and roles, as well as the superposition of permissions; the permission definition module is used to define the types of operations and data and the permissions for operating data types; the combined condition module is used to verify permissions and conditions; the permission application module is used to apply for permissions when verification fails and to automatically approve applications; The output end of the role control module is connected to the input end of the combination condition; the output end of the authority definition module is connected to the input end of the combination condition module; the output end of the combination condition module is connected to the input end of the authority application module.

4. The function authority management system based on role control and combination conditions according to claim 3 is characterized in that: The role control module includes: a user type unit, a user authority unit, a role type unit, a role authority unit and a authority superposition unit; The user type unit is used to define the type of user; the user permission unit is used to assign user permissions; the role type unit is used to define the type of role; the role permission unit is used to assign role permissions; the permission superposition unit is used to superimpose the permissions of users and roles; The output end of the user type unit is connected to the input end of the user permission unit; the output end of the user permission unit is connected to the input end of the permission superposition unit; the output end of the role type unit is connected to the input end of the role permission unit; the output end of the role permission unit is connected to the input end of the permission superposition unit; the output end of the permission superposition unit is connected to the input end of the combination condition module.

5. The function authority management system based on role control and combination conditions according to claim 4 is characterized in that: The permission definition module includes an operation type unit, a data type unit and a data operation permission unit; The operation type unit is used to define the type of operation; the data type unit is used to define the type of data; the data operation permission unit is used to define the permission required for operating the data type; The output end of the operation type unit is connected to the input end of the data operation permission unit; the output end of the data type unit is connected to the input end of the data operation permission unit; the output end of the data operation permission unit is connected to the input end of the combination condition module.

6. The function authority management system based on role control and combination conditions according to claim 5 is characterized in that: The combination condition module includes an authority verification unit, a role verification unit, a space verification unit, a time verification unit, a combination verification unit and an operation unit; The permission verification unit is used to verify the matching degree between the superposition permission and the data operation permission; the role verification unit is used to verify whether the user role meets the operation condition requirements; the space verification unit is used to verify whether the user space condition meets the operation condition requirements; the time verification unit is used to verify whether the user time condition meets the operation condition requirements; the combination verification unit is used to verify the combination conditions; the operation unit is used to operate the data after the user meets the permission and conditions; The output end of the authority verification unit is connected to the input end of the role verification unit; the output end of the role verification unit is connected to the input end of the space verification unit; the output end of the space verification unit is connected to the input end of the time verification unit; the output end of the time verification unit is connected to the input end of the combination verification unit; the output end of the combination verification unit is connected to the input end of the operation unit and the authority application module; the output end of the operation unit is connected to the input end of the authority application module.

7. The function authority management system based on role control and combination conditions according to claim 6 is characterized in that: The permission application module includes: a permission application unit, an application approval unit and an end operation unit; The permission application unit is used to apply for permission when the user's permission or conditions are not met; the application approval unit is used to automatically approve the user's application; the end operation unit is used to end the operation on the data; The output end of the permission application unit is connected to the input end of the application approval unit; the output end of the application approval unit is connected to the input end of the end operation unit and the combination condition module.

Images