Permission processing method and device, computer equipment and storage medium

Abstract

The invention belongs to the technical field of artificial intelligence, and relates to an authority processing method and device, computer equipment and a storage medium, and the method comprises the steps: collecting authority data of each business system based on an authority data uploading class; preprocessing the permission data to obtain target permission data; constructing an authority data model based on the target authority data; generating a permission relationship network based on the permission data model; performing permission relationship analysis on each service system based on the permission relationship network to obtain a permission relationship analysis result; performing strategy construction processing on the authority relation analysis result based on the large model to obtain a cross-domain authority strategy; verifying the cross-domain permission policy based on the verification rule; and if the cross-domain permission policy passes the verification, performing access control on an access request which is input by the user and corresponds to the service system based on the cross-domain permission policy. In addition, the invention also relates to a block chain technology, and the cross-domain permission policy can be stored in a block chain. According to the method, the intelligence and automation level of cross-domain authority management is effectively improved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence development technology and financial technology, and in particular to permission processing methods, devices, computer equipment and storage media. Background Art

[0002] In the rapid development of the financial industry, enterprises have built a series of complex and diverse business systems in order to improve business processing efficiency and enhance market competitiveness. These business systems cover multiple key areas from customer service, risk management to transaction processing, and constitute the cornerstone of enterprise operations.

[0003] At present, the permission management solutions commonly used by enterprises mainly rely on hard-coded rules and static permission configuration. This method may be able to maintain basic permission control requirements within a single system, but once it involves cross-system or cross-platform permission intercommunication, there will be the following disadvantages: First, permission data is not interoperable: Since each business system uses an independent permission database or data structure, permission information cannot flow freely between different systems. This not only increases the complexity of data management, but may also lead to inconsistent user permission experience between different systems, and even cause security vulnerabilities. Second, inconsistent permission strategies: Different business systems may have formulated their own permission control strategies based on different business logic and security requirements. The differences between these strategies may cause users to face permission conflicts or insufficient permissions when operating across systems, thus affecting business continuity and user experience. Summary of the invention

[0004] The purpose of the embodiments of the present application is to propose a permission processing method, apparatus, computer equipment and storage medium to solve the technical problems that the permission management solutions commonly used by existing enterprises mainly rely on hard-coded rules and static permission configurations, and there are non-interoperable permission data and inconsistent permission policies.

[0005] In order to solve the above technical problems, the embodiment of the present application provides a permission processing method, which adopts the following technical solution:

[0006] Collect the permission data of each business system based on the preset permission data upload category;

[0007] Preprocessing the permission data to obtain corresponding target permission data;

[0008] Building a corresponding permission data model based on the target permission data;

[0009] Generate a corresponding permission relationship network based on the permission data model;

[0010] Performing authority relationship analysis on each of the business systems based on the authority relationship network to obtain corresponding authority relationship analysis results;

[0011] Performing policy building processing on the authority relationship analysis result based on a preset big model to obtain a corresponding cross-domain authority policy;

[0012] Verifying the cross-domain authority policy based on preset verification rules;

[0013] If the cross-domain authority policy passes the verification, access control is performed on the access request corresponding to the business system input by the user based on the cross-domain authority policy.

[0014] Furthermore, the step of constructing a corresponding permission data model based on the target permission data specifically includes:

[0015] Get the preset model building strategy;

[0016] Call the preset graph database;

[0017] By using the graph database, constructing a data model for the target permission data according to the model construction strategy to obtain a corresponding data model;

[0018] The permission data model is generated based on the data model.

[0019] Furthermore, the step of generating a corresponding permission relationship network based on the permission data model specifically includes:

[0020] Extracting the specified association relationship data and the authority intercommunication data between the business systems from the authority data model;

[0021] Call the preset graphical tool;

[0022] Based on the graphical tool, a relationship network is constructed for the designated association relationship data and the authority intercommunication data to obtain a corresponding initial relationship network;

[0023] Optimizing the initial relationship network to obtain an optimized relationship network;

[0024] The optimized relationship network is used as the authority relationship network.

[0025] Furthermore, the step of performing permission relationship analysis on each of the business systems based on the permission relationship network to obtain corresponding permission relationship analysis results specifically includes:

[0026] Extracting authority relationship data and dependency relationship data of each of the business systems from the authority relationship network;

[0027] Call the preset graph theory algorithm;

[0028] Analyze the authority relationship data and the dependency relationship data based on the graph theory algorithm to obtain corresponding analysis results;

[0029] The authority relationship analysis result is generated based on the analysis result.

[0030] Furthermore, the step of performing policy construction processing on the authority relationship analysis result based on the preset large model to obtain the corresponding cross-domain authority policy specifically includes:

[0031] Training a permission policy generation model based on the large model;

[0032] Inputting the authority relationship analysis result into the authority strategy generation model;

[0033] Performing policy generation processing on the authority relationship analysis result through the authority policy generation model to obtain a corresponding initial authority policy;

[0034] Optimizing the initial permission policy to obtain an optimized permission policy;

[0035] The optimized permission policy is used as the cross-domain permission policy.

[0036] Furthermore, the step of verifying the cross-domain authority policy based on a preset verification rule specifically includes:

[0037] Obtain preset business verification rules, security verification rules, and performance verification rules;

[0038] Performing business verification on the cross-domain authority policy based on the business verification rule;

[0039] If the cross-domain permission policy passes the business verification, performing security verification on the cross-domain permission policy based on the security verification rule;

[0040] If the cross-domain permission policy passes the security verification, then performing performance verification on the cross-domain permission policy based on the performance verification rule;

[0041] If the cross-domain permission policy passes the performance verification, it is determined that the cross-domain permission policy passes the verification; otherwise, it is determined that the cross-domain permission policy fails the verification.

[0042] Furthermore, the step of preprocessing the permission data to obtain corresponding target permission data specifically includes:

[0043] Performing data cleaning processing on the authority data to obtain corresponding first authority data;

[0044] Performing data deduplication processing on the first permission data to obtain corresponding second permission data;

[0045] Performing data formatting processing on the second authority data to obtain corresponding third authority data;

[0046] The third authority data is used as the target authority data.

[0047] In order to solve the above technical problems, the embodiment of the present application further provides a permission processing device, which adopts the following technical solution:

[0048] The collection module is used to collect the permission data of each business system based on the preset permission data upload class;

[0049] A preprocessing module, used for preprocessing the permission data to obtain corresponding target permission data;

[0050] A first construction module, used to construct a corresponding permission data model based on the target permission data;

[0051] A generation module, used to generate a corresponding permission relationship network based on the permission data model;

[0052] An analysis module, used to perform permission relationship analysis on each of the business systems based on the permission relationship network to obtain corresponding permission relationship analysis results;

[0053] The second construction module is used to perform policy construction processing on the permission relationship analysis result based on a preset large model to obtain a corresponding cross-domain permission policy;

[0054] A verification module, used to verify the cross-domain authority policy based on preset verification rules;

[0055] The processing module is used to perform access control on the access request corresponding to the business system input by the user based on the cross-domain authority policy if the cross-domain authority policy passes the verification.

[0056] In order to solve the above technical problems, the embodiment of the present application further provides a computer device, which adopts the following technical solution:

[0057] Collect the permission data of each business system based on the preset permission data upload category;

[0058] Preprocessing the permission data to obtain corresponding target permission data;

[0059] Building a corresponding permission data model based on the target permission data;

[0060] Generate a corresponding permission relationship network based on the permission data model;

[0061] Performing authority relationship analysis on each of the business systems based on the authority relationship network to obtain corresponding authority relationship analysis results;

[0062] Performing policy building processing on the authority relationship analysis result based on a preset big model to obtain a corresponding cross-domain authority policy;

[0063] Verifying the cross-domain authority policy based on preset verification rules;

[0064] If the cross-domain authority policy passes the verification, access control is performed on the access request corresponding to the business system input by the user based on the cross-domain authority policy.

[0065] In order to solve the above technical problems, the embodiment of the present application further provides a computer-readable storage medium, which adopts the following technical solution:

[0066] Collect the permission data of each business system based on the preset permission data upload category;

[0067] Preprocessing the permission data to obtain corresponding target permission data;

[0068] Building a corresponding permission data model based on the target permission data;

[0069] Generate a corresponding permission relationship network based on the permission data model;

[0070] Performing authority relationship analysis on each of the business systems based on the authority relationship network to obtain corresponding authority relationship analysis results;

[0071] Performing policy building processing on the authority relationship analysis result based on a preset big model to obtain a corresponding cross-domain authority policy;

[0072] Verifying the cross-domain authority policy based on preset verification rules;

[0073] If the cross-domain authority policy passes the verification, access control is performed on the access request corresponding to the business system input by the user based on the cross-domain authority policy.

[0074] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0075] This application first collects the permission data of each business system based on the preset permission data upload class; then pre-processes the permission data to obtain the corresponding target permission data; then builds the corresponding permission data model based on the target permission data; and generates the corresponding permission relationship network based on the permission data model; subsequently, performs permission relationship analysis on each of the business systems based on the permission relationship network to obtain the corresponding permission relationship analysis results; further performs policy construction processing on the permission relationship analysis results based on the preset big model to obtain the corresponding cross-domain permission policy; and verifies the cross-domain permission policy based on the preset verification rules; if the cross-domain permission policy passes the verification, then based on the cross-domain permission policy, access control is performed on the access request corresponding to the business system input by the user. This application processes the permission data collected from each business system by combining the use of the permission data model, the permission relationship network, and the big model, and can intelligently and accurately build a unified, efficient, and secure cross-domain permission policy, thereby ensuring the interoperability and consistency of permissions between each business system, solving the problem of non-interoperability of permission data in the traditional hard-coding method, and effectively improving the intelligence and automation level of cross-domain permission management. BRIEF DESCRIPTION OF THE DRAWINGS

[0076] In order to more clearly illustrate the scheme in the present application, a brief introduction is given below to the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0077] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0078] Figure 2 A flowchart of an embodiment of a method for handling permissions according to the present application;

[0079] Figure 3 is a schematic diagram of the structure of an embodiment of a permission processing device according to the present application;

[0080] Figure 4 It is a structural diagram of an embodiment of a computer device according to the present application. DETAILED DESCRIPTION

[0081] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by technicians in the technical field of the present application; the terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of the present application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0082] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0083] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0084] like Figure 1 As shown, the system architecture 100 may include a terminal device 101, a network 102 and a server 103. The terminal device 101 may be a laptop 1011, a tablet computer 1012 or a mobile phone 1013. The network 102 is used to provide a medium for a communication link between the terminal device 101 and the server 103. The network 102 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0085] The user can use the terminal device 101 to interact with the server 103 through the network 102 to receive or send messages, etc. Various communication client applications can be installed on the terminal device 101, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0086] The terminal device 101 can be any electronic device with a display screen and supporting web browsing. In addition to the laptop computer 1011, tablet computer 1012 or mobile phone 1013, the terminal device 101 can also be an e-book reader, an MP3 player (Moving Picture Experts Group Audio Layer III), an MP4 (Moving Picture Experts Group Audio Layer IV), a laptop computer, a desktop computer, etc.

[0087] The server 103 may be a server that provides various services, such as a background server that provides support for a web page displayed on the terminal device 101 .

[0088] It should be noted that the permission processing method provided in the embodiment of the present application is generally executed by a server / terminal device, and accordingly, the permission processing device is generally set in the server / terminal device.

[0089] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0090] Continue to refer Figure 2 , shows a flowchart of an embodiment of the permission processing method according to the present application. According to different requirements, the order of the steps in the flowchart can be changed, and some steps can be omitted. The permission processing method provided in the embodiment of the present application can be applied to any scenario that requires access processing, and the permission processing method can be applied to products in these scenarios, for example, access processing in the financial insurance field. The permission processing method includes the following steps:

[0091] Step S201 : collecting the authority data of each business system based on a preset authority data upload category.

[0092] In this embodiment, the electronic device (eg, Figure 1The server / terminal device shown in the figure) can obtain the permission data of each business system through a wired connection or a wireless connection. It should be noted that the above-mentioned wireless connection method may include but is not limited to 3G / 4G / 5G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (ultra wideband) connection, and other wireless connection methods currently known or to be developed in the future. The executor of this application may be a central authority management system, or simply referred to as the system. According to actual business needs, a class for uploading authority data is pre-designed and implemented, that is, the authority data upload class, which is responsible for unifying the authority data of each business system (such as user information, role information, authority identification, etc.) in a unified format and uploading it to the central authority management system. In the business scenario of the financial field, the above-mentioned business systems may include loan business systems, claims business systems, financial management business systems, and so on. In addition, a basic permission control class is created in the system, which provides abstract methods for core functions such as permission verification, permission allocation, and permission adjustment. Each business system needs to inherit this class and implement these methods according to its own business logic. In addition, a permission configuration base class is defined in the system to manage the configuration information of permission data, such as permission level, permission range, etc. This class provides the functions of reading, modifying and saving configuration information. Specifically, in the system, you can write code to call the predefined permission data upload class, and then collect and summarize the permission data of each business system according to the permission data upload class.

[0093] Step S202: pre-process the permission data to obtain corresponding target permission data.

[0094] In this embodiment, the above-mentioned specific implementation process of preprocessing the permission data to obtain the corresponding target permission data will be further described in detail in subsequent specific embodiments of the present application, and will not be elaborated on here.

[0095] Step S203: construct a corresponding permission data model based on the target permission data.

[0096] In this embodiment, the specific implementation process of constructing the corresponding permission data model based on the target permission data will be further described in detail in subsequent specific embodiments of the present application, and will not be elaborated on here.

[0097] Step S204: generating a corresponding authority relationship network based on the authority data model.

[0098] In this embodiment, the specific implementation process of generating the corresponding permission relationship network based on the permission data model will be further described in detail in subsequent specific embodiments of the present application, and will not be elaborated on here.

[0099] Step S205: performing permission relationship analysis on each of the business systems based on the permission relationship network to obtain corresponding permission relationship analysis results.

[0100] In this embodiment, the above-mentioned specific implementation process of performing permission relationship analysis on each of the business systems based on the permission relationship network to obtain the corresponding permission relationship analysis results will be further described in detail in subsequent specific embodiments of the present application and will not be elaborated on here.

[0101] Step S206: Perform policy construction processing on the permission relationship analysis result based on the preset big model to obtain a corresponding cross-domain permission policy.

[0102] In this embodiment, the above-mentioned policy construction processing is performed on the permission relationship analysis results based on the preset large model to obtain the specific implementation process of the corresponding cross-domain permission policy. This application will provide further detailed descriptions of this in subsequent specific embodiments, and will not be elaborated in detail here.

[0103] Step S207: verify the cross-domain authority policy based on preset verification rules.

[0104] In this embodiment, the specific implementation process of verifying the cross-domain authority policy based on the preset verification rules will be further described in detail in subsequent specific embodiments of the present application, and will not be elaborated on here.

[0105] Step S208: If the cross-domain authority policy passes the verification, access control is performed on the access request corresponding to the business system input by the user based on the cross-domain authority policy.

[0106] In this embodiment, the generated cross-domain permission policy is a policy that can ensure the intercommunication and consistency of permissions between systems. By using the cross-domain permission policy later, intelligent identification and verification of cross-domain identities can be achieved. In the business scenario where an access request corresponding to a business system input by a user is received, the user identity can be accurately identified and its cross-domain access rights can be verified according to the cross-domain permission policy, and then the corresponding access control can be performed intelligently and accurately on the access request input by the user.

[0107] In addition, the access control policy can be adjusted dynamically by combining user identity, cross-domain activity information and context information, using the real-time learning ability of the big model. This can ensure that the permission settings of each business system are adjusted in a timely manner in the event of personnel position changes, personnel resignation or abnormal operations. In addition, a unified access control interface can be provided for each business system, which is convenient for each system to call and realize cross-domain permission management.

[0108] This application first collects the permission data of each business system based on the preset permission data upload class; then pre-processes the permission data to obtain the corresponding target permission data; then builds the corresponding permission data model based on the target permission data; and generates the corresponding permission relationship network based on the permission data model; subsequently, performs permission relationship analysis on each of the business systems based on the permission relationship network to obtain the corresponding permission relationship analysis results; further performs policy construction processing on the permission relationship analysis results based on the preset big model to obtain the corresponding cross-domain permission policy; and verifies the cross-domain permission policy based on the preset verification rules; if the cross-domain permission policy passes the verification, then based on the cross-domain permission policy, access control is performed on the access request corresponding to the business system input by the user. This application processes the permission data collected from each business system by combining the use of the permission data model, the permission relationship network, and the big model, and can intelligently and accurately build a unified, efficient, and secure cross-domain permission policy, thereby ensuring the interoperability and consistency of permissions between each business system, solving the problem of non-interoperability of permission data in the traditional hard-coding method, and effectively improving the intelligence and automation level of cross-domain permission management.

[0109] In some optional implementations, step S203 includes the following steps:

[0110] Get a preset model building strategy.

[0111] In this embodiment, the policy content of the above-mentioned model building strategy includes: 1) Clarifying the content that needs to be described in the permission data model, including the relationship between users, roles, permissions, and the intercommunication of permissions between business systems. And determine the functions that the model needs to support, such as permission query, permission allocation, permission adjustment, etc. 2) Based on the results of the demand analysis, design the structure of the permission data model, including entities, attributes, relationships, etc. Use data modeling tools for visual design to ensure the clarity and accuracy of the model structure. 3) Use a graph database to implement the permission data model. Define data tables or graph structures, create indexes and constraints, and ensure data integrity and consistency. Write SQL statements or graph query statements for operations such as data insertion, query, and update.

[0112] Call the preset graph database.

[0113] In this embodiment, there is no specific limitation on the selection of graph databases. For example, graph databases such as Neo4j may be used.

[0114] Through the graph database, a data model is constructed for the target permission data according to the model construction strategy to obtain a corresponding data model.

[0115] In this embodiment, according to the policy content of the above-mentioned model building strategy, a graph database can be used to build a data model for the target permission data to obtain a corresponding data model.

[0116] The permission data model is generated based on the data model.

[0117] In this embodiment, the generated data model can be subjected to functional testing and performance testing to ensure that the data model can meet business requirements. Based on the test results, the data model is optimized, such as adjusting the data structure, optimizing query statements, etc., and the optimized data model is used as the final permission data model.

[0118] This application obtains a preset model building strategy; then calls a preset graph database; then, through the graph database, the target permission data is constructed according to the model building strategy to obtain a corresponding data model; and then the permission data model is generated based on the data model. This application obtains a model building strategy, and then, based on the use of a graph database, the target permission data is constructed according to the model building strategy to obtain a data model. Subsequently, the data model can be used to quickly and intelligently generate the corresponding permission data model, thereby improving the generation efficiency of the permission data model and ensuring the model effect of the generated permission data model.

[0119] In some optional implementations of this embodiment, step S204 includes the following steps:

[0120] Specified association relationship data and authority intercommunication data between the business systems are extracted from the authority data model.

[0121] In this embodiment, the above-mentioned specified association relationship data may specifically include association relationship data between users, roles, and permissions. Among them, the specific data of the above-mentioned permission intercommunication data may be determined according to actual business needs.

[0122] Calls a preset graphical tool.

[0123] In this embodiment, the graphical tool is a tool having a function of generating a relationship network.

[0124] Based on the graphical tool, a relationship network is constructed for the designated association relationship data and the authority intercommunication data to obtain a corresponding initial relationship network.

[0125] In this embodiment, a graphical tool is used to construct a relationship network for the extracted specified association relationship data and permission intercommunication data, thereby generating a corresponding initial relationship network. The initial relationship network is a relationship network that can intuitively display the association relationship between users, roles, and permissions, as well as the permission intercommunication status between various systems.

[0126] The initial relationship network is optimized to obtain an optimized relationship network.

[0127] In this embodiment, the generated initial relationship network can be optimized, including adjusting node layout, adding labels and annotations, etc., to improve the readability and usability of the relationship network, thereby obtaining an optimized relationship network.

[0128] The optimized relationship network is used as the authority relationship network.

[0129] In this embodiment, the finally generated permission relationship network can be output in the format of picture, PDF, HTML, etc., so as to facilitate business personnel to view and analyze. In addition, the permission relationship network query and export function can also be provided to support business personnel to query and export specific parts of the permission relationship network as needed.

[0130] This application extracts the specified association relationship data and the authority intercommunication data between the business systems from the authority data model; then calls a preset graphical tool; then, based on the graphical tool, performs a relationship network construction process on the specified association relationship data and the authority intercommunication data to obtain a corresponding initial relationship network; subsequently, the initial relationship network is optimized to obtain an optimized relationship network, and the optimized relationship network is used as the authority relationship network. This application extracts the specified association relationship data and the authority intercommunication data from the authority data model; then, based on the use of a graphical tool, the specified association relationship data and the authority intercommunication data are used to construct a relationship network to obtain an initial relationship network, and then the initial relationship network is optimized to achieve a fast and intelligent construction of an accurate, consistent, unified authority relationship network, thereby ensuring the data accuracy of the generated authority relationship network, which is conducive to providing strong support for cross-domain authority management and analysis.

[0131] In some optional implementations, step S205 includes the following steps:

[0132] The authority relationship data and dependency relationship data of each of the business systems are extracted from the authority relationship network.

[0133] In this embodiment, the authority relationship data and dependency relationship data between various business systems can be extracted from the generated authority relationship network.

[0134] Call the preset graph theory algorithm.

[0135] In this embodiment, there is no specific limitation on the selection of the above graph theory algorithm. For example, any one of the algorithms such as depth-first search (DFS), breadth-first search (BFS), topological sorting, etc. can be used.

[0136] The permission relationship data and the dependency relationship data are analyzed based on the graph theory algorithm to obtain corresponding analysis results.

[0137] In this embodiment, the extracted permission relationship data and dependency relationship data are deeply analyzed by using a graph theory algorithm to identify key nodes (such as important users, roles or permissions) and key paths (such as permission transfer paths), and analyze the complexity, redundancy and potential security risks of the permission relationship to compile corresponding analysis results.

[0138] The authority relationship analysis result is generated based on the analysis result.

[0139] In this embodiment, the generated analysis results can be directly used as the above-mentioned permission relationship analysis results. The analysis results can also be displayed in a graphical manner, such as a permission relationship diagram, a permission dependency tree, etc. The key nodes and key paths can be further highlighted to facilitate business personnel to understand and analyze.

[0140] This application extracts the permission relationship data and dependency relationship data of each business system from the permission relationship network; then calls a preset graph theory algorithm; then analyzes the permission relationship data and the dependency relationship data based on the graph theory algorithm to obtain corresponding analysis results; and subsequently generates the permission relationship analysis results based on the analysis results. This application extracts the permission relationship data and dependency relationship data of each business system from the permission relationship network, and then analyzes the permission relationship data and the dependency relationship data based on the use of a graph theory algorithm, so that the required permission relationship analysis results can be generated quickly and accurately, the efficiency of generating the permission relationship analysis results is improved, and the accuracy of the generated permission relationship analysis results is ensured. And it is conducive to the subsequent accurate construction of the corresponding cross-domain permission strategy based on the permission relationship analysis results.

[0141] In some optional implementations, step S206 includes the following steps:

[0142] A permission policy generation model is trained based on the large model.

[0143] In this embodiment, by utilizing the intelligent analysis capability of the large model, a permission policy generation model is trained. The permission policy generation model can receive permission relationship data as input and output a permission policy that meets business needs and security requirements.

[0144] The authority relationship analysis result is input into the authority policy generation model.

[0145] In this embodiment, the authority relationship data obtained by performing authority relationship analysis on each business system using the authority relationship network is input into the trained authority policy generation model.

[0146] The authority relationship analysis result is processed by the authority policy generation model to obtain a corresponding initial authority policy.

[0147] In this embodiment, the permission policy generation model will intelligently generate a matching initial cross-domain permission policy based on the input permission relationship analysis results, that is, the above-mentioned initial permission policy. The generated initial permission policy may include permission allocation rules, permission adjustment rules, permission verification rules, etc.

[0148] The initial permission policy is optimized to obtain an optimized permission policy.

[0149] In this embodiment, the optimized permission policy can be obtained by performing optimization processing such as removing redundant rules and merging similar rules on the initial permission policy.

[0150] The optimized permission policy is used as the cross-domain permission policy.

[0151] In this embodiment, simulation test or actual test data can also be used to verify the optimized policy to ensure its accuracy and effectiveness, and the optimized permission policy that has passed the verification is used as the final cross-domain permission policy.

[0152] This application trains a permission policy generation model based on the large model; then inputs the permission relationship analysis result into the permission policy generation model; then performs policy generation processing on the permission relationship analysis result through the permission policy generation model to obtain the corresponding initial permission policy; subsequently optimizes the initial permission policy to obtain the optimized permission policy, and uses the optimized permission policy as the cross-domain permission policy. This application trains a permission policy generation model based on the use of a large model, then performs policy generation processing on the permission relationship analysis result based on the use of the permission policy generation model to obtain the initial permission policy, and then optimizes the initial permission policy, so that the corresponding cross-domain permission policy can be constructed quickly and accurately, the construction efficiency of the cross-domain permission policy is improved, and the data accuracy of the obtained cross-domain permission policy is guaranteed. And it is beneficial to be able to accurately perform access control on the access request corresponding to the business system input by the user according to the obtained cross-domain permission policy, thereby improving the processing intelligence and processing accuracy of the access control of the business system.

[0153] In some optional implementations of this embodiment, step S207 includes the following steps:

[0154] Get preset business validation rules, security validation rules, and performance validation rules.

[0155] In this embodiment, the rule content of the above-mentioned business verification rules includes: communicating with business personnel to ensure that the generated cross-domain permission policy meets business needs. And according to business feedback, necessary adjustments and optimizations can be made to the cross-domain permission policy. The rule content of the above-mentioned security verification rules includes: performing a security assessment on the cross-domain permission policy to identify potential security risks. If there are security risks, the cross-domain permission policy is reinforced and optimized according to the security assessment results, such as adding additional security verification rules, restricting high-risk operations, etc. The rule content of the above-mentioned performance verification rules includes: performing performance testing on the cross-domain permission policy to evaluate its performance in large-scale data and high-concurrency scenarios. And according to the performance test results, the policy can be optimized, such as optimizing query statements, adding caching mechanisms, etc.

[0156] The cross-domain authority policy is business verified based on the business verification rule.

[0157] In this embodiment, the cross-domain authority policy can be business-verified according to the rule content of the business verification rule, and a corresponding business verification result can be generated, wherein the business verification result includes that the cross-domain authority policy passes the business verification or that the cross-domain authority policy fails the business verification.

[0158] If the cross-domain authority policy passes the business verification, security verification is performed on the cross-domain authority policy based on the security verification rules.

[0159] In this embodiment, the cross-domain permission policy can be security-verified according to the rule content of the security verification rule, and a corresponding security verification result can be generated, wherein the security verification result includes whether the cross-domain permission policy passes the security verification or whether the cross-domain permission policy fails the security verification.

[0160] If the cross-domain authority policy passes the security verification, a performance verification is performed on the cross-domain authority policy based on the performance verification rule.

[0161] In this embodiment, the cross-domain permission policy may be performance-verified according to the content of the performance verification rule, and a corresponding performance verification result may be generated, wherein the performance verification result includes whether the cross-domain permission policy passes the performance verification or whether the cross-domain permission policy fails the performance verification.

[0162] If the cross-domain permission policy passes the performance verification, it is determined that the cross-domain permission policy passes the verification; otherwise, it is determined that the cross-domain permission policy fails the verification.

[0163] In this embodiment, only if it is detected that the cross-domain permission policy has passed the business verification, security verification, and performance verification at the same time, will the cross-domain permission policy be determined to have passed the verification; otherwise, the cross-domain permission policy is determined to have failed the verification.

[0164] This application obtains preset business verification rules, security verification rules, and performance verification rules; then performs business verification on the cross-domain authority policy based on the business verification rules; if the cross-domain authority policy passes the business verification, then performs security verification on the cross-domain authority policy based on the security verification rules; if the cross-domain authority policy passes the security verification, then performs performance verification on the cross-domain authority policy based on the performance verification rules; if the cross-domain authority policy passes the performance verification, then the cross-domain authority policy is determined to have passed the verification, otherwise, the cross-domain authority policy is determined to have failed the verification. This application performs business verification, security verification, and performance verification on the cross-domain authority policy based on the combined use of business verification rules, security verification rules, and performance verification rules. Only when it is detected that the cross-domain authority policy has passed the business verification, security verification, and performance verification at the same time, will the cross-domain authority policy be determined to have passed the verification, which effectively improves the multidimensionality and accuracy of the verification processing of the cross-domain authority policy and ensures the accuracy of the generated verification results.

[0165] In some optional implementations of this embodiment, step S202 includes the following steps:

[0166] The authority data is cleansed to obtain corresponding first authority data.

[0167] In this embodiment, the data cleaning process includes removing duplicate data, correcting erroneous data, standardizing data formats, and the like. Removing duplicate data includes: using unique identifiers (such as user IDs, role IDs, etc.) to remove duplicate records. Correcting erroneous data includes: checking and correcting erroneous values, missing values, etc. in the data. Standardizing data formats includes: unifying the data formats uploaded by different business systems into a format that can be recognized by the central system.

[0168] Perform data deduplication processing on the first permission data to obtain corresponding second permission data.

[0169] In this embodiment, a hash algorithm or uniqueness constraint can be used to ensure that there are no duplicate records in the second permission data. In addition, for data that may be duplicated (such as the user's nickname is the same in different business systems), further comparison and deduplication processing is performed.

[0170] The second authority data is formatted to obtain corresponding third authority data.

[0171] In this embodiment, the data formatting process may include converting the data into a format suitable for subsequent processing, such as converting string type data into a numeric type, converting date and time data into a standard format, and the like.

[0172] The third authority data is used as the target authority data.

[0173] In this embodiment, the generated permission data may also be encoded or encrypted to ensure the security and privacy of the permission data.

[0174] The present application performs data cleaning on the permission data to obtain the corresponding first permission data; then performs data deduplication processing on the first permission data to obtain the corresponding second permission data; then performs data formatting processing on the second permission data to obtain the corresponding third permission data; and subsequently uses the third permission data as the target permission data. The present application performs data cleaning, data deduplication and data formatting on the permission data, thereby realizing intelligent and accurate preprocessing of the permission data, and effectively ensuring the accuracy and consistency of the generated target permission data.

[0175] In some optional implementations, the user information obtained is subject to the user's consent and complies with relevant laws and policies.

[0176] In addition, the non-Company software tools or components that appear in the embodiments of the present application are merely examples and do not represent actual use.

[0177] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0178] It should be emphasized that in order to further ensure the privacy and security of the above-mentioned cross-domain permission policy, the above-mentioned cross-domain permission policy can also be stored in a node of a blockchain.

[0179] The blockchain referred to in this application is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods. Each data block contains a batch of network transaction information, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, platform product service layer, and application service layer.

[0180] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Among them, artificial intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0181] AI basic technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics, etc. AI software technologies mainly include computer vision technology, robotics technology, biometrics technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0182] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through computer-readable instructions, and the computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a non-volatile storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0183] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0184] Further references Figure 3 , as a response to the above Figure 2 The present application provides an embodiment of a permission processing device, and the device embodiment is similar to Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0185] like Figure 3 As shown, the permission processing device 300 described in this embodiment includes: a collection module 301, a preprocessing module 302, a first construction module 303, a generation module 304, an analysis module 305, a second construction module 306, a verification module 307 and a processing module 308. Among them:

[0186] The collection module 301 is used to collect the authority data of each business system based on the preset authority data upload category;

[0187] A preprocessing module 302 is used to preprocess the permission data to obtain corresponding target permission data;

[0188] A first construction module 303, configured to construct a corresponding permission data model based on the target permission data;

[0189] A generating module 304, configured to generate a corresponding authority relationship network based on the authority data model;

[0190] An analysis module 305 is used to perform permission relationship analysis on each of the business systems based on the permission relationship network to obtain corresponding permission relationship analysis results;

[0191] The second construction module 306 is used to perform policy construction processing on the authority relationship analysis result based on a preset large model to obtain a corresponding cross-domain authority policy;

[0192] Verification module 307, used to verify the cross-domain authority policy based on preset verification rules;

[0193] The processing module 308 is configured to perform access control on the access request corresponding to the business system input by the user based on the cross-domain authority policy if the cross-domain authority policy passes the verification.

[0194] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the permission processing method in the above-mentioned implementation mode, and are not described in detail here.

[0195] In some optional implementations of this embodiment, the first building module 303 includes:

[0196] The first acquisition submodule is used to acquire a preset model building strategy;

[0197] The first calling submodule is used to call a preset graph database;

[0198] A first construction submodule is used to construct a data model for the target permission data according to the model construction strategy through the graph database to obtain a corresponding data model;

[0199] The first generating submodule is used to generate the permission data model based on the data model.

[0200] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the permission processing method in the above-mentioned implementation mode, and are not described in detail here.

[0201] In some optional implementations of this embodiment, the generating module 304 includes:

[0202] A first extraction submodule is used to extract the specified association relationship data and the authority intercommunication data between the business systems from the authority data model;

[0203] The second calling submodule is used to call a preset graphical tool;

[0204] A second construction submodule is used to perform a relationship network construction process on the specified association relationship data and the authority intercommunication data based on the graphical tool to obtain a corresponding initial relationship network;

[0205] A first optimization submodule is used to optimize the initial relationship network to obtain an optimized relationship network;

[0206] The first determining submodule is used to use the optimized relationship network as the authority relationship network.

[0207] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the permission processing method in the above-mentioned implementation mode, and are not described in detail here.

[0208] In some optional implementations of this embodiment, the analysis module 305 includes:

[0209] A second extraction submodule is used to extract the authority relationship data and dependency relationship data of each business system from the authority relationship network;

[0210] The third calling submodule is used to call the preset graph theory algorithm;

[0211] An analysis submodule, used to analyze the authority relationship data and the dependency relationship data based on the graph theory algorithm to obtain corresponding analysis results;

[0212] The second generating submodule is used to generate the authority relationship analysis result based on the analysis result.

[0213] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the permission processing method in the above-mentioned implementation mode, and are not described in detail here.

[0214] In some optional implementations of this embodiment, the second building module 306 includes:

[0215] A training submodule, used to train a permission policy generation model based on the large model;

[0216] An input submodule, used for inputting the authority relationship analysis result into the authority policy generation model;

[0217] A third generation submodule is used to perform policy generation processing on the permission relationship analysis result through the permission policy generation model to obtain a corresponding initial permission policy;

[0218] A second optimization submodule is used to optimize the initial permission policy to obtain an optimized permission policy;

[0219] The second determining submodule is configured to use the optimized permission policy as the cross-domain permission policy.

[0220] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the permission processing method in the above-mentioned implementation mode, and are not described in detail here.

[0221] In some optional implementations of this embodiment, the verification module 307 includes:

[0222] The second acquisition submodule is used to obtain preset business verification rules, security verification rules and performance verification rules;

[0223] A first verification submodule, configured to perform business verification on the cross-domain authority policy based on the business verification rule;

[0224] A second verification submodule, configured to perform security verification on the cross-domain authority policy based on the security verification rule if the cross-domain authority policy passes the business verification;

[0225] A third verification submodule, configured to perform performance verification on the cross-domain authority policy based on the performance verification rule if the cross-domain authority policy passes the security verification;

[0226] The determination submodule is used to determine that the cross-domain permission policy has passed the verification if the cross-domain permission policy has passed the performance verification, otherwise, determine that the cross-domain permission policy has not passed the verification.

[0227] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the permission processing method in the above-mentioned implementation mode, and are not described in detail here.

[0228] In some optional implementations of this embodiment, the preprocessing module 302 includes:

[0229] A first processing submodule, configured to perform data cleaning processing on the permission data to obtain corresponding first permission data;

[0230] A second processing submodule, configured to perform data deduplication processing on the first permission data to obtain corresponding second permission data;

[0231] A third processing submodule, configured to perform data formatting processing on the second authority data to obtain corresponding third authority data;

[0232] The third determining submodule is configured to use the third permission data as the target permission data.

[0233] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the permission processing method in the above-mentioned implementation mode, and are not described in detail here.

[0234] To solve the above technical problems, the present application also provides a computer device. Figure 4 , Figure 4 This is a basic structural block diagram of the computer device in this embodiment.

[0235] The computer device 4 includes a memory 41, a processor 42, and a network interface 43 that are interconnected through a system bus. It should be noted that the figure only shows a computer device 4 with components 41-43, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (Application Specific Integrated Circuit, ASIC), programmable gate arrays (Field-Programmable Gate Array, FPGA), digital processors (Digital Signal Processor, DSP), embedded devices, etc.

[0236] The computer device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The computer device may interact with a user through a keyboard, a mouse, a remote controller, a touch pad, or a voice control device.

[0237] The memory 41 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 41 can be an internal storage unit of the computer device 4, such as a hard disk or memory of the computer device 4. In other embodiments, the memory 41 can also be an external storage device of the computer device 4, such as a plug-in hard disk equipped on the computer device 4, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (FlashCard), etc. Of course, the memory 41 can also include both the internal storage unit of the computer device 4 and its external storage device. In this embodiment, the memory 41 is generally used to store the operating system and various application software installed on the computer device 4, such as computer-readable instructions of the permission processing method, etc. In addition, the memory 41 can also be used to temporarily store various types of data that have been output or are to be output.

[0238] The processor 42 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip in some embodiments. The processor 42 is generally used to control the overall operation of the computer device 4. In this embodiment, the processor 42 is used to run computer-readable instructions or process data stored in the memory 41, such as computer-readable instructions for running the permission processing method.

[0239] The network interface 43 may include a wireless network interface or a wired network interface. The network interface 43 is generally used to establish a communication connection between the computer device 4 and other electronic devices.

[0240] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0241] In the embodiment of the present application, the present application first collects the permission data of each business system based on the preset permission data upload class; then pre-processes the permission data to obtain the corresponding target permission data; then builds the corresponding permission data model based on the target permission data; and generates the corresponding permission relationship network based on the permission data model; subsequently, performs permission relationship analysis on each of the business systems based on the permission relationship network to obtain the corresponding permission relationship analysis result; further performs policy construction processing on the permission relationship analysis result based on the preset big model to obtain the corresponding cross-domain permission policy; and verifies the cross-domain permission policy based on the preset verification rules; if the cross-domain permission policy passes the verification, then based on the cross-domain permission policy, access control is performed on the access request corresponding to the business system input by the user. The present application processes the permission data collected from each business system by combining the use of the permission data model, the permission relationship network, and the big model, and can intelligently and accurately construct a unified, efficient, and secure cross-domain permission policy, thereby ensuring the interoperability and consistency of permissions between the business systems, solving the problem of non-interoperability of permission data in the traditional hard-coded method, and effectively improving the intelligence and automation level of cross-domain permission management.

[0242] The present application also provides another implementation, namely, providing a computer-readable storage medium, wherein the computer-readable storage medium stores computer-readable instructions, and the computer-readable instructions can be executed by at least one processor to enable the at least one processor to perform the steps of the permission processing method as described above.

[0243] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0244] In the embodiment of the present application, the present application first collects the permission data of each business system based on the preset permission data upload class; then pre-processes the permission data to obtain the corresponding target permission data; then builds the corresponding permission data model based on the target permission data; and generates the corresponding permission relationship network based on the permission data model; subsequently, performs permission relationship analysis on each of the business systems based on the permission relationship network to obtain the corresponding permission relationship analysis result; further performs policy construction processing on the permission relationship analysis result based on the preset big model to obtain the corresponding cross-domain permission policy; and verifies the cross-domain permission policy based on the preset verification rules; if the cross-domain permission policy passes the verification, then based on the cross-domain permission policy, access control is performed on the access request corresponding to the business system input by the user. The present application processes the permission data collected from each business system by combining the use of the permission data model, the permission relationship network, and the big model, and can intelligently and accurately construct a unified, efficient, and secure cross-domain permission policy, thereby ensuring the interoperability and consistency of permissions between the business systems, solving the problem of non-interoperability of permission data in the traditional hard-coded method, and effectively improving the intelligence and automation level of cross-domain permission management.

[0245] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0246] Obviously, the embodiments described above are only some embodiments of the present application, rather than all embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application is described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific implementation methods, or to perform equivalent replacement of some of the technical features therein. Any equivalent structure made using the contents of the specification and drawings of this application, directly or indirectly used in other related technical fields, is similarly within the scope of patent protection of this application.

Claims

1. A permission processing method, characterized in that: The steps include: Collect the permission data of each business system based on the preset permission data upload category; Preprocessing the permission data to obtain corresponding target permission data; Building a corresponding permission data model based on the target permission data; Generate a corresponding permission relationship network based on the permission data model; Performing authority relationship analysis on each of the business systems based on the authority relationship network to obtain corresponding authority relationship analysis results; Performing policy construction processing on the permission relationship analysis result based on a preset big model to obtain a corresponding cross-domain permission policy; Verifying the cross-domain authority policy based on preset verification rules; If the cross-domain authority policy passes the verification, access control is performed on the access request corresponding to the business system input by the user based on the cross-domain authority policy.

2. The permission processing method according to claim 1, characterized in that: The step of constructing a corresponding permission data model based on the target permission data specifically includes: Get the preset model building strategy; Call the preset graph database; By using the graph database, constructing a data model for the target permission data according to the model construction strategy to obtain a corresponding data model; The permission data model is generated based on the data model.

3. The permission processing method according to claim 1, characterized in that: The step of generating a corresponding authority relationship network based on the authority data model specifically includes: Extracting the specified association relationship data and the authority intercommunication data between the business systems from the authority data model; Call the preset graphical tool; Based on the graphical tool, a relationship network is constructed for the designated association relationship data and the authority intercommunication data to obtain a corresponding initial relationship network; Optimizing the initial relationship network to obtain an optimized relationship network; The optimized relationship network is used as the authority relationship network.

4. The permission processing method according to claim 1, characterized in that: The step of performing permission relationship analysis on each of the business systems based on the permission relationship network to obtain corresponding permission relationship analysis results specifically includes: Extracting authority relationship data and dependency relationship data of each of the business systems from the authority relationship network; Call the preset graph theory algorithm; Analyze the authority relationship data and the dependency relationship data based on the graph theory algorithm to obtain corresponding analysis results; The authority relationship analysis result is generated based on the analysis result.

5. The permission processing method according to claim 1, characterized in that: The step of performing policy construction processing on the authority relationship analysis result based on the preset large model to obtain the corresponding cross-domain authority policy specifically includes: Training a permission policy generation model based on the large model; Inputting the authority relationship analysis result into the authority strategy generation model; Performing policy generation processing on the authority relationship analysis result through the authority policy generation model to obtain a corresponding initial authority policy; Optimizing the initial permission policy to obtain an optimized permission policy; The optimized permission policy is used as the cross-domain permission policy.

6. The permission processing method according to claim 1, characterized in that: The step of verifying the cross-domain authority policy based on the preset verification rules specifically includes: Obtain preset business verification rules, security verification rules, and performance verification rules; Performing business verification on the cross-domain authority policy based on the business verification rule; If the cross-domain permission policy passes the business verification, performing security verification on the cross-domain permission policy based on the security verification rule; If the cross-domain permission policy passes the security verification, then performing performance verification on the cross-domain permission policy based on the performance verification rule; If the cross-domain permission policy passes the performance verification, it is determined that the cross-domain permission policy passes the verification; otherwise, it is determined that the cross-domain permission policy fails the verification.

7. The permission processing method according to claim 1, characterized in that: The step of preprocessing the permission data to obtain corresponding target permission data specifically includes: Performing data cleaning processing on the authority data to obtain corresponding first authority data; Performing data deduplication processing on the first permission data to obtain corresponding second permission data; Performing data formatting processing on the second authority data to obtain corresponding third authority data; The third authority data is used as the target authority data.

8. A permission processing device, characterized in that: include: The collection module is used to collect the permission data of each business system based on the preset permission data upload class; A preprocessing module, used for preprocessing the permission data to obtain corresponding target permission data; A first construction module, used to construct a corresponding permission data model based on the target permission data; A generation module, used to generate a corresponding permission relationship network based on the permission data model; An analysis module, used to perform permission relationship analysis on each of the business systems based on the permission relationship network to obtain corresponding permission relationship analysis results; The second construction module is used to perform policy construction processing on the permission relationship analysis result based on a preset large model to obtain a corresponding cross-domain permission policy; A verification module, used to verify the cross-domain authority policy based on preset verification rules; The processing module is used to perform access control on the access request corresponding to the business system input by the user based on the cross-domain authority policy if the cross-domain authority policy passes the verification.

9. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the permission processing method according to any one of claims 1 to 7 when executing the computer-readable instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, the steps of the permission processing method according to any one of claims 1 to 7 are implemented.

Images