Authority control method and device based on fine granularity

Abstract

The embodiment of the invention provides an authority control method and device based on fine granularity, and the method comprises the steps: carrying out the node relation extraction of a mapping database, obtaining a role node and a product node, and introducing a user node and a context node; the method comprises the following steps: constructing a hyperedge structure, performing hyperedge linking on role nodes, product nodes, user nodes and service context nodes, determining a corresponding hyperedge relationship, performing dynamic weight endowing on the hyperedge relationship according to a time decay factor and a context risk coefficient, determining a dynamic graph structure, and constructing a directed acyclic graph based on the role inheritance relationship. Fusing the dynamic graph structure and the directed acyclic graph according to a graph algorithm, and determining a corresponding product permission layer graph database; the method comprises the steps of receiving a user operation instruction, performing context-aware query based on the operation instruction according to a graph traversal algorithm, determining a user permission, and performing permission control on a user according to the user permission. The method can improve the efficiency and the refinement degree of permission allocation.

Description

Technical Field

[0001] The present application relates to the field of data processing, and in particular to a method and device for fine-grained permission control. Background Art

[0002] In today's information technology landscape, permission control is a critical component in ensuring system security and data integrity. Traditional permission control methods are primarily based on role-based access control (RBAC), where users are assigned specific roles to obtain corresponding system operation permissions. However, in practice, this role-based permission control model often suffers from overly broad permission assignments, potentially granting users excessive access rights that are inappropriate for their actual work needs, thereby increasing potential security risks.

[0003] In business systems involving shipment management, traditional RBAC models often lack granularity down to the product level. This means that once a user is assigned a role, they may be able to access and operate all products within that role's permissions, regardless of whether those products actually fall within their responsibilities. This coarse-grained permission allocation not only increases management complexity but also can lead to misuse or malicious operations, negatively impacting business operations.

[0004] Therefore, there is an urgent need for a more refined permission control method to improve the efficiency and refinement of permission control. Summary of the Invention

[0005] In response to the problems in the prior art, the present application provides a fine-grained permission control method and device, which can improve the efficiency and refinement of permission allocation.

[0006] In order to solve at least one of the above problems, the present application provides the following technical solutions:

[0007] In a first aspect, the present application provides a fine-grained permission control method, comprising:

[0008] Perform node relationship extraction operations on the preset mapping database to determine the corresponding role nodes, product nodes, direct binding relationships between roles and products, and role inheritance relationships between the role nodes. Introduce user nodes, build direct binding relationships between users and products, and introduce business context nodes based on heterogeneous node expansion.

[0009] Construct a hyperedge structure, hyperlink the role node, the product node, the user node, and the business context node according to the hyperedge structure, the direct binding relationship between the role and the product, and the direct binding relationship between the user and the product, determine the corresponding hyperedge relationship, dynamically assign weights to the hyperedge relationship according to a preset time attenuation factor and a preset context risk coefficient, determine the corresponding dynamic graph structure, construct a directed acyclic graph based on the role inheritance relationship, fuse the dynamic graph structure and the directed acyclic graph according to a preset graph algorithm, and determine the corresponding product permission layer graph database;

[0010] Accept user operation instructions, extract context features corresponding to the operation instructions, perform context-aware query on the product permission layer graph database based on the context features according to the graph traversal algorithm, and determine whether the user permission results obtained after the query are conflicting. If so, call the set conflict decision model to make a permission decision, determine the corresponding user permissions, and perform permission control on the user according to the user permissions.

[0011] Furthermore, in constructing the hyperedge structure, the role node, product node, user node, and business context node are hyperedge-linked according to the hyperedge structure, the direct binding relationship between the role and the product, and the direct binding relationship between the user and the product, and after determining the corresponding hyperedge relationship, the following steps are included:

[0012] Constructing intermediate nodes for the hyperedge relationships based on binary relationship subgraph technology, and determining a unique intermediate node corresponding to each hyperedge relationship;

[0013] Each member node in the hyperedge relationship is connected to the intermediate node to determine a corresponding binary hyperedge relationship.

[0014] Furthermore, dynamically assigning weights to the hyperedge relationships according to a preset time decay factor and a preset context risk coefficient to determine the corresponding dynamic graph structure includes:

[0015] Constructing an exponential time decay model and a step time decay model, and determining corresponding time decay factors based on the exponential time decay model and the step time decay model, wherein the exponential time decay model is used for the short-term time decay factor, and the step time decay model is used for the fixed-period time decay factor;

[0016] Quantitative risk dimension indicators are constructed based on business scenarios, and the quantitative risk dimension indicators are weighted according to the preset risk aggregation function to determine the corresponding contextual risk coefficient. The hyperedge relationship is dynamically weighted according to the contextual risk coefficient and the time attenuation factor to determine the corresponding dynamic graph structure.

[0017] Furthermore, the directed acyclic graph is constructed based on the role inheritance relationship, and the dynamic graph structure and the directed acyclic graph are merged according to a preset graph algorithm to determine the corresponding product permission layer graph database, including:

[0018] Constructing a directed acyclic graph by topological sorting according to the role nodes and the role inheritance relationship;

[0019] The role nodes in the directed acyclic graph are used as child nodes of the role nodes in the dynamic graph structure to perform graph fusion and determine the corresponding product permission layer graph database.

[0020] Furthermore, before calling the conflict decision model to make a permission decision and determining the corresponding user permission, the method includes:

[0021] Set permission conflict types based on business rules, design resolution strategies for each permission conflict type, and determine corresponding conflict resolution rules;

[0022] An initial model based on Q-Learning is constructed, and the initial model is trained according to historical conflict resolution data to determine a corresponding conflict resolution Q value table, and a corresponding conflict decision model is determined based on the optimal Q value.

[0023] Furthermore, the constructing of the hyperedge structure, hyperlinking the role node, the product node, the user node, and the business context node according to the hyperedge structure, the direct binding relationship between the role and the product, and the direct binding relationship between the user and the product, and determining the corresponding hyperedge relationship, includes:

[0024] Determine the corresponding context node according to the preset environmental context, the preset behavioral context, and the preset business attributes;

[0025] A hyperedge structure is constructed based on a native hypergraph database, and the role node, the product node, the user node, and the business context node are stored as nodes of the hyperedge structure. The nodes of the hyperedge structure are hyperlinked according to the direct binding relationship between the role and the product and the direct binding relationship between the user and the product to determine the corresponding hyperedge relationship.

[0026] Furthermore, the accepting of user operation instructions, extracting context features corresponding to the operation instructions, and performing context-aware query on the product permission layer graph database based on the context features according to a graph traversal algorithm include:

[0027] Accepting a user operation instruction, extracting static context features and dynamic context features corresponding to the operation instruction for feature modeling, and determining corresponding context features;

[0028] A context-aware query is performed on the product permission layer graph database based on the context features according to a graph traversal algorithm to determine the corresponding user permission results.

[0029] In a second aspect, the present application provides a fine-grained permission control device, comprising:

[0030] A node relationship extraction module is used to perform node relationship extraction operations on a preset mapping database, determine the corresponding role nodes, product nodes, the direct binding relationship between roles and products, and the role inheritance relationship between the role nodes, introduce user nodes, build a direct binding relationship between users and products, and introduce business context nodes based on heterogeneous node expansion;

[0031] A hyperedge graph database construction module is used to construct a hyperedge structure, hyperlink the role node, the product node, the user node, and the business context node according to the hyperedge structure, the direct binding relationship between the role and the product, and the direct binding relationship between the user and the product, determine the corresponding hyperedge relationship, dynamically assign weights to the hyperedge relationship according to a preset time attenuation factor and a preset context risk coefficient, determine the corresponding dynamic graph structure, construct a directed acyclic graph based on the role inheritance relationship, fuse the dynamic graph structure and the directed acyclic graph according to a preset graph algorithm, and determine the corresponding product permission layer graph database;

[0032] The user authority control module is used to accept user operation instructions, extract context features corresponding to the operation instructions, perform context-aware queries on the product authority layer graph database based on the context features according to the graph traversal algorithm, and determine whether the user authority results obtained after the query are conflicting. If so, call the set conflict decision model to make authority decisions, determine the corresponding user authority, and perform authority control on the user according to the user authority.

[0033] In a third aspect, the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the fine-grained permission control method when executing the program.

[0034] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of the fine-grained permission control method when executed by a processor.

[0035] In a fifth aspect, the present application provides a computer program product, including a computer program / instruction, which implements the steps of the fine-grained permission control method when executed by a processor.

[0036] It can be seen from the above technical solution that the present application provides a fine-grained permission control method and device, which obtains role nodes and product nodes by extracting node relationships from a mapping database, and introduces user nodes and context nodes; constructs a hyperedge structure, hyperlinks role nodes, product nodes, user nodes and business context nodes, determines the corresponding hyperedge relationships, dynamically assigns weights to the hyperedge relationships according to the time attenuation factor and the context risk coefficient, determines the dynamic graph structure, constructs a directed acyclic graph based on the role inheritance relationship, fuses the dynamic graph structure and the directed acyclic graph according to the graph algorithm, and determines the corresponding product permission layer graph database; accepts user operation instructions, performs context-aware queries based on the operation instructions according to the graph traversal algorithm, determines user permissions, and performs permission control on the user according to the user permissions, thereby improving the efficiency and refinement of permission allocation. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0038] Figure 1 This is one of the flow charts of the fine-grained permission control method in the embodiment of the present application;

[0039] Figure 2 This is the second flow chart of the fine-grained permission control method in the embodiment of the present application;

[0040] Figure 3 This is the third flow chart of the fine-grained permission control method in the embodiment of the present application;

[0041] Figure 4 This is a fourth flow chart of the fine-grained permission control method in an embodiment of the present application;

[0042] Figure 5 This is the fifth flow chart of the fine-grained permission control method in the embodiment of the present application;

[0043] Figure 6 This is the sixth flow chart of the fine-grained permission control method in the embodiment of the present application;

[0044] Figure 7 This is the seventh flow chart of the fine-grained permission control method in the embodiment of the present application;

[0045] Figure 8This is a structural diagram of a fine-grained permission control device in an embodiment of the present application;

[0046] Figure 9 Schematic diagram of the structure of the electronic device in the embodiment of the present application.

[0047] Reference numerals:

[0048] Electronic device 9600, central processing unit 9100, memory 9140, communication module 9110, input unit 9120, audio processor 9130, display 9160, power supply 9170, buffer memory 9141, application / function storage unit 9142, data storage unit 9143, driver program storage unit 9144, antenna 9111, speaker 9131, microphone 9132. DETAILED DESCRIPTION

[0049] To make the purpose, technical solutions, and advantages of the embodiments of this application more clear, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0050] The acquisition, storage, use, and processing of data in this application's technical solution comply with relevant national laws and regulations.

[0051] Taking into account the problem that the traditional RBAC model is often unable to be accurate to the specific product level. The present application provides a fine-grained permission control method and device, which extracts the node relationship from the mapping database to obtain the role node and product node, introduces the user node and the context node; constructs a hyperedge structure, hyperlinks the role node, product node, user node and business context node, determines the corresponding hyperedge relationship, dynamically assigns weights to the hyperedge relationship according to the time decay factor and the context risk coefficient, determines the dynamic graph structure, constructs a directed acyclic graph based on the role inheritance relationship, fuses the dynamic graph structure and the directed acyclic graph according to the graph algorithm, and determines the corresponding product permission layer graph database; accepts user operation instructions, performs context-aware query based on the operation instructions according to the graph traversal algorithm, determines user permissions, and performs permission control on the user according to the user permissions, thereby improving the efficiency and refinement of permission allocation.

[0052] In order to improve the efficiency and refinement of permission allocation, this application provides an embodiment of a fine-grained permission control method, see Figure 1 The fine-grained permission control method specifically includes the following contents:

[0053] This embodiment primarily addresses the problem that traditional permission control methods are primarily based on role-based access control (RBAC), where users are assigned specific roles to obtain corresponding system operation permissions. However, once a user is assigned a role, they may be able to access and operate all products under the corresponding permissions of that role, regardless of whether these products actually fall within their scope of responsibility. This coarse-grained permission division not only increases management difficulty, but may also lead to misoperations or malicious operations, adversely affecting business operations.

[0054] To address the above issues, this application replaces the existing user-role relationship mapping database with a graph database, constructing a user-role-product-dynamic context graph database hyperedge structure. This not only enables fine-grained user permission authorization based on specific products, but also introduces dynamic context to enable temporary product demand authorization based on time decay. Furthermore, to resolve user authorization conflicts in the hyperedge structure, this embodiment constructs a directed acyclic graph of permission inheritance relationships, resolving permission conflicts through graph fusion.

[0055] Step S101: Performing a node relationship extraction operation on a preset mapping database to determine corresponding role nodes, product nodes, direct binding relationships between roles and products, and role inheritance relationships between the role nodes; introducing user nodes, building direct binding relationships between users and products, and introducing business context nodes based on heterogeneous node expansion;

[0056] Optionally, in this embodiment, this step is a process of defining graph structure nodes.

[0057] Extract roles from the mapping database and mark their attributes (such as role level and creation time);

[0058] Extract products from the resource table and associate access granularity (such as API and page buttons);

[0059] Get the user's unique identification code;

[0060] To build a direct binding relationship:

[0061] Direct binding between roles and products, such as the read and write permissions for the role "Finance" and the product "Financial Statements".

[0062] Direct user-product binding, such as user "A" → product "Log System" (bypassing roles).

[0063] Dynamic business nodes are introduced on top of the basic entity nodes.

[0064] Dynamic business nodes, including but not limited to:

[0065] Environmental context: time (Time), geographic location (Location), device (Device), IP address (IP).

[0066] Behavioral context: action type (Action), access frequency (Frequency), session state (Session).

[0067] Business attributes: Project ID (Project), Approval status (Approval), and Risk level (Risk).

[0068] Step S102: Construct a hyperedge structure, hyperlink the role node, the product node, the user node, and the business context node according to the hyperedge structure, the direct binding relationship between the role and the product, and the direct binding relationship between the user and the product, determine the corresponding hyperedge relationship, dynamically assign weights to the hyperedge relationship according to a preset time attenuation factor and a preset context risk coefficient, determine the corresponding dynamic graph structure, construct a directed acyclic graph based on the role inheritance relationship, fuse the dynamic graph structure and the directed acyclic graph according to a preset graph algorithm, and determine the corresponding product permission layer graph database;

[0069] Optionally, in this embodiment, this step constructs a hyperedge graph structure based on the entity nodes and the relationships between the nodes established in the above step S101, and assigns dynamic weights to the hyperedge relationships to achieve fine-grained user authority control.

[0070] Optionally, a hyperedge is a structure used in graph theory to describe multi-dimensional relationships. It can simultaneously connect multiple heterogeneous nodes. A hyperedge can directly express N-ary associations, which is more in line with the complex permission relationships in real business.

[0071] Specifically, the construction of hyperedge relationships "packages" multiple nodes of different types into a complete relationship unit. For example, in the application scenario, employee A (user) accesses the "financial system" (product) as "administrator" (role) at "9:00 AM on a weekday" (context).

[0072] The hyperedge relationship is constructed as: [Employee A, Administrator, Financial System, Working Days 9:00].

[0073] Understandably, the existing mapping system directly allows the "Administrator" role to log into the product "Finance System." However, if Employee B also has the "Administrator" role but is responsible for warehouse management, Employee B can also log into the "Finance System" using their Admin role. However, by building a hyperedge structure, Employee A is directly bound to the Finance System, and contextually, Employee A's permissions can be further constrained.

[0074] Preferably, traditional graph databases (such as Neo4j) usually only optimize binary relationship processing. Therefore, after constructing the hyperedge structure, in order to expand the application range of the hyperedge structure, the binary relationship subgraph technology is adopted. The hyperedge is decomposed into multiple binary relationships by introducing intermediate nodes.

[0075] Specifically, a unique intermediate node is created for each original hyperedge, which inherits the original hyperedge properties. Each member node in the hyperedge is connected to the intermediate node to form a star topology.

[0076] The intermediate nodes store the global attributes of the original hyperedge (such as weight and type).

[0077] Member nodes retain their own attributes (such as user permissions and role levels).

[0078] Through the binary relationship subgraph technology, the graph structure is adapted to all graph databases that support binary relationships and has high scalability.

[0079] Optionally, in this embodiment, the hyperedge relationship is dynamically weighted according to a preset time decay factor and a preset context risk coefficient to determine the corresponding dynamic graph structure. This step is the process of assigning dynamic weights to the constructed static hyperedge relationship.

[0080] Specifically, dynamic weights are divided into three parts: basic weights, time-decay weights, and contextual risk weights.

[0081] More specifically, the base weight reflects the original trust of the static permission configuration and provides a calculation starting point for dynamic adjustment (time / context).

[0082] The empowerment methods include explicit assignment based on business rules and implicit calculation based on historical behavior.

[0083] For explicit assignments based on business rules, they need to be aligned with the business rules. For example:

[0084] Define weights based on role-permissions (e.g., administrator = 1.0, normal user = 0.5);

[0085] Based on product sensitivity rating (e.g. core database = 1.2, general application = 0.8).

[0086] For implicit calculations based on historical behavior, in a system that needs to dynamically adapt to behavior, values ​​are assigned based on historical behavior. For example:

[0087] Statistics are collected on the success rate and violation rate of historical user operations, and corresponding weights are assigned based on the success rate and violation rate.

[0088] In systems that do not require dynamic adaptive behavior, this weight remains constant.

[0089] The basic weight assignment process is described using a specific example:

[0090] In the rights management of cloud computing platforms, it is necessary to control the allocation of management rights of VMs (virtual machines).

[0091] Basic weight design:

[0092] Role dimension: Operations Engineer = 1.0, Developer = 0.6.

[0093] Resource dimensions: Production environment VM = 1.5, test environment VM = 0.5.

[0094] Final weight: Operations + Production VM → W base =1.0×1.5=1.5.

[0095] More specifically, time decay weight, in the hyperedge relationship that requires timeliness, a time decay model is constructed to control the time decay weight coefficient.

[0096] In the short-term validity scenario, an exponential decay model is constructed: f(t) = e -λ(tcurrent-tlast)

[0097] λ: Decay rate (needs to be preset, e.g. λ = 0.01 means 1% decay per day).

[0098] t last : The timestamp of the last permission usage.

[0099] For example, if a high-frequency trader temporarily obtains risk control permissions, λ is set to a high value (such as 0.1) to ensure that the permissions expire quickly.

[0100] In the fixed-period rights scenario, a step-by-step attenuation model is constructed:

[0101]

[0102] For example, the equipment maintenance authority adopts a step-by-step attenuation, T threshold =24h, the privilege will be automatically downgraded after the timeout.

[0103] More specifically, contextual risk weighting quantifies risk based on the risk dimensions of the business scenario.

[0104] For example, in the geographic location dimension, the access coefficient of high-risk areas = 1.5, and that of safe areas = 1.0;

[0105] In the device security status dimension, the coefficient of devices without security patches installed = 2.0;

[0106] In the operation sensitivity dimension, the delete operation coefficient = 1.8, and the read operation coefficient = 1.0;

[0107] In the dimension of behavioral abnormality, it is calculated based on the deviation of the user's historical behavior (for example, when Z-Score>3, coefficient = 1.5).

[0108] The above application scenarios are merely exemplary application scenarios, and the application of any risk quantification rules expanded based on business rules does not affect the implementation of the embodiments of the present application.

[0109] Next, after quantifying the risk of a single scenario, the risk is aggregated based on the risk aggregation function to determine the risk of the corresponding context dimension.

[0110] The basic weights, time factor weights, and contextual risk weights are integrated, and hyperedge relationships are dynamically assigned to obtain a dynamic graph structure so that the graph structure can dynamically adapt to changes in application scenarios.

[0111] Optionally, in this embodiment, a directed acyclic graph is constructed based on the role inheritance relationship, the dynamic graph structure and the directed acyclic graph are fused according to a preset graph algorithm, and the corresponding product permission layer graph database is determined. This step is the process of fusing the inheritance relationship with the graph structure.

[0112] In the role extraction phase of step S101, not only the role nodes are extracted, but also the role inheritance relationships between roles are extracted:

[0113] Each role is considered a node in the graph. If role A inherits permissions from role B, a directed edge is added from A to B. Topological sorting is used to ensure there are no cycles in the graph, thus constructing a directed acyclic graph. A DAG is constructed to express the role inheritance hierarchy, for example, a "Director" inherits permissions from a "Manager."

[0114] Then, the role nodes in the DAG are used as subgraphs of the dynamic graph structure and linked to user, product and other nodes through hyperedges.

[0115] For example, a hyperedge (user, role, product, context) indicates that a user accesses a product through a role in a specific context, and the permissions of the role are dynamically calculated by the DAG.

[0116] By modeling role inheritance relationships through DAG, we can flexibly support hierarchical permission transfer, dynamic adjustment, and contextual constraints. Combining hyperedges with dynamic graph structures can cover complex scenarios.

[0117] After step S102, this embodiment constructs a product permission layer graph database to replace the original role-product mapping relationship library, which can realize fine-grained user permission query based on role-user-product-context. On this basis, combined with the time attenuation factor and the hyperedge dynamic assignment of risk weights, the product permission layer graph database can adapt to scenario changes in real time according to business rules.

[0118] Step S103: Accept user operation instructions, extract context features corresponding to the operation instructions, perform context-aware query on the product permission layer graph database based on the context features according to the graph traversal algorithm, and determine whether the user permission results obtained after the query are conflicting. If so, call the set conflict decision model to make a permission decision, determine the corresponding user permissions, and perform permission control on the user according to the user permissions.

[0119] Optionally, this embodiment is the specific implementation process of this solution when the user operates based on the product permission layer graph database.

[0120] Specifically, this embodiment applies a graph traversal algorithm combined with context awareness to accurately query user permissions.

[0121] First, based on user instructions, features are extracted for context feature modeling, including static context and dynamic context.

[0122] Static context includes but is not limited to: user role, product category, geographic location (such as IP), and device type (PC / mobile).

[0123] Dynamic context includes but is not limited to: access time, operation frequency, session activity, and risk score (such as login anomaly detection).

[0124] Then, starting from the user node, find all permission paths that meet the context constraints.

[0125] Optionally, in the scenario of quickly finding directly related roles and products, the graph traversal algorithm is preferably breadth-first search (BFS).

[0126] Optionally, when there are dynamic weighted hyperedge relationships (time, context), the weighted Dijkstra algorithm is preferred.

[0127] Optionally, if the user permission results conflict, the conflict decision model is called to make a permission decision and determine the corresponding user permissions.

[0128] Specifically, the conflict decision model is based on Q-Learning training.

[0129] The authority conflicts are divided into three categories: "role inheritance conflict", "timeliness conflict" and "resource competition conflict", and solution strategies are designed for each category.

[0130] Build a conflict decision model based on Q-Learning, train it through historical operation data, and dynamically optimize the conflict resolution rules. For example:

[0131] When multiple roles conflict, the model selects the optimal role combination based on "operation success rate" and "risk level." The conflict resolution strategy library is updated in real time, forming a closed-loop feedback loop.

[0132] In the first embodiment, user A has both the roles of "warehouse manager" and "temporary auditor", and the shipping authority of the two roles for the same product conflicts.

[0133] The system identifies the conflict as a "role inheritance conflict" and invokes the Q-Learning model to make a decision. Based on user A's historical operation data ("Warehouse Administrator" has a high success rate), the model prioritizes the permissions of that role. After verification, the decision is recorded in the policy library for reference in subsequent conflicts.

[0134] In Example 2, user B is granted temporary shipping permission for product Q, valid until December 31, 2023. However, on December 30, 2023, the administrator manually sets B's permission for product Q to "permanently disabled." When B attempts to ship the product on December 30, 2023, the system must determine a "timeliness conflict." The model determines that the disable rule is in effect, preventing the shipment from occurring, based on the fact that the permanent rule exceeds the temporary rule.

[0135] In Example 3, during peak hours, users C and D simultaneously request shipment of the last item of the same product, R. The system needs to ensure that only one user completes the request to avoid over-issuance. The system executes a resource competition module and prioritizes D, who has lower latency based on historical user requests.

[0136] It is understandable that the reinforcement learning model can resolve permission conflicts and select the optimal role permissions based on historical operation data and rules, so that the permission determination system has dynamic decision-making capabilities based on dynamic graph database queries.

[0137] This example demonstrates how this embodiment implements user permission control by building a graph database to store the multi-dimensional relationship between users, products, roles, and contexts, while introducing weight factors, dynamically adjusting the scope of permissions, and resolving subsequent permission conflicts based on a decision model.

[0138] From the above description, it can be seen that the fine-grained permission control method provided in the embodiment of the present application can obtain role nodes and product nodes by extracting node relationships from the mapping database, and introduce user nodes and context nodes; construct a hyperedge structure, hyperlink role nodes, product nodes, user nodes and business context nodes, determine the corresponding hyperedge relationships, dynamically assign weights to the hyperedge relationships according to the time attenuation factor and the context risk coefficient, determine the dynamic graph structure, construct a directed acyclic graph based on the role inheritance relationship, fuse the dynamic graph structure and the directed acyclic graph according to the graph algorithm, and determine the corresponding product permission layer graph database; accept user operation instructions, perform context-aware queries based on the operation instructions according to the graph traversal algorithm, determine user permissions, and perform permission control on the user according to the user permissions, thereby improving the efficiency and refinement of permission allocation.

[0139] In one embodiment of the fine-grained permission control method of the present application, see Figure 2 , and can also include the following:

[0140] Step S201: constructing intermediate nodes for the hyperedge relationship based on the binary relationship subgraph technology, and determining a unique intermediate node corresponding to each hyperedge relationship;

[0141] Step S202: Connect each member node in the hyperedge relationship to the intermediate node to determine the corresponding binary hyperedge relationship.

[0142] Optionally, in this embodiment, after constructing the hyperedge structure, in order to expand the application scope of the hyperedge structure, a binary relationship subgraph technology is used to decompose the hyperedge into multiple binary relationships by introducing intermediate nodes.

[0143] Specifically, a unique intermediate node is created for each original hyperedge, which inherits the original hyperedge properties. Each member node in the hyperedge is connected to the intermediate node to form a star topology.

[0144] The intermediate nodes store the global attributes of the original hyperedge (such as weight and type).

[0145] Member nodes retain their own attributes (such as user permissions and role levels).

[0146] Through the binary relationship subgraph technology, the graph structure is adapted to all graph databases that support binary relationships and has high scalability.

[0147] Original hyperedge: [User=Dev, Role=K8S-Admin, Resource=Pod-A, Context=NonProd]

[0148] After decomposition: graph LR

[0149] U(User:Dev)-->HE(HyperEdge:HE1)

[0150] R(Role:K8S-Admin)-->HE

[0151] P(Resource:Pod-A)-->HE

[0152] C(Context:NonProd)-->HE

[0153] Through step S202, this embodiment decomposes the original hyperedge architecture into binary relationship subgraphs, which significantly improves the compatibility and query efficiency with traditional graph databases while retaining the hyperedge semantics.

[0154] In one embodiment of the fine-grained permission control method of the present application, see Figure 3 , and can also include the following:

[0155] Step S301: constructing an exponential time decay model and a step time decay model, and determining corresponding time decay factors based on the exponential time decay model and the step time decay model, wherein the exponential time decay model is used for the short-term time decay factor, and the step time decay model is used for the fixed-period time decay factor;

[0156] Step S302: Construct a quantitative risk dimension indicator based on the business scenario, perform weight calculation on the quantitative risk dimension indicator according to a preset risk aggregation function, determine the corresponding contextual risk coefficient, dynamically assign weights to the hyperedge relationship according to the contextual risk coefficient and the time attenuation factor, and determine the corresponding dynamic graph structure.

[0157] Optionally, in this embodiment, this step dynamically assigns static hyperedge relationships.

[0158] Specifically, dynamic weights are divided into three parts: basic weights, time-decay weights, and contextual risk weights.

[0159] More specifically, the base weight reflects the original trust of the static permission configuration and provides a calculation starting point for dynamic adjustment (time / context).

[0160] The empowerment methods include explicit assignment based on business rules and implicit calculation based on historical behavior.

[0161] For explicit assignments based on business rules, they need to be aligned with the business rules. For example:

[0162] Define weights based on role-permissions (e.g., administrator = 1.0, normal user = 0.5);

[0163] Based on product sensitivity rating (e.g. core database = 1.2, general application = 0.8).

[0164] For implicit calculations based on historical behavior, in a system that needs to dynamically adapt to behavior, values ​​are assigned based on historical behavior. For example:

[0165] Statistics are collected on the success rate and violation rate of historical user operations, and corresponding weights are assigned based on the success rate and violation rate.

[0166] In systems that do not require dynamic adaptive behavior, this weight remains constant.

[0167] The basic weight assignment process is described using a specific example:

[0168] In the rights management of cloud computing platforms, it is necessary to control the allocation of management rights of VMs (virtual machines).

[0169] Basic weight design:

[0170] Role dimension: Operations Engineer = 1.0, Developer = 0.6.

[0171] Resource dimensions: Production environment VM = 1.5, test environment VM = 0.5.

[0172] Final weight: Operations + Production VM → Wbase = 1.0 × 1.5 = 1.5.

[0173] More specifically, time decay weight, in the hyperedge relationship that requires timeliness, a time decay model is constructed to control the time decay weight coefficient.

[0174] In the short-term validity scenario, an exponential decay model is constructed: f(t) = e-λ(tcurrent-tlast)

[0175] λ: Decay rate (needs to be preset, e.g. λ = 0.01 means 1% decay per day).

[0176] tlast: timestamp of the last permission usage.

[0177] For example, if a high-frequency trader temporarily obtains risk control permissions, λ is set to a high value (such as 0.1) to ensure that the permissions expire quickly.

[0178] In the fixed-period rights scenario, a step-by-step attenuation model is constructed:

[0179]

[0180] For example, the device maintenance authority adopts a step-by-step attenuation system, Tthreshold = 24h, and the authority is automatically downgraded after the timeout.

[0181] More specifically, contextual risk weighting quantifies risk based on the risk dimensions of the business scenario.

[0182] For example, in the geographic location dimension, the access coefficient of high-risk areas = 1.5, and that of safe areas = 1.0;

[0183] In the device security status dimension, the coefficient of devices without security patches installed = 2.0;

[0184] In the operation sensitivity dimension, the delete operation coefficient = 1.8, and the read operation coefficient = 1.0;

[0185] In the dimension of behavioral abnormality, it is calculated based on the deviation of the user's historical behavior (for example, when Z-Score>3, coefficient = 1.5).

[0186] The above application scenarios are merely exemplary application scenarios, and the application of any risk quantification rules expanded based on business rules does not affect the implementation of the embodiments of the present application.

[0187] Next, after quantifying the risk of a single scenario, the risk is aggregated based on the risk aggregation function to determine the risk of the corresponding context dimension.

[0188] The basic weights, time factor weights, and contextual risk weights are integrated, and hyperedge relationships are dynamically assigned to obtain a dynamic graph structure so that the graph structure can dynamically adapt to changes in application scenarios.

[0189] Through step S302 , this embodiment implements assigning dynamic hyperedge relationships to static graph structures, so that the graph structure can dynamically adapt to changes in application scenarios.

[0190] In one embodiment of the fine-grained permission control method of the present application, see Figure 4 , and can also include the following:

[0191] Step S401: constructing a directed acyclic graph by topological sorting according to the role nodes and the role inheritance relationship;

[0192] Step S402: The role nodes in the directed acyclic graph are used as child nodes of the role nodes in the dynamic graph structure to perform graph fusion and determine the corresponding product permission layer graph database.

[0193] Optionally, in this embodiment, this step is a process of integrating the inheritance relationship with the graph structure.

[0194] In the role extraction phase of step S101, not only the role nodes are extracted, but also the role inheritance relationships between roles are extracted:

[0195] Each role is considered a node in the graph. If role A inherits permissions from role B, a directed edge is added from A to B. Topological sorting is used to ensure there are no cycles in the graph, thus constructing a directed acyclic graph. A DAG is constructed to express the role inheritance hierarchy, for example, a "Director" inherits permissions from a "Manager."

[0196] Then, the role nodes in the DAG are used as subgraphs of the dynamic graph structure and linked to user, product and other nodes through hyperedges.

[0197] For example, a hyperedge (user, role, product, context) indicates that a user accesses a product through a role in a specific context, and the permissions of the role are dynamically calculated by the DAG.

[0198] By modeling role inheritance relationships through DAG, we can flexibly support hierarchical permission transfer, dynamic adjustment, and contextual constraints. Combining hyperedges with dynamic graph structures can cover complex scenarios.

[0199] Through step S402 , this embodiment successfully models the role inheritance relationship through DAG, and combines hyperedges with dynamic graph structures to cover complex scenarios.

[0200] In one embodiment of the fine-grained permission control method of the present application, see Figure 5 , and can also include the following:

[0201] Step S501: setting the permission conflict type based on the business rules, designing a resolution strategy for each permission conflict type, and determining the corresponding conflict resolution rule;

[0202] Step S502: construct an initial model based on Q-Learning, perform model training on the initial model according to historical conflict resolution data, determine a corresponding conflict resolution Q value table, and determine a corresponding conflict decision model based on the optimal Q value.

[0203] Optionally, in this embodiment, the conflict decision model is based on Q-Learning training.

[0204] The authority conflicts are divided into three categories: "role inheritance conflict", "timeliness conflict" and "resource competition conflict", and solution strategies are designed for each category.

[0205] Build a conflict decision model based on Q-Learning, train it through historical operation data, and dynamically optimize the conflict resolution rules. For example:

[0206] When multiple roles conflict, the model selects the optimal role combination based on "operation success rate" and "risk level." The conflict resolution strategy library is updated in real time, forming a closed-loop feedback loop.

[0207] In the first embodiment, user A has both the roles of "warehouse manager" and "temporary auditor", and the two roles have conflicting permissions for shipping the same product.

[0208] The system identifies the conflict as a "role inheritance conflict" and invokes the Q-Learning model to make a decision. Based on user A's historical operation data ("Warehouse Administrator" has a high success rate), the model prioritizes the permissions of that role. After verification, the decision is recorded in the policy library for reference in subsequent conflicts.

[0209] In Example 2, user B is granted temporary shipping permission for product Q, valid until December 31, 2023. However, on December 30, 2023, the administrator manually sets B's permission for product Q to "permanently disabled." When B attempts to ship the product on December 30, 2023, the system must determine a "timeliness conflict." The model determines that the disable rule is in effect, preventing the shipment from occurring, based on the fact that the permanent rule exceeds the temporary rule.

[0210] In Example 3, during peak hours, users C and D simultaneously request shipment of the last item of the same product, R. The system needs to ensure that only one user completes the request to avoid over-issuance. The system executes a resource competition module and prioritizes D, who has lower latency based on historical user requests.

[0211] It is understandable that the reinforcement learning model can resolve permission conflicts and select the optimal role permissions based on historical operation data and rules, so that the permission determination system has dynamic decision-making capabilities based on dynamic graph database queries.

[0212] Through step S502, this embodiment successfully constructs a conflict decision model, so that the authority determination system has dynamic decision-making capabilities based on dynamic graph database query.

[0213] In one embodiment of the fine-grained permission control method of the present application, see Figure 6 , and can also include the following:

[0214] Step S601: determining a corresponding context node according to a preset environmental context, a preset behavior context, and a preset business attribute;

[0215] Step S602: Construct a hyperedge structure based on the native hypergraph database, store the role node, the product node, the user node and the business context node as nodes of the hyperedge structure, and perform hyperedge links on the nodes of the hyperedge structure based on the direct binding relationship between the role and the product and the direct binding relationship between the user and the product to determine the corresponding hyperedge relationship.

[0216] Optionally, in this embodiment, the dynamic service nodes include but are not limited to:

[0217] Environmental context: time (Time), geographic location (Location), device (Device), IP address (IP).

[0218] Behavioral context: action type (Action), access frequency (Frequency), session state (Session).

[0219] Business attributes: Project ID (Project), Approval status (Approval), and Risk level (Risk).

[0220] Optionally, a hyperedge is a structure used in graph theory to describe multi-dimensional relationships. It can simultaneously connect multiple heterogeneous nodes. A hyperedge can directly express N-ary associations, which is more in line with the complex permission relationships in real business.

[0221] Specifically, the construction of hyperedge relationships "packages" multiple nodes of different types into a complete relationship unit. For example, in the application scenario, employee A (user) accesses the "financial system" (product) as "administrator" (role) at "9:00 AM on a weekday" (context).

[0222] The hyperedge relationship is constructed as: [Employee A, Administrator, Financial System, Working Days 9:00].

[0223] Understandably, the existing mapping system directly allows the "Administrator" role to log into the product "Finance System." However, if Employee B also has the "Administrator" role but is responsible for warehouse management, Employee B can also log into the "Finance System" using their Admin role. However, by building a hyperedge structure, Employee A is directly bound to the Finance System, and contextually, Employee A's permissions can be further constrained.

[0224] Through step S602 , this embodiment successfully constructs a hyperedge relationship based on user-role-product-context, laying the foundation for subsequently weighting hyperedges to obtain a dynamic graph structure.

[0225] In one embodiment of the fine-grained permission control method of the present application, see Figure 7 , and can also include the following:

[0226] Step S701: accepting a user operation instruction, extracting static context features and dynamic context features corresponding to the operation instruction, performing feature modeling, and determining corresponding context features;

[0227] Step S702: Perform a context-aware query on the product permission layer graph database based on the context features according to a graph traversal algorithm to determine the corresponding user permission results.

[0228] Optionally, in this embodiment, first, based on user instructions, features are extracted to perform context feature modeling, including static context and dynamic context.

[0229] Static context includes but is not limited to: user role, product category, geographic location (such as IP), and device type (PC / mobile).

[0230] Dynamic context includes but is not limited to: access time, operation frequency, session activity, and risk score (such as login anomaly detection).

[0231] Then, starting from the user node, find all permission paths that meet the context constraints.

[0232] Optionally, in the scenario of quickly finding directly related roles and products, the graph traversal algorithm is preferably breadth-first search (BFS).

[0233] Optionally, when there are dynamic weighted hyperedge relationships (time, context), the weighted Dijkstra algorithm is preferred.

[0234] Optionally, if the user permission results conflict, the conflict decision model is called to make a permission decision and determine the corresponding user permissions.

[0235] Through step S702, this embodiment successfully obtains user permissions according to user instructions based on the product permission layer graph structure and conflict decision model and performs permission control.

[0236] In order to improve the efficiency and refinement of permission allocation, the present application provides an embodiment of a fine-grained permission control device for implementing all or part of the fine-grained permission control method, see Figure 8 The fine-grained permission control device specifically includes the following contents:

[0237] The node relationship extraction module 10 is used to perform node relationship extraction operations on the preset mapping database, determine the corresponding role nodes, product nodes, the direct binding relationship between roles and products, and the role inheritance relationship between the role nodes, introduce user nodes, establish the direct binding relationship between users and products, and introduce business context nodes based on heterogeneous node expansion;

[0238] A hyperedge graph database construction module 20 is used to construct a hyperedge structure, hyperlink the role node, the product node, the user node, and the business context node according to the hyperedge structure, the direct binding relationship between the role and the product, and the direct binding relationship between the user and the product, determine the corresponding hyperedge relationship, dynamically assign weights to the hyperedge relationship according to a preset time attenuation factor and a preset context risk coefficient, determine the corresponding dynamic graph structure, construct a directed acyclic graph based on the role inheritance relationship, fuse the dynamic graph structure and the directed acyclic graph according to a preset graph algorithm, and determine the corresponding product permission layer graph database;

[0239] The user authority control module 30 is used to accept user operation instructions, extract context features corresponding to the operation instructions, perform context-aware query on the product authority layer graph database based on the context features according to the graph traversal algorithm, and determine whether the user authority results obtained after the query are conflicting. If so, call the set conflict decision model to make an authority decision, determine the corresponding user authority, and perform authority control on the user according to the user authority.

[0240] From the above description, it can be seen that the fine-grained permission control device provided in the embodiment of the present application can obtain role nodes and product nodes by extracting node relationships from the mapping database, and introduce user nodes and context nodes; construct a hyperedge structure, hyperlink the role nodes, product nodes, user nodes and business context nodes, determine the corresponding hyperedge relationships, dynamically assign weights to the hyperedge relationships according to the time attenuation factor and the context risk coefficient, determine the dynamic graph structure, construct a directed acyclic graph based on the role inheritance relationship, fuse the dynamic graph structure and the directed acyclic graph according to the graph algorithm, and determine the corresponding product permission layer graph database; accept user operation instructions, perform context-aware queries based on the operation instructions according to the graph traversal algorithm, determine user permissions, and perform permission control on the user according to the user permissions, thereby improving the efficiency and refinement of permission allocation.

[0241] From a hardware perspective, in order to improve the efficiency and refinement of permission allocation, the present application provides an embodiment of an electronic device for implementing all or part of the fine-grained permission control method. The electronic device specifically includes the following:

[0242] Processor (processor), memory (memory), communication interface (Communications Interface) and bus; wherein, the processor, memory, and communication interface communicate with each other through the bus; the communication interface is used to realize information transmission between the fine-grained permission control method and related devices such as the core business system, user terminals and related databases; the logic controller can be a desktop computer, a tablet computer and a mobile terminal, etc., but this embodiment is not limited to this. In this embodiment, the logic controller can be implemented with reference to the embodiment of the fine-grained permission control method and the embodiment of the fine-grained permission control method in the embodiment, and the content thereof is merged here, and the repeated parts are not repeated.

[0243] It is understandable that the user terminal may include a smart phone, a tablet electronic device, a network set-top box, a portable computer, a desktop computer, a personal digital assistant (PDA), a vehicle-mounted device, a smart wearable device, etc. Among them, the smart wearable device may include smart glasses, a smart watch, a smart bracelet, etc.

[0244] In practical applications, part of the fine-grained permission control method can be executed on the electronic device side as described above, or all operations can be completed on the client device. The specific selection can be based on the processing capabilities of the client device and the limitations of the user's usage scenario. This application does not limit this. If all operations are completed on the client device, the client device may also include a processor.

[0245] The client device may include a communication module (i.e., a communication unit) that can establish a communication connection with a remote server to implement data transmission with the server. The server may include a server on the task scheduling center side, and in other implementation scenarios, may also include a server on an intermediate platform, such as a server on a third-party server platform that has a communication link with the task scheduling center server. The server may include a single computer device, a server cluster consisting of multiple servers, or a server structure of a distributed device.

[0246] Figure 9 Schematic block diagram of the system structure of the electronic device 9600 according to an embodiment of the present application. Figure 9 As shown, the electronic device 9600 may include a central processing unit 9100 and a memory 9140; the memory 9140 is coupled to the central processing unit 9100. It is worth noting that the Figure 9 is exemplary; other types of structures may also be used to supplement or replace this structure to implement telecommunication functions or other functions.

[0247] In one embodiment, the fine-grained permission control method function may be integrated into the central processing unit 9100. The central processing unit 9100 may be configured to perform the following control:

[0248] Step S101: Performing a node relationship extraction operation on a preset mapping database to determine corresponding role nodes, product nodes, direct binding relationships between roles and products, and role inheritance relationships between the role nodes; introducing user nodes, building direct binding relationships between users and products, and introducing business context nodes based on heterogeneous node expansion;

[0249] Step S102: Construct a hyperedge structure, hyperlink the role node, the product node, the user node, and the business context node according to the hyperedge structure, the direct binding relationship between the role and the product, and the direct binding relationship between the user and the product, determine the corresponding hyperedge relationship, dynamically assign weights to the hyperedge relationship according to a preset time attenuation factor and a preset context risk coefficient, determine the corresponding dynamic graph structure, construct a directed acyclic graph based on the role inheritance relationship, fuse the dynamic graph structure and the directed acyclic graph according to a preset graph algorithm, and determine the corresponding product permission layer graph database;

[0250] Step S103: Accept user operation instructions, extract context features corresponding to the operation instructions, perform context-aware query on the product permission layer graph database based on the context features according to the graph traversal algorithm, and determine whether the user permission results obtained after the query are conflicting. If so, call the set conflict decision model to make a permission decision, determine the corresponding user permissions, and perform permission control on the user according to the user permissions.

[0251] From the above description, it can be seen that the electronic device provided in the embodiment of the present application obtains role nodes and product nodes by extracting node relationships from a mapping database, and introduces user nodes and context nodes; constructs a hyperedge structure, hyperlinks role nodes, product nodes, user nodes and business context nodes, determines the corresponding hyperedge relationships, dynamically assigns weights to the hyperedge relationships according to the time attenuation factor and the context risk coefficient, determines the dynamic graph structure, constructs a directed acyclic graph based on the role inheritance relationship, fuses the dynamic graph structure and the directed acyclic graph according to the graph algorithm, and determines the corresponding product permission layer graph database; accepts user operation instructions, performs context-aware queries based on the operation instructions according to the graph traversal algorithm, determines user permissions, and performs permission control on the user according to the user permissions, thereby improving the efficiency and refinement of permission allocation.

[0252] In another embodiment, the fine-grained permission control method can be configured separately from the central processing unit 9100. For example, the fine-grained permission control method can be configured as a chip connected to the central processing unit 9100, and the function of the fine-grained permission control method can be realized through the control of the central processing unit.

[0253] like Figure 9 As shown, the electronic device 9600 may further include: a communication module 9110, an input unit 9120, an audio processor 9130, a display 9160, and a power supply 9170. It is worth noting that the electronic device 9600 does not necessarily have to include Figure 9 In addition, the electronic device 9600 may also include all components shown in Figure 9 For components not shown, reference may be made to the prior art.

[0254] like Figure 9 As shown, the central processing unit 9100 is sometimes also referred to as a controller or operation control, and may include a microprocessor or other processor device and / or logic device. The central processing unit 9100 receives input and controls the operation of various components of the electronic device 9600.

[0255] Memory 9140 can be, for example, one or more of a cache, flash memory, hard drive, removable media, volatile memory, non-volatile memory, or other suitable devices. It can store the aforementioned failure-related information and also store programs that execute the relevant information. The CPU 9100 can execute the programs stored in memory 9140 to implement information storage or processing.

[0256] The input unit 9120 provides input to the central processing unit 9100. The input unit 9120 may be, for example, a keypad or touch input device. The power supply 9170 is used to provide power to the electronic device 9600. The display 9160 is used to display objects such as images and text. The display may be, for example, an LCD display, but is not limited thereto.

[0257] The memory 9140 may be a solid-state memory, such as a read-only memory (ROM), a random access memory (RAM), or a SIM card. Alternatively, it may be a memory that retains information even when power is off, can be selectively erased, and is provided with more data. Examples of such memory are sometimes referred to as EPROMs. The memory 9140 may also be some other type of device. The memory 9140 includes a buffer memory 9141 (sometimes referred to as a buffer). The memory 9140 may include an application / function storage unit 9142 for storing application programs and function programs or processes for executing the operation of the electronic device 9600 by the central processing unit 9100.

[0258] The memory 9140 may also include a data storage unit 9143 for storing data, such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. The driver storage unit 9144 of the memory 9140 may include various driver programs for communication functions of the electronic device and / or for executing other functions of the electronic device (such as messaging applications, address book applications, etc.).

[0259] The communication module 9110 is a transmitter / receiver that transmits and receives signals via the antenna 9111. The communication module 9110 is coupled to the central processing unit 9100 to provide input signals and receive output signals, which may be the same as the case of a conventional mobile communication terminal.

[0260] Based on different communication technologies, multiple communication modules 9110 can be provided in the same electronic device, such as a cellular network module, a Bluetooth module, and / or a wireless local area network module. The communication module 9110 is also coupled to a speaker 9131 and a microphone 9132 via an audio processor 9130 to provide audio output via the speaker 9131 and receive audio input from the microphone 9132, thereby implementing common telecommunication functions. The audio processor 9130 may include any suitable buffer, decoder, amplifier, etc. Furthermore, the audio processor 9130 is also coupled to the central processing unit 9100, enabling local recording via the microphone 9132 and playback of stored audio via the speaker 9131.

[0261] Embodiments of the present application also provide a computer-readable storage medium capable of implementing all steps of the fine-grained permission control method in the above-mentioned embodiment, where the execution subject is a server or a client. The computer-readable storage medium stores a computer program. When the computer program is executed by a processor, the computer program implements all steps of the fine-grained permission control method in the above-mentioned embodiment, where the execution subject is a server or a client. For example, when the processor executes the computer program, the following steps are implemented:

[0262] Step S101: Performing a node relationship extraction operation on a preset mapping database to determine corresponding role nodes, product nodes, direct binding relationships between roles and products, and role inheritance relationships between the role nodes; introducing user nodes, building direct binding relationships between users and products, and introducing business context nodes based on heterogeneous node expansion;

[0263] Step S102: Construct a hyperedge structure, hyperlink the role node, the product node, the user node, and the business context node according to the hyperedge structure, the direct binding relationship between the role and the product, and the direct binding relationship between the user and the product, determine the corresponding hyperedge relationship, dynamically assign weights to the hyperedge relationship according to a preset time attenuation factor and a preset context risk coefficient, determine the corresponding dynamic graph structure, construct a directed acyclic graph based on the role inheritance relationship, fuse the dynamic graph structure and the directed acyclic graph according to a preset graph algorithm, and determine the corresponding product permission layer graph database;

[0264] Step S103: Accept user operation instructions, extract context features corresponding to the operation instructions, perform context-aware query on the product permission layer graph database based on the context features according to the graph traversal algorithm, and determine whether the user permission results obtained after the query are conflicting. If so, call the set conflict decision model to make a permission decision, determine the corresponding user permissions, and perform permission control on the user according to the user permissions.

[0265] From the above description, it can be seen that the computer-readable storage medium provided in the embodiment of the present application obtains role nodes and product nodes by extracting node relationships from the mapping database, and introduces user nodes and context nodes; constructs a hyperedge structure, hyperlinks the role nodes, product nodes, user nodes and business context nodes, determines the corresponding hyperedge relationships, dynamically assigns weights to the hyperedge relationships according to the time attenuation factor and the context risk coefficient, determines the dynamic graph structure, constructs a directed acyclic graph based on the role inheritance relationship, fuses the dynamic graph structure and the directed acyclic graph according to the graph algorithm, and determines the corresponding product permission layer graph database; accepts user operation instructions, performs context-aware queries based on the operation instructions according to the graph traversal algorithm, determines user permissions, and performs permission control on the user according to the user permissions, thereby improving the efficiency and refinement of permission allocation.

[0266] The embodiments of the present application also provide a computer program product that can implement all steps of the fine-grained permission control method in the above embodiments, where the execution subject is a server or a client. When the computer program / instructions are executed by a processor, the computer program / instructions implement the steps of the fine-grained permission control method. For example, the computer program / instructions implement the following steps:

[0267] Step S101: Performing a node relationship extraction operation on a preset mapping database to determine corresponding role nodes, product nodes, direct binding relationships between roles and products, and role inheritance relationships between the role nodes; introducing user nodes, building direct binding relationships between users and products, and introducing business context nodes based on heterogeneous node expansion;

[0268] Step S102: Construct a hyperedge structure, hyperlink the role node, the product node, the user node, and the business context node according to the hyperedge structure, the direct binding relationship between the role and the product, and the direct binding relationship between the user and the product, determine the corresponding hyperedge relationship, dynamically assign weights to the hyperedge relationship according to a preset time attenuation factor and a preset context risk coefficient, determine the corresponding dynamic graph structure, construct a directed acyclic graph based on the role inheritance relationship, fuse the dynamic graph structure and the directed acyclic graph according to a preset graph algorithm, and determine the corresponding product permission layer graph database;

[0269] Step S103: Accept user operation instructions, extract context features corresponding to the operation instructions, perform context-aware query on the product permission layer graph database based on the context features according to the graph traversal algorithm, and determine whether the user permission results obtained after the query are conflicting. If so, call the set conflict decision model to make a permission decision, determine the corresponding user permissions, and perform permission control on the user according to the user permissions.

[0270] From the above description, it can be seen that the computer program product provided in the embodiment of the present application obtains role nodes and product nodes by extracting node relationships from a mapping database, and introduces user nodes and context nodes; constructs a hyperedge structure, hyperlinks role nodes, product nodes, user nodes and business context nodes, determines the corresponding hyperedge relationships, dynamically assigns weights to the hyperedge relationships according to the time attenuation factor and the context risk coefficient, determines the dynamic graph structure, constructs a directed acyclic graph based on the role inheritance relationship, fuses the dynamic graph structure and the directed acyclic graph according to the graph algorithm, and determines the corresponding product permission layer graph database; accepts user operation instructions, performs context-aware queries based on the operation instructions according to the graph traversal algorithm, determines user permissions, and performs permission control on the user according to the user permissions, thereby improving the efficiency and refinement of permission allocation.

[0271] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, apparatus, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0272] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (apparatus), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as a combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0273] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0274] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0275] Specific embodiments are used in the present invention to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core ideas. At the same time, for those skilled in the art, according to the ideas of the present invention, there may be changes in the specific implementation methods and application scopes. In summary, the contents of this specification should not be understood as limiting the present invention.

Claims

1. A fine-grained permission control method, characterized in that: The method comprises: Perform node relationship extraction operations on the preset mapping database to determine the corresponding role nodes, product nodes, direct binding relationships between roles and products, and role inheritance relationships between the role nodes. Introduce user nodes, build direct binding relationships between users and products, and introduce business context nodes based on heterogeneous node expansion. Construct a hyperedge structure, hyperlink the role node, the product node, the user node, and the business context node according to the hyperedge structure, the direct binding relationship between the role and the product, and the direct binding relationship between the user and the product, determine the corresponding hyperedge relationship, dynamically assign weights to the hyperedge relationship according to a preset time attenuation factor and a preset context risk coefficient, determine the corresponding dynamic graph structure, construct a directed acyclic graph based on the role inheritance relationship, fuse the dynamic graph structure and the directed acyclic graph according to a preset graph algorithm, and determine the corresponding product permission layer graph database; Accept user operation instructions, extract context features corresponding to the operation instructions, perform context-aware query on the product permission layer graph database based on the context features according to the graph traversal algorithm, and determine whether the user permission results obtained after the query are conflicting. If so, call the set conflict decision model to make a permission decision, determine the corresponding user permissions, and perform permission control on the user according to the user permissions.

2. The fine-grained permission control method according to claim 1 is characterized in that: In constructing the hyperedge structure, hyperedge-linking the role node, product node, user node, and business context node according to the hyperedge structure, the direct binding relationship between the role and the product, and the direct binding relationship between the user and the product, and determining the corresponding hyperedge relationship, including: Constructing intermediate nodes for the hyperedge relationships based on binary relationship subgraph technology, and determining a unique intermediate node corresponding to each hyperedge relationship; Each member node in the hyperedge relationship is connected to the intermediate node to determine a corresponding binary hyperedge relationship.

3. The fine-grained permission control method according to claim 1 is characterized in that: The step of dynamically assigning weights to the hyperedge relationships according to a preset time attenuation factor and a preset context risk coefficient to determine a corresponding dynamic graph structure includes: Constructing an exponential time decay model and a step time decay model, and determining corresponding time decay factors based on the exponential time decay model and the step time decay model, wherein the exponential time decay model is used for the short-term time decay factor, and the step time decay model is used for the fixed-period time decay factor; Quantitative risk dimension indicators are constructed based on business scenarios, and the quantitative risk dimension indicators are weighted according to the preset risk aggregation function to determine the corresponding contextual risk coefficient. The hyperedge relationship is dynamically weighted according to the contextual risk coefficient and the time attenuation factor to determine the corresponding dynamic graph structure.

4. The fine-grained permission control method according to claim 1 is characterized in that: The step of constructing a directed acyclic graph based on the role inheritance relationship, fusing the dynamic graph structure and the directed acyclic graph according to a preset graph algorithm, and determining a corresponding product permission layer graph database includes: Constructing a directed acyclic graph by topological sorting according to the role nodes and the role inheritance relationship; The role nodes in the directed acyclic graph are used as child nodes of the role nodes in the dynamic graph structure to perform graph fusion and determine the corresponding product permission layer graph database.

5. The fine-grained permission control method according to claim 1 is characterized in that: Before calling the conflict decision model to make a permission decision and determining the corresponding user permission, the following steps are included: Set permission conflict types based on business rules, design resolution strategies for each permission conflict type, and determine corresponding conflict resolution rules; An initial model based on Q-Learning is constructed, and the initial model is trained according to historical conflict resolution data to determine a corresponding conflict resolution Q value table, and a corresponding conflict decision model is determined based on the optimal Q value.

6. The fine-grained permission control method according to claim 1 is characterized in that: The constructing of the hyperedge structure, hyperlinking the role node, the product node, the user node, and the business context node according to the hyperedge structure, the direct binding relationship between the role and the product, and the direct binding relationship between the user and the product, and determining corresponding hyperedge relationships, includes: Determine the corresponding context node according to the preset environmental context, the preset behavioral context, and the preset business attributes; A hyperedge structure is constructed based on a native hypergraph database, and the role node, the product node, the user node, and the business context node are stored as nodes of the hyperedge structure. The nodes of the hyperedge structure are hyperlinked according to the direct binding relationship between the role and the product and the direct binding relationship between the user and the product to determine the corresponding hyperedge relationship.

7. The fine-grained permission control method according to claim 1, characterized in that: The accepting user operation instructions, extracting context features corresponding to the operation instructions, and performing context-aware query on the product permission layer graph database based on the context features according to a graph traversal algorithm includes: Accepting a user operation instruction, extracting static context features and dynamic context features corresponding to the operation instruction for feature modeling, and determining corresponding context features; A context-aware query is performed on the product permission layer graph database based on the context features according to a graph traversal algorithm to determine the corresponding user permission results.

8. A fine-grained permission control device, characterized in that: The device comprises: A node relationship extraction module is used to perform node relationship extraction operations on a preset mapping database, determine the corresponding role nodes, product nodes, the direct binding relationship between roles and products, and the role inheritance relationship between the role nodes, introduce user nodes, build a direct binding relationship between users and products, and introduce business context nodes based on heterogeneous node expansion; A hyperedge graph database construction module is used to construct a hyperedge structure, hyperlink the role node, the product node, the user node, and the business context node according to the hyperedge structure, the direct binding relationship between the role and the product, and the direct binding relationship between the user and the product, determine the corresponding hyperedge relationship, dynamically assign weights to the hyperedge relationship according to a preset time attenuation factor and a preset context risk coefficient, determine the corresponding dynamic graph structure, construct a directed acyclic graph based on the role inheritance relationship, fuse the dynamic graph structure and the directed acyclic graph according to a preset graph algorithm, and determine the corresponding product permission layer graph database; The user authority control module is used to accept user operation instructions, extract context features corresponding to the operation instructions, perform context-aware queries on the product authority layer graph database based on the context features according to the graph traversal algorithm, and determine whether the user authority results obtained after the query are conflicting. If so, call the set conflict decision model to make authority decisions, determine the corresponding user authority, and perform authority control on the user according to the user authority.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the fine-grained permission control method described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the fine-grained permission control method according to any one of claims 1 to 7 are implemented.

Images