Authority management method and device, computer equipment and storage medium

Abstract

The invention discloses an authority management method and device, computer equipment and a storage medium. The method comprises the following steps: when an authority request uploaded by a preset system is received, analyzing the authority request, and obtaining a user identifier and service content corresponding to the authority request; analyzing the service content, and obtaining multiple pieces of sub-service information corresponding to the service content and a service sequence corresponding to each piece of sub-service information; inputting each piece of sub-service information into a pre-trained permission confirmation model, analyzing each piece of sub-service information by the permission confirmation model, and outputting a service permission range and a service permission duration corresponding to each piece of sub-service information; obtaining a current permission range of the user in a preset system according to the user identifier, and generating a plurality of authorization permission ranges according to each service permission range and the current permission range; generating permission granting information according to the plurality of authorization permission ranges, the service permission duration corresponding to each authorization permission range and the service sequence; and completing the management of the user permission according to the user identifier and the permission granting information.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, which is applied in the financial field, and in particular to a permission management method, device, computer equipment and storage medium. Background Art

[0002] Financial business systems have frequent business interactions, and business personnel frequently need temporary authorization of access rights control, that is, temporarily raising the business personnel's level to a specific level and authorizing them to interact with specific temporary resources. After completing the task, the permissions are restored to the original level.

[0003] The traditional permission management method is to assign users in the system to different roles based on the needs of different positions. Each role has specific permissions and operating scope to manage the permissions of each user.

[0004] However, in the traditional model, when the roles granted contain many permissions that users do not need to use, there is a risk that users will use these permissions to obtain relevant privacy information. However, if users are not granted corresponding role permissions, it will bring huge workload to the corresponding senior managers, resulting in many problems in the current permission management methods, such as potential security risks of permission data, data leakage risks, and inconsistent permission system standards. Summary of the invention

[0005] This application provides a permission management method, device, computer equipment and storage medium, which aims to solve the problem that in the traditional mode, when the role given to the user contains many permissions that the user does not need to use, there is a risk that the user uses these permissions to obtain relevant privacy information. However, if the user is not granted the corresponding role permissions, it will bring a huge workload to the corresponding senior management personnel, resulting in many problems such as security risks of permission data, data leakage risks, and inconsistent permission system standards. The method provided can form a complete, standard, and secure automated permission management solution to ensure that the preset system can operate safely while responding to business quickly.

[0006] In a first aspect, the present application provides a rights management method, comprising:

[0007] When receiving the permission request uploaded by the preset system, parse the permission request and obtain the user ID corresponding to the permission request and the business content corresponding to the permission request;

[0008] Parse the business content, obtain multiple sub-business information corresponding to the business content and the business sequence corresponding to each sub-business information;

[0009] Input each sub-business information into the pre-trained permission confirmation model. The permission confirmation model parses each sub-business information and outputs the business permission scope and business permission duration corresponding to each sub-business information.

[0010] Obtain the user's current authority scope in the preset system according to the user ID, and generate multiple authorized authority scopes according to each business authority scope and the current authority scope;

[0011] Generate permission granting information according to multiple authorization permission ranges, business permission duration corresponding to each authorization permission range, and business sequence;

[0012] The management of user rights is completed based on user identification and permission granting information.

[0013] In some embodiments, multiple authorization authority scopes are generated based on each business authority scope and the current authority scope, including: obtaining the difference authority scope corresponding to each business authority scope and the current authority scope; obtaining the target business information corresponding to each difference authority scope in each sub-business information; obtaining the necessity factors of each target business information and the corresponding sub-business information; if the target business information is confirmed as a necessary business in the sub-business information based on the necessity factors, generating the authorization authority scope based on the difference authority scope.

[0014] In some embodiments, after completing the management of user permissions based on user identification and permission granting information, it also includes: obtaining the audit log of the user in the preset system during the permission granting period; the audit log includes at least the user's actual operation information; generating preset operation information based on the sub-business information, the business sequence corresponding to each sub-business information, and the business permission duration to determine whether the preset operation information and the actual operation information are consistent; if the preset operation information and the actual operation information are inconsistent, generating a permission withdrawal instruction; sending the permission withdrawal instruction to the preset system to cancel the permission granting to the user.

[0015] In some embodiments, before parsing the business content and obtaining multiple sub-business information corresponding to the business content and the business order corresponding to each sub-business information, it also includes: obtaining the user's position information in a preset system based on the user identifier; extracting the business feature information corresponding to the business content; obtaining the matching degree between the position information and the business feature information; if the matching degree is lower than the preset matching degree, returning the permission request.

[0016] In some embodiments, before generating permission granting information based on multiple authorization authority scopes, the business authority duration corresponding to each authorization authority scope, and the business sequence, it also includes: querying the user's completed business information based on the user identifier in a preset system; the completed business information includes completed business content, the business type corresponding to the completed business content, and the completion duration; generating a duration prediction model corresponding to the user based on the completed business content, the business type corresponding to the completed business content, and the completion duration; obtaining the business type corresponding to each sub-business information; inputting the business type and business content corresponding to each sub-business information into the duration prediction model, and the duration prediction model outputs the predicted completion duration corresponding to each sub-business information; and updating the business authority duration based on the predicted completion duration corresponding to each sub-business information.

[0017] In some embodiments, business content is parsed to obtain multiple sub-business information corresponding to the business content and a business sequence corresponding to each sub-business information, including: obtaining business coding information corresponding to the business content; inputting the business coding information into a pre-trained sub-business extraction model, and the sub-business extraction model outputs the sub-business information and business sequence corresponding to the business coding information.

[0018] Exemplarily, before inputting the business coding information into the pre-trained sub-business extraction model, it also includes: obtaining multiple historical business information corresponding to a preset system and historical sub-business information and historical business sequence corresponding to each historical business information; inputting the historical business information into the sub-business extraction model to be trained, the sub-business extraction model parses the historical business information, and outputs predicted sub-business information and predicted business sequence; completing the training of the sub-business extraction model according to the historical sub-business information and predicted business information, the historical business sequence and the predicted business sequence.

[0019] In a second aspect, the present application provides a rights management device, including:

[0020] The request receiving module is used to parse the permission request when receiving the permission request uploaded by the preset system, and obtain the user identification corresponding to the permission request and the business content corresponding to the permission request;

[0021] A business analysis module is used to analyze business content, obtain multiple sub-business information corresponding to the business content and the business sequence corresponding to each sub-business information;

[0022] The scope output module is used to input each sub-business information into the pre-trained permission confirmation model. The permission confirmation model parses each sub-business information and outputs the business permission scope and business permission duration corresponding to each sub-business information.

[0023] A scope confirmation module is used to obtain the current authority scope of the user in the preset system according to the user ID, and generate multiple authorized authority scopes according to each business authority scope and the current authority scope;

[0024] An information generation module is used to generate permission granting information according to multiple authorization permission ranges, the business permission duration corresponding to each authorization permission range, and the business sequence;

[0025] The permission granting module is used to manage user permissions based on user identification and permission granting information.

[0026] In a third aspect, the present application further provides a computer device, including:

[0027] Memory and processor;

[0028] The memory is used to store computer programs;

[0029] The processor is used to execute the computer program and implement the steps of the rights management method described in the first aspect when executing the computer program.

[0030] In a fourth aspect, the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the processor implements the steps of the permission management method described in the first aspect above.

[0031] The present application discloses a permission management method, device, computer equipment and storage medium. When receiving a permission request uploaded by a preset system, the method parses the permission request, obtains the user ID corresponding to the permission request and the business content corresponding to the permission request; parses the business content, obtains multiple sub-business information corresponding to the business content and the business sequence corresponding to each sub-business information; inputs each sub-business information into a pre-trained permission confirmation model, and the permission confirmation model parses each sub-business information, outputs the business permission scope and business permission duration corresponding to each sub-business information; obtains the current permission scope of the user in the preset system according to the user ID, generates multiple authorized permission scopes according to each business permission scope and the current permission scope; generates permission granting information according to multiple authorized permission scopes, the business permission duration corresponding to each authorized permission scope and the business sequence; completes the management of user permissions according to the user ID and permission granting information.

[0032] The provided method analyzes the business content corresponding to the user, splits it into multiple sub-business information, and confirms the business authority scope and business authority duration of each sub-business information through the authority confirmation model. The actual authorized authority scope of the user is determined according to the current authority scope of the user, and then the authority granting information can be generated for the business authority duration, authorized authority scope and business sequence of each sub-business information. While managing user authority, the dynamic authority granting of users can be realized accurately. This ensures the security of the system while ensuring the normal operation of the business.

[0033] At the same time, the provided method also has the following advantages:

[0034] 1. Form a complete, standard and secure temporary authorization management solution to support temporary system permissions for users. This method can ensure that the authorization is reasonable and necessary, and track all authorization operations to prevent abuse. At the same time, it supports self-service authorization, and users can apply for it themselves and obtain the corresponding temporary permissions after verification. This method not only simplifies the authorization process, but also improves operational efficiency.

[0035] 2. Authorization security risks are controllable, and multi-level permission control is supported. Multiple levels of permission control are set in the preset system, and different levels of permissions are assigned according to user positions, roles, etc. When a user needs to perform a task that is not within the scope of daily job responsibilities, he can obtain the required access rights by requesting authorization from the superior administrator.

[0036] 3. Supports automatic revocation of time limits. For users who need to obtain permissions temporarily, a time limit can be set so that they have the required permissions within a preset period of time. Once the time is exceeded, the user's permissions will be automatically revoked. This can prevent information leakage caused by overdue unauthorized access and operations.

[0037] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0039] Figure 1 is a schematic flow chart of the steps of a rights management method provided by an embodiment of the present application;

[0040] Figure 2This is a schematic flow chart of the steps of a method for generating an authorization authority range provided in an embodiment of the present application;

[0041] Figure 3 is a schematic flow chart of the steps of a method for cancelling permission granting provided by an embodiment of the present application;

[0042] Figure 4 It is a structural diagram of a rights management device provided by an embodiment of the present application;

[0043] Figure 5 It is a schematic block diagram of the structure of a computer device provided in one embodiment of the present application.

[0044] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. DETAILED DESCRIPTION

[0045] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0046] The flowcharts shown in the accompanying drawings are only examples and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may be decomposed, combined or partially merged, so the actual execution order may change according to actual conditions.

[0047] It should be understood that, in order to facilitate the clear description of the technical solutions of the embodiments of the present invention, in the embodiments of the present invention, the words "first", "second", etc. are used to distinguish the same items or similar items with substantially the same functions and effects. Those skilled in the art can understand that the words "first", "second", etc. do not limit the quantity and execution order, and the words "first", "second", etc. do not necessarily limit the difference.

[0048] It should be understood that the terms used in this application specification are only for the purpose of describing specific embodiments and are not intended to limit the application. As used in this application specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0049] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0050] In conjunction with the accompanying drawings, some embodiments of the present application are described in detail below. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0051] Financial business systems have frequent business interactions, and business personnel frequently need temporary authorization of access rights control, that is, temporarily raising the business personnel's level to a specific level and authorizing them to interact with specific temporary resources. After completing the task, the permissions are restored to the original level.

[0052] The traditional permission management method is to assign users in the system to different roles based on the needs of different positions. Each role has specific permissions and operating scope to manage the permissions of each user.

[0053] However, in the traditional model, when the roles granted contain many permissions that users do not need to use, there is a risk that users will use these permissions to obtain relevant privacy information. However, if users are not granted corresponding role permissions, it will bring huge workload to the corresponding senior managers, resulting in many problems in the current permission management methods, such as potential security risks of permission data, data leakage risks, and inconsistent permission system standards.

[0054] To solve the above problems, please refer to Figure 1 , Figure 1 1 is a schematic flow chart of a rights management method provided by an embodiment of the present application. The rights management method can be implemented by a computer device, which can be deployed on a single server or a server cluster. It can also be deployed on a handheld terminal, a laptop computer, a wearable device or a robot, etc.

[0055] To solve the above problems, please refer to Figure 1 Specifically, Figure 1 As shown, the provided method includes steps S101 to S106. The details are as follows:

[0056] S101. When receiving a permission request uploaded by a preset system, parse the permission request to obtain a user ID corresponding to the permission request and business content corresponding to the permission request.

[0057] Specifically, when the server receives a permission request uploaded by the preset system, such as when any employee in the preset financial system uploads a permission request to apply for greater permissions due to business needs, the server first parses the permission request and obtains the user representation and business content corresponding to the requested permission request. That is, through the provided method, the server automatically parses and verifies each permission request, and grants the corresponding permission to the user after the verification passes. This achieves efficient management of user permissions for the preset system.

[0058] It should be noted that in some embodiments, the preset system can be a financial system, a medical system, or a management system with a large number of business volumes. The provided method can greatly improve the efficiency of authority management of various systems, thereby improving the stability and security of system business operations.

[0059] S102. Analyze the business content, obtain multiple sub-business information corresponding to the business content and the business sequence corresponding to each sub-business information.

[0060] Specifically, by parsing the business content, the server can obtain multiple sub-business information corresponding to each business content and the business sequence corresponding to each sub-business information. The sub-business information can correspond to a step, such as reviewing a matter, checking a document, modifying a file code, etc. The embodiment of the present application does not limit the scope of the sub-business information. However, by splitting the business content, the present application can accurately and precisely parse the permissions actually required by the business content.

[0061] In some embodiments, before parsing the business content and obtaining multiple sub-business information corresponding to the business content and the business order corresponding to each sub-business information, it also includes: obtaining the user's position information in a preset system based on the user identifier; extracting the business feature information corresponding to the business content; obtaining the matching degree between the position information and the business feature information; if the matching degree is lower than the preset matching degree, returning the permission request.

[0062] In order to prevent users from fabricating business content, the server obtains the user's job information and the business features corresponding to the business content in the preset system to calculate the matching degree. For example, if the job information is a sales position, but the business content is to view experimental data, the server will return the permission request if the position and business are too different, to avoid data leakage. Or the business content with a matching degree lower than the preset matching degree will be sent to the management end of the position corresponding to the business content for review. That is, if position A needs to request the business corresponding to position B, then the corresponding management of position B needs to review and approve it before authorization can be made, thereby improving the security of the system.

[0063] In some embodiments, business content is parsed to obtain multiple sub-business information corresponding to the business content and a business sequence corresponding to each sub-business information, including: obtaining business coding information corresponding to the business content; inputting the business coding information into a pre-trained sub-business extraction model, and the sub-business extraction model outputs the sub-business information and business sequence corresponding to the business coding information.

[0064] By encoding the features of the business content, the corresponding business coding information is obtained and input into the sub-business extraction model, such as the neural network model, so that the sub-business information and business sequence corresponding to the business content can be quickly extracted, which can pave the way for the subsequent rapid determination of business permissions.

[0065] Exemplarily, before inputting the business coding information into the pre-trained sub-business extraction model, it also includes: obtaining multiple historical business information corresponding to a preset system and historical sub-business information and historical business sequence corresponding to each historical business information; inputting the historical business information into the sub-business extraction model to be trained, the sub-business extraction model parses the historical business information, and outputs predicted sub-business information and predicted business sequence; completing the training of the sub-business extraction model according to the historical sub-business information and predicted business information, the historical business sequence and the predicted business sequence.

[0066] By combining historical business information and the historical sub-business information and historical business sequence corresponding to each historical business information, it is possible to successfully use a large amount of traceable historical records of preset systems such as financial systems, and then accurately train a sub-business extraction model that can accurately split business content.

[0067] S103. Input each sub-business information into the pre-trained authority confirmation model. The authority confirmation model parses each sub-business information and outputs the business authority scope and business authority duration corresponding to each sub-business information.

[0068] Specifically, after the server splits the business content to obtain multiple sub-business information, by inputting the sub-business information into the corresponding permission confirmation model, the business permission scope involved in each sub-business information and the business permission duration corresponding to the sub-business information can be parsed. The provided method can accurately authorize users and control the authorization duration, ensuring the safe operation of the system and the normal operation of the business.

[0069] S104. Obtain the current authority scope of the user in the preset system according to the user identification, and generate multiple authorized authority scopes according to each business authority scope and the current authority scope.

[0070] Specifically, the server queries the current authority scope of the user in the preset system according to the user identification (such as ID, employee number, name, etc.), and then compares the business authority scope of each sub-business with the current authority scope to determine the authorization authority scope that needs to be granted to the user, thereby achieving accurate authorization of the user.

[0071] In some embodiments, Figure 2 As shown, multiple authorization authority scopes are generated according to each business authority scope and the current authority scope, including steps S104a to S104d.

[0072] Step S104a. Obtain the difference authority scope corresponding to each business authority scope and the current authority scope;

[0073] Step S104b. Obtain the target business information corresponding to each difference authority range in each sub-business information;

[0074] Step S104c. Obtaining the necessity factors of each target business information and the corresponding sub-business information;

[0075] Step S104d. If the target business information is confirmed as a necessary business in the sub-business information based on the necessity factor, an authorization authority range is generated based on the difference authority range.

[0076] Since some businesses may not be necessary for the entire sub-business information, we determine whether the target business information is necessary for the sub-business by calculating the proportion of the target business information in the sub-business information or its location or business type. We do not authorize non-essential businesses, but authorize necessary businesses with corresponding differentiated authority ranges. This ensures the normal operation of the business while also improving the security of the system.

[0077] S105. Generate authority granting information according to multiple authorization authority ranges, the business authority duration corresponding to each authorization authority range, and the business sequence.

[0078] Specifically, the server can generate permission granting information for accurate authorization of the user after determining the multiple permission ranges corresponding to this time, the business permission duration and business sequence corresponding to each authorized permission range, thereby realizing rapid determination of user permissions.

[0079] In some embodiments, before generating permission granting information based on multiple authorization authority scopes, the business authority duration corresponding to each authorization authority scope, and the business sequence, it also includes: querying the user's completed business information based on the user identifier in a preset system; the completed business information includes completed business content, the business type corresponding to the completed business content, and the completion duration; generating a duration prediction model corresponding to the user based on the completed business content, the business type corresponding to the completed business content, and the completion duration; obtaining the business type corresponding to each sub-business information; inputting the business type and business content corresponding to each sub-business information into the duration prediction model, and the duration prediction model outputs the predicted completion duration corresponding to each sub-business information; and updating the business authority duration based on the predicted completion duration corresponding to each sub-business information.

[0080] Since users may have different processing capabilities and speeds, in order to avoid users performing other operations due to too fast processing speed or being unable to complete operations due to too slow processing speed, this application builds a corresponding time prediction model for each user through the server, and then can determine the corresponding time for the user to complete each sub-business information based on the business content and business type of each sub-business information. If the predicted completion time is less than the business permission time, the business permission time is shortened, and vice versa, if the predicted completion time is longer, the business permission time is appropriately increased. This allows for flexible adjustment of the authorization time.

[0081] S106. Complete the management of user rights according to the user identification and the rights granting information.

[0082] Specifically, after generating the permission granting information corresponding to the user's request, the provided method quickly grants the permission to the user, and subsequently tracks the user's operations during the authorization period to ensure that the system security is not leaked. At the same time, taking into account conditional authorization and minimum authorization capabilities, a user or role can be given some specific operation permissions according to work needs, such as accessing a folder or modifying certain data. After meeting specific conditions, these permissions will be revoked, thereby ensuring that additional permissions can only be obtained when necessary, reducing system permission abuse. It also supports two protection mechanisms: revocation and notification. When the permission reaches the predetermined time or condition, the temporary authorization is automatically revoked, and a notification is sent to the administrator via email or SMS to follow up on permission changes in a timely manner to prevent unexpected security risks.

[0083] In some embodiments, Figure 3 As shown, after completing the management of the user rights according to the user identification and the rights granting information, it further includes steps S107a to S107d.

[0084] Step S107a. Obtain the audit log of the user in the preset system during the authorization period; the audit log includes at least the user's actual operation information;

[0085] Step S107b generates preset operation information according to the sub-business information, the business sequence and business authority duration corresponding to each sub-business information, to determine whether the preset operation information and the actual operation information are consistent;

[0086] Step S107c. If the preset operation information and the actual operation information are inconsistent, a permission withdrawal instruction is generated;

[0087] Step S107d. Send the permission withdrawal instruction to the preset system to cancel the permission granted to the user.

[0088] Through the above steps, the server can trace the source of each step of the user's actual operation, making the information protection capability of the preset system better. The provided method supports audit logs, which can support the user's actual operation information, including: login time, location, functions used, data modification and other audit logs, which can better protect the security and controllability of the preset system and prevent potential risks brought by temporary authorization.

[0089] The provided method analyzes the business content corresponding to the user, splits it into multiple sub-business information, and confirms the business permission scope and business permission duration of each sub-business information through the permission confirmation model. The actual authorization permission scope of the user is determined according to the current permission scope of the user, and then the permission granting information can be generated for the business permission duration, authorization permission scope and business sequence of each sub-business information. While managing user permissions, it realizes the accurate granting of dynamic permissions to users. This ensures the security of the system while ensuring the normal operation of the business.

[0090] At the same time, the provided method also has the following advantages:

[0091] 1. Form a complete, standard and secure temporary authorization management solution to support temporary system permissions for users. This method can ensure that the authorization is reasonable and necessary, and track all authorization operations to prevent abuse. At the same time, it supports self-service authorization, and users can apply for it themselves and obtain the corresponding temporary permissions after verification. This method not only simplifies the authorization process, but also improves operational efficiency.

[0092] 2. Authorization security risks are controllable, and multi-level permission control is supported. Multiple levels of permission control are set in the preset system, and different levels of permissions are assigned according to user positions, roles, etc. When a user needs to perform a task that is not within the scope of daily job responsibilities, he can obtain the required access rights by requesting authorization from the superior administrator.

[0093] 3. Supports automatic revocation of time limits. For users who need to obtain permissions temporarily, a time limit can be set so that they have the required permissions within a preset period of time. Once the time is exceeded, the user's permissions will be automatically revoked. This can prevent information leakage caused by overdue unauthorized access and operations.

[0094] See also Figure 4 As shown, Figure 4 1 is a schematic diagram of the structure of the rights management device 200 provided in an embodiment of the present application. The rights management device 200 is used to execute the steps of the rights management method shown in the above embodiments. The rights management device 200 can be a single server or a server cluster, or the rights management device 200 can be a terminal, which can be a handheld terminal, a laptop computer, a wearable device or a robot, etc.

[0095] like Figure 4 As shown, the rights management device 200 includes:

[0096] The request receiving module 201 is used to parse the permission request when receiving the permission request uploaded by the preset system, and obtain the user identification corresponding to the permission request and the business content corresponding to the permission request;

[0097] The business analysis module 202 is used to analyze the business content, obtain multiple sub-business information corresponding to the business content and the business sequence corresponding to each sub-business information;

[0098] The scope output module 203 is used to input each sub-business information into the pre-trained permission confirmation model, and the permission confirmation model parses each sub-business information and outputs the business permission scope and business permission duration corresponding to each sub-business information;

[0099] A scope confirmation module 204 is used to obtain the current authority scope of the user in the preset system according to the user identification, and generate multiple authorized authority scopes according to each business authority scope and the current authority scope;

[0100] Information generation module 205, used to generate permission granting information according to multiple authorization permission ranges, service permission duration corresponding to each authorization permission range, and service sequence;

[0101] The authority granting module 206 is used to manage the user's authority according to the user identification and the authority granting information.

[0102] It should be noted that technical personnel in the relevant field can clearly understand that for the convenience and conciseness of description, the specific working processes of the permission management device and each module described above can refer to the corresponding processes in the permission management method embodiments described in the above embodiments, and will not be repeated here.

[0103] The above-mentioned rights management method can be implemented in the form of a computer program. Figure 4 Run on the device shown.

[0104] See also Figure 5 , Figure 5 1 is a schematic block diagram of the structure of a computer device provided in an embodiment of the present application. The computer device includes a processor, a memory and a network interface connected via a device bus, wherein the memory may include a storage medium and an internal memory.

[0105] The storage medium can store an operating device and a computer program. The computer program includes program instructions, and when the program instructions are executed, the processor can execute any one of the rights management methods.

[0106] The processor is used to provide computing and control capabilities and support the operation of the entire computer equipment.

[0107] The internal memory provides an environment for the operation of the computer program in the non-volatile storage medium. When the computer program is executed by the processor, the processor can execute any one of the rights management methods.

[0108] The network interface is used for network communication, such as sending assigned tasks, etc. Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the scheme of the present application, and does not constitute a limitation on the terminal to which the scheme of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0109] It should be understood that the processor may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0110] In one embodiment, the processor is used to run a computer program stored in the memory to implement the following steps:

[0111] When receiving the permission request uploaded by the preset system, parse the permission request and obtain the user ID corresponding to the permission request and the business content corresponding to the permission request;

[0112] Parse the business content, obtain multiple sub-business information corresponding to the business content and the business sequence corresponding to each sub-business information;

[0113] Input each sub-business information into the pre-trained permission confirmation model. The permission confirmation model parses each sub-business information and outputs the business permission scope and business permission duration corresponding to each sub-business information.

[0114] Obtain the user's current authority scope in the preset system according to the user ID, and generate multiple authorized authority scopes according to each business authority scope and the current authority scope;

[0115] Generate permission granting information according to multiple authorization permission ranges, business permission duration corresponding to each authorization permission range, and business sequence;

[0116] The management of user rights is completed based on user identification and permission granting information.

[0117] In some embodiments, multiple authorization authority scopes are generated based on each business authority scope and the current authority scope, including: obtaining the difference authority scope corresponding to each business authority scope and the current authority scope; obtaining the target business information corresponding to each difference authority scope in each sub-business information; obtaining the necessity factors of each target business information and the corresponding sub-business information; if the target business information is confirmed as a necessary business in the sub-business information based on the necessity factors, generating the authorization authority scope based on the difference authority scope.

[0118] In some embodiments, after completing the management of user permissions based on user identification and permission granting information, it also includes: obtaining the audit log of the user in the preset system during the permission granting period; the audit log includes at least the user's actual operation information; generating preset operation information based on the sub-business information, the business sequence corresponding to each sub-business information, and the business permission duration to determine whether the preset operation information and the actual operation information are consistent; if the preset operation information and the actual operation information are inconsistent, generating a permission withdrawal instruction; sending the permission withdrawal instruction to the preset system to cancel the permission granting to the user.

[0119] In some embodiments, before parsing the business content and obtaining multiple sub-business information corresponding to the business content and the business order corresponding to each sub-business information, it also includes: obtaining the user's position information in a preset system based on the user identifier; extracting the business feature information corresponding to the business content; obtaining the matching degree between the position information and the business feature information; if the matching degree is lower than the preset matching degree, returning the permission request.

[0120] In some embodiments, before generating permission granting information based on multiple authorization authority scopes, the business authority duration corresponding to each authorization authority scope, and the business sequence, it also includes: querying the user's completed business information based on the user identifier in a preset system; the completed business information includes completed business content, the business type corresponding to the completed business content, and the completion duration; generating a duration prediction model corresponding to the user based on the completed business content, the business type corresponding to the completed business content, and the completion duration; obtaining the business type corresponding to each sub-business information; inputting the business type and business content corresponding to each sub-business information into the duration prediction model, and the duration prediction model outputs the predicted completion duration corresponding to each sub-business information; and updating the business authority duration based on the predicted completion duration corresponding to each sub-business information.

[0121] In some embodiments, business content is parsed to obtain multiple sub-business information corresponding to the business content and a business sequence corresponding to each sub-business information, including: obtaining business coding information corresponding to the business content; inputting the business coding information into a pre-trained sub-business extraction model, and the sub-business extraction model outputs the sub-business information and business sequence corresponding to the business coding information.

[0122] Exemplarily, before inputting the business coding information into the pre-trained sub-business extraction model, it also includes: obtaining multiple historical business information corresponding to a preset system and historical sub-business information and historical business sequence corresponding to each historical business information; inputting the historical business information into the sub-business extraction model to be trained, the sub-business extraction model parses the historical business information, and outputs predicted sub-business information and predicted business sequence; completing the training of the sub-business extraction model according to the historical sub-business information and predicted business information, the historical business sequence and the predicted business sequence.

[0123] A computer-readable storage medium is also provided in an embodiment of the present application, wherein the computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and the processor executes the program instructions to implement the steps of the permission management method provided in the above embodiments of the present application.

[0124] The computer-readable storage medium may be an internal storage unit of the computer device described in the foregoing embodiment, such as a hard disk or memory of the computer device. The computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, a smart memory card (SmartMedia Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc., equipped on the computer device.

[0125] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A rights management method, characterized in that: include: When receiving a permission request uploaded by a preset system, parsing the permission request, obtaining a user identifier corresponding to the permission request and a business content corresponding to the permission request; Parsing the business content, obtaining a plurality of sub-business information corresponding to the business content and a business sequence corresponding to each sub-business information; Input each of the sub-business information into a pre-trained permission confirmation model, the permission confirmation model parses each of the sub-business information, and outputs the business permission scope and business permission duration corresponding to each of the sub-business information; Acquire the current authority scope of the user in the preset system according to the user identifier, and generate multiple authorized authority scopes according to each of the business authority scopes and the current authority scope; Generate permission granting information according to multiple authorization permission ranges, business permission duration corresponding to each authorization permission range, and business sequence; The management of the user rights is completed according to the user identification and the rights granting information.

2. The method according to claim 1, characterized in that The generating of multiple authorization authority scopes according to each of the business authority scopes and the current authority scope includes: Obtain the difference authority scope corresponding to each of the business authority scopes and the current authority scope; Obtaining target business information corresponding to each of the difference authority ranges in each of the sub-business information; Obtaining the necessity factor of each of the target service information and the corresponding sub-service information; If the target business information is confirmed as a necessary business in the sub-business information according to the necessity factor, the authorization authority range is generated according to the difference authority range.

3. The method according to claim 1, characterized in that After completing the management of the user rights according to the user identification and the rights granting information, the method further includes: Obtaining an audit log of the user in the preset system during the period of granting authority; the audit log at least includes the user's actual operation information; Generate preset operation information according to the sub-business information, the business sequence corresponding to each of the sub-business information, and the business authority duration, to determine whether the preset operation information is consistent with the actual operation information; If the preset operation information is inconsistent with the actual operation information, generating a permission withdrawal instruction; The permission withdrawal instruction is sent to the preset system to cancel the permission granted to the user.

4. The method according to claim 1, characterized in that: Before parsing the business content and obtaining a plurality of sub-business information corresponding to the business content and a business sequence corresponding to each sub-business information, the method further includes: Acquiring the user's position information in the preset system according to the user identifier; Extracting business feature information corresponding to the business content; Obtaining a matching degree between the job information and the business feature information; If the matching degree is lower than a preset matching degree, the permission request is returned.

5. The method according to claim 1, characterized in that Before the authority granting information is generated according to the multiple authorization authority ranges, the service authority duration corresponding to each authorization authority range, and the service sequence, the method further includes: In the preset system, query the completed business information of the user according to the user identifier; the completed business information includes the completed business content, the business type corresponding to the completed business content, and the completion time; Generate a duration prediction model corresponding to the user according to the completed service content, the service type corresponding to the completed service content, and the completion duration; Get the business type corresponding to each sub-business information; Inputting the service type and service content corresponding to each of the sub-service information into the duration prediction model, and the duration prediction model outputting the predicted completion duration corresponding to each of the sub-service information; The service authority duration is updated according to the predicted completion duration corresponding to each sub-service information.

6. The method according to claim 1, characterized in that The parsing of the business content to obtain a plurality of sub-business information corresponding to the business content and a business sequence corresponding to each sub-business information includes: Obtaining business coding information corresponding to the business content; The service coding information is input into a pre-trained sub-service extraction model, and the sub-service extraction model outputs sub-service information and service sequence corresponding to the service coding information.

7. The method according to claim 6, characterized in that Before inputting the service coding information into the pre-trained sub-service extraction model, the method further includes: Acquire multiple historical service information corresponding to the preset system and historical sub-service information and historical service sequence corresponding to each of the historical service information; Inputting the historical business information into a sub-business extraction model to be trained, the sub-business extraction model parses the historical business information, and outputs predicted sub-business information and predicted business sequence; The sub-business extraction model is trained according to the historical sub-business information and the predicted business information, the historical business sequence and the predicted business sequence.

8. A rights management device, characterized in that: include: A request receiving module, configured to parse the permission request upon receiving the permission request uploaded by the preset system, and obtain the user identifier corresponding to the permission request and the business content corresponding to the permission request; A business analysis module, used to analyze the business content, obtain multiple sub-business information corresponding to the business content and the business sequence corresponding to each sub-business information; A scope output module, used to input each sub-business information into a pre-trained permission confirmation model, the permission confirmation model parses each sub-business information, and outputs the business permission scope and business permission duration corresponding to each sub-business information; A scope confirmation module, used to obtain the current authority scope of the user in the preset system according to the user identification, and generate multiple authorized authority scopes according to each of the business authority scopes and the current authority scope; An information generation module is used to generate permission granting information according to multiple authorization permission ranges, the business permission duration corresponding to each authorization permission range, and the business sequence; The authority granting module is used to manage the user's authority according to the user identification and the authority granting information.

9. A computer device, characterized in that: The computer device includes a memory and a processor; The memory is used to store computer programs; The processor is configured to execute the computer program and implement the method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, causes the processor to implement the method according to any one of claims 1 to 7.

Images