Role-based authority management method and device

Abstract

The embodiment of the invention provides a role-based authority management method and device, and the method comprises the steps: binding a basic authority to a preset basic role, and determining a basic role template library; constructing a user-defined role, endowing the user-defined role with a user-defined permission, and binding the user-defined role to the basic role template library according to a permission inheritance rule to determine a role permission template library; when a user is endowed with multiple roles and performs permission operation, constructing a directed acyclic graph based on the multiple roles and corresponding permissions, traversing the directed acyclic graph, executing permission union set operation according to a preset role weight value, and determining a corresponding user permission result; the method comprises the steps of collecting user operation behavior data flow in real time, inputting the operation behavior data flow into a pre-trained abnormal operation detection model for data processing, determining a corresponding abnormal probability value, correcting a permission result according to the abnormal probability value, and authorizing a user according to the corrected permission result. The team management efficiency can be improved through role permission optimization.

Description

Technical Field

[0001] The present application relates to the field of data processing, and in particular to a role-based permission management method and device. Background Art

[0002] In current team management systems, a multi-tiered approval model is widely adopted. This traditional model typically follows a fixed hierarchical structure, such as "management-sales-teacher-student." Within each tier, information must be passed down and decisions approved step by step. However, this model has significant drawbacks and shortcomings.

[0003] First, the multi-tiered approval model results in a cumbersome process and slow response times. Information needs to be passed between various levels, which not only consumes significant time but can also lead to delays or misunderstandings due to communication barriers between levels. These delays and misunderstandings can severely impact the team's overall execution, making it difficult to quickly respond to market changes or customer needs.

[0004] Secondly, traditional team management systems suffer from inefficient information transfer. In a multi-tiered approval model, each level can become a bottleneck, preventing important information from reaching the right people in a timely manner. This inefficient information transfer not only hinders team collaboration but can also lead to poor decision-making and missed business opportunities.

[0005] Furthermore, the multi-tiered approval model presents security risks. Due to inadequate permission management, sensitive information could be accessed or leaked by those who shouldn't have access. This security risk not only threatens the team's data security but can also severely impact their reputation and business.

[0006] Therefore, in order to solve the above problems, there is an urgent need for a simplified role-based permission management method that can improve the efficiency of team management through role permission optimization. Summary of the Invention

[0007] In response to the problems in the prior art, the present application provides a role-based permission management method and device, which can improve the efficiency of team management through role permission optimization.

[0008] In order to solve at least one of the above problems, the present application provides the following technical solutions:

[0009] In a first aspect, the present application provides a role-based permission management method, comprising:

[0010] Receive basic role definition data input, bind each basic role according to preset basic permissions, determine the corresponding basic role template library, receive a custom role creation request, bind the custom role according to preset permission activation parameters, determine the corresponding custom permission, associate the custom role and the custom permission with the basic role template library according to the target basic role identifier and permission inheritance rule in the custom role creation request, and determine the corresponding role permission template library;

[0011] When a user is assigned multiple roles and performs permission operations, the user's currently activated multiple role permission sets are parsed according to the role permission template library, a directed acyclic graph is constructed with roles as nodes and permission dependencies as edges, the directed acyclic graph is traversed, and a permission union operation is performed according to the preset role weight values ​​to determine the corresponding user permission result;

[0012] Collect user operation behavior data stream in real time, input the operation behavior data stream into a pre-trained abnormal operation detection model for data processing, determine the corresponding abnormal probability value, call the dynamic token generator according to the abnormal probability value to modify the user authority result, determine the corresponding corrected authority result, and authorize the user according to the corrected authority result, so that the user can perform team management according to the authorized authority.

[0013] Furthermore, the step of associating the custom role and the custom permission with the basic role template library according to the target basic role identifier and permission inheritance rule in the custom role creation request and determining the corresponding role permission template library includes:

[0014] Matching a corresponding target basic role from the basic role template library according to the target basic role identifier in the custom role creation request;

[0015] Establishing a permission inheritance relationship between the custom role and the target basic role according to the permission inheritance rule in the custom role creation request, and obtaining basic permissions associated with the target basic role based on the permission inheritance relationship;

[0016] The custom permission and the basic permission are associated and stored in the basic role template library, and a corresponding role permission template library is determined.

[0017] Furthermore, when a user is assigned multiple roles and performs permission operations, the user's currently activated multiple role permission sets are parsed according to the role permission template library, and a directed acyclic graph with roles as nodes and permission dependencies as edges is constructed, including:

[0018] When a user is assigned multiple roles and performs permission operations, all the role data and corresponding permission data assigned to the user are extracted from the role permission template library;

[0019] Assign a role weight value to the role data according to a preset weight configuration rule, determine the corresponding role node, determine the corresponding edge relationship according to the dependency relationship between the permission data, and determine the corresponding directed acyclic graph according to the role nodes and the edge relationship, wherein the role weight value includes static weight and dynamic weight.

[0020] Furthermore, traversing the directed acyclic graph, performing a permission union operation according to preset role weight values, and determining corresponding user permission results includes:

[0021] Traversing all role nodes in the directed acyclic graph, determining the permission data sets corresponding to each role node, and judging whether there is overlapping permission data in each permission data set;

[0022] If so, the overlapping permissions are prioritized according to the preset role weight values, and the corresponding user permission results are determined according to the priority sorting results.

[0023] Furthermore, assigning a role weight value to the role data according to a preset weight configuration rule and determining a corresponding role node includes:

[0024] Obtain the fixed level depth of character data in real time to determine the corresponding static weight;

[0025] Acquire in real time the context features activated when the user performs permission operations, and determine the corresponding dynamic weights based on the context features and a preset feature mapping table;

[0026] A role weight value is assigned to the role data according to the static weight and the dynamic weight, and a corresponding role node is determined.

[0027] Furthermore, the real-time collection of user operation behavior data streams, inputting the operation behavior data streams into a pre-trained abnormal operation detection model for data processing, and determining corresponding abnormality probability values ​​include:

[0028] Collecting user operation behavior data streams in real time, performing standardization processing on the behavior data streams, and extracting time series feature vectors from the standardized data streams according to user session slices;

[0029] The time series feature vector is input into the pre-trained LSTM attention hybrid model to determine the corresponding context anomaly score. A dynamic threshold comparison is performed based on the context anomaly score and the user historical behavior baseline library to determine the corresponding anomaly probability value.

[0030] Furthermore, calling a dynamic token generator to modify the user authority result according to the abnormal probability value and determining a corresponding revised authority result includes:

[0031] According to the abnormal probability value, a preset attenuation level mapping table is matched and a linear interpolation algorithm is used to determine the corresponding authority attenuation coefficient;

[0032] The dynamic token generator is called according to the permission decay coefficient in combination with the current timestamp to determine the corresponding temporary access token, and the user permission result is modified according to the temporary access token to determine the corresponding revised permission result.

[0033] In a second aspect, the present application provides a role-based rights management device, comprising:

[0034] The role and permission library definition module is used to receive basic role definition data input, bind each basic role according to preset basic permissions, determine the corresponding basic role template library, receive a custom role creation request, bind the custom role according to preset permission activation parameters, determine the corresponding custom permission, and associate the custom role and the custom permission with the basic role template library according to the target basic role identifier and permission inheritance rules in the custom role creation request, and determine the corresponding role and permission template library;

[0035] The permission result determination module is used to parse the user's currently activated multiple role permission sets according to the role permission template library when the user is assigned multiple roles and performs permission operations, construct a directed acyclic graph with roles as nodes and permission dependencies as edges, traverse the directed acyclic graph, perform permission union operations according to preset role weight values, and determine the corresponding user permission results;

[0036] The permission result correction module is used to collect user operation behavior data streams in real time, input the operation behavior data streams into a pre-trained abnormal operation detection model for data processing, determine the corresponding abnormal probability value, call the dynamic token generator according to the abnormal probability value to modify the user permission result, determine the corresponding corrected permission result, and authorize the user according to the corrected permission result so that the user can perform team management according to the authorized authority.

[0037] In a third aspect, the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the role-based permission management method when executing the program.

[0038] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of the role-based permission management method when executed by a processor.

[0039] In a fifth aspect, the present application provides a computer program product, comprising a computer program / instruction, which implements the steps of the role-based permission management method when executed by a processor.

[0040] It can be seen from the above technical solution that the present application provides a role-based permission management method and device, which determines the basic role template library by binding basic permissions to preset basic roles; constructs custom roles, assigns custom permissions to custom roles and binds them to the basic role template library according to permission inheritance rules to determine the role permission template library; when a user is assigned multiple roles and performs permission operations, a directed acyclic graph is constructed based on multiple roles and corresponding permissions, the directed acyclic graph is traversed, and the permission union operation is performed according to the preset role weight value to determine the corresponding user permission result; the user operation behavior data stream is collected in real time, and the operation behavior data stream is input into a pre-trained abnormal operation detection model for data processing, the corresponding abnormal probability value is determined, the permission result is corrected according to the abnormal probability value, and the user is authorized according to the corrected permission result, thereby improving the efficiency of team management through role permission optimization. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0042] Figure 1 This is one of the flow charts of the role-based permission management method in the embodiment of the present application;

[0043] Figure 2 This is a second flow chart of the role-based permission management method in an embodiment of the present application;

[0044] Figure 3 This is the third flow chart of the role-based permission management method in the embodiment of the present application;

[0045] Figure 4 This is a fourth flow chart of the role-based permission management method in an embodiment of the present application;

[0046] Figure 5 This is the fifth flow chart of the role-based permission management method in the embodiment of the present application;

[0047] Figure 6 This is the sixth flow chart of the role-based permission management method in the embodiment of the present application;

[0048] Figure 7 This is the seventh flow chart of the role-based permission management method in the embodiment of the present application;

[0049] Figure 8 This is a structural diagram of a role-based rights management device in an embodiment of the present application;

[0050] Figure 9 Schematic diagram of the structure of the electronic device in the embodiment of the present application.

[0051] Reference numerals:

[0052] Electronic device 9600, central processing unit 9100, memory 9140, communication module 9110, input unit 9120, audio processor 9130, display 9160, power supply 9170, buffer memory 9141, application / function storage unit 9142, data storage unit 9143, driver program storage unit 9144, antenna 9111, speaker 9131, microphone 9132. DETAILED DESCRIPTION

[0053] To make the purpose, technical solutions, and advantages of the embodiments of this application more clear, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0054] The acquisition, storage, use, and processing of data in this application's technical solution comply with relevant national laws and regulations.

[0055] Taking into account the current multi-level approval process of group management, which leads to cumbersome and slow response, and the problem that the management authority is not refined enough, resulting in low efficiency. The present application provides a role-based authority management method and device, which determines the basic role template library by binding the basic authority to the preset basic role; constructs a custom role, assigns custom authority to the custom role and binds it to the basic role template library according to the authority inheritance rule to determine the role authority template library; when the user is assigned multiple roles and performs authority operations, a directed acyclic graph is constructed based on the multiple roles and the corresponding authorities, the directed acyclic graph is traversed, and the authority union operation is performed according to the preset role weight value to determine the corresponding user authority result; the user operation behavior data stream is collected in real time, the operation behavior data stream is input into the pre-trained abnormal operation detection model for data processing, the corresponding abnormal probability value is determined, the authority result is corrected according to the abnormal probability value, and the user is authorized according to the corrected authority result, thereby improving the efficiency of team management through role authority optimization.

[0056] In order to improve the efficiency of team management through role permission optimization, this application provides an embodiment of a role-based permission management method, see Figure 1 The role-based permission management method specifically includes the following contents:

[0057] Step S101: receiving basic role definition data input, binding each basic role according to preset basic permissions, determining a corresponding basic role template library, receiving a custom role creation request, binding the custom role according to preset permission activation parameters, determining a corresponding custom permission, and associating the custom role and the custom permission with the basic role template library according to a target basic role identifier and permission inheritance rules in the custom role creation request, and determining a corresponding role permission template library;

[0058] Optionally, in this embodiment, this step introduces custom roles in addition to basic roles to build role permission templates. Through hierarchical role design (basic role + custom role), repeated configuration of permissions is avoided, and on-demand inheritance of basic permissions is supported. At the same time, custom roles are allowed to dynamically expand or adjust permissions, thereby improving the reusability and maintainability of permission templates.

[0059] Optionally, in order to avoid the problem of multi-level review and multi-level authorization, the role permission template library in this embodiment is directly defined by the management personnel, avoiding the multi-level review and authorization mechanism of management-sales-teachers.

[0060] Optionally, in this embodiment, each basic role has its own fixed basic permissions. For example, in a student management system, the basic roles are: administrator, teacher, and student.

[0061] "Administrator" has basic permissions: user freezing and system parameter configuration;

[0062] "Teacher" has basic permissions: create courses, publish homework, and correct homework;

[0063] "Student" has basic permissions: submit homework and view course materials;

[0064] After defining basic permissions, each role can only perform tasks within its own basic permissions. For example, a teacher can publish assignments but cannot modify other teachers' data. First, build a basic role template library based on basic roles and basic permissions.

[0065] Optionally, in this embodiment, custom roles and custom permissions are introduced into the basic role template library, allowing custom roles to dynamically expand or adjust basic permissions, thereby improving the reusability and maintainability of permission templates.

[0066] Specifically, in the step of building a custom role, the permissions of the custom role are obtained from two sources. One is based on the permission inheritance rules, inheriting all or part of the basic permissions of the base role; the other is the custom permissions directly bound to the custom role.

[0067] Specifically, let's first talk about the application of permission inheritance rules. Permission inheritance rules are defined by the administrator. Custom roles can inherit all or part of the basic permissions of the basic role through inheritance rules. Let's take a specific implementation scenario as an example:

[0068] Suppose a university needs to create a "laboratory teaching assistant" role for a temporary experimental course. This role must inherit some permissions of the "teacher" basic role, but is restricted from modifying grades or deleting courses.

[0069] First, the administrator submits a custom role creation request, which includes the target basic role identifier and permission inheritance rules. The request example is as follows:

[0070] {Role name: "Experimental Teaching Assistant", inherited from: "Teacher", permission inheritance rule: "Experimental Management Subset"}

[0071] Based on the target basic role identifier "Teacher" in the request, the system locates the teacher and the corresponding basic permission set from the basic role template library:

[0072] ["Publish homework","Grade homework","Edit grades","Create experiments","Delete courses"]

[0073] And based on the permission inheritance rule filtering conditions, a subset is generated to retain the inherited permission set:

[0074] ["Publish homework","Grade homework","Create experiment"]

[0075] At this point, the "Laboratory Teaching Assistant" role obtains some basic permission sets inherited from the teacher, namely the inherited permission set.

[0076] More specifically, the types of permission inheritance rules include:

[0077] Positive inclusion rules: select specific types of permissions from the base role;

[0078] Reverse exclusion rule: remove sensitive permissions from basic roles;

[0079] Conditional inheritance rules: Dynamically decide whether to inherit based on the context:

[0080] Weight override rule: select by weight when multiple inheritance conflicts.

[0081] Specifically, let's look at custom permissions directly bound to custom roles. When customizing roles, we consider their unique permissions. When submitting a custom role request, we also attach custom permissions to the role. For example, if a lab assistant has unique auxiliary management permissions, then when defining the "Lab Assistant" role, we'd bind "Auxiliary Management" to the custom role. When binding custom permissions to a custom role, we also bind permission activation parameters to the custom role, which trigger the custom permissions and bind them to basic permissions.

[0082] Specifically, permission activation parameters are key variables that trigger custom permissions and bind basic permissions. They include parameters such as time, space, device, business context, security policy, and organizational relationships. Permission activation is triggered only when a custom role meets these activation parameters, allowing the custom role to bind basic permissions and activate custom permissions.

[0083] The following examples illustrate the activation parameters:

[0084] Time dimension parameters include:

[0085] Absolute time range, implemented by Cron expression + timestamp comparison, for example, "2023-09-01 to 2023-12-31";

[0086] Relative time range, based on the periodic task scheduler, for example, "every Monday 14:00-16:00";

[0087] Expiration time is implemented with Redis expiration key + callback notification, for example, "expires in 24 hours".

[0088] Spatial dimension parameters include:

[0089] IP address segment, only intranet IP is allowed to use;

[0090] GPS geofencing, which requires permission to be obtained at a designated location;

[0091] Device dimension parameters include:

[0092] Device fingerprint, limited to company-issued computers to access the system;

[0093] Business context parameters include:

[0094] Project / task ID, sensitive documents are visible only to project members;

[0095] Business process status, which only has specific permissions at specific stages of the process;

[0096] Data attribute tags must match file tags before downloading;

[0097] Security policy parameters include:

[0098] Risk score threshold, open only for low-risk operations;

[0099] MFA authentication level, which requires biometrics + SMS verification;

[0100] Operation frequency limit to prevent crawlers from abusing the data export interface;

[0101] Organization relationship parameters include:

[0102] Reporting line level, approval must be in line with the organizational structure level;

[0103] Temporary working groups, gaining authority when collaborating across departments;

[0104] In the case of a substitute post relationship, the authority will be automatically transferred to the substitute post during the leave period;

[0105] It is understandable that, in addition to the above-mentioned specific parameters, multiple conditions can be combined into composite parameters and assigned to custom roles to increase the template reusability of the role permission database.

[0106] After step S101, we obtain a role permission template library. The template library contains basic roles and the basic permissions enjoyed by each basic role. Basic roles and basic permissions are fixed and used for specific business presets. At the same time, to increase the reusability and flexibility of the role permission template library, custom roles are introduced. To avoid repeated permission configuration, custom roles support on-demand inheritance of basic permissions and allow custom roles to dynamically expand or adjust permissions.

[0107] It is understandable that there are two sources of permissions for custom roles. One is all or part of the basic permissions inherited from the base role based on inheritance rules, and the other comes from the custom permissions bound in the custom role creation request. At the same time, the custom role creation request is also bound with permission activation parameters. Only when the custom user operating environment parameters meet the permission activation parameters can the custom role activate its role permissions, that is, inherit the basic permissions and custom permissions.

[0108] Step S102: When a user is assigned multiple roles and performs permission operations, the user's currently activated multiple role permission sets are parsed according to the role permission template library, a directed acyclic graph is constructed with roles as nodes and permission dependencies as edges, the directed acyclic graph is traversed, and a permission union operation is performed according to preset role weight values ​​to determine the corresponding user permission result;

[0109] Optionally, in this embodiment, this step is a conflict resolution process when multi-role users authorize permissions based on the above-mentioned role permission library, but there is a conflict between the permissions of each role.

[0110] Specifically, when a user is assigned multiple roles and performs permission operations, this embodiment extracts all the roles assigned to the user and the corresponding permissions of each role from the defined role permission library, models the role permission relationship through a graph structure, and solves the complex management problems of multi-role permission conflicts and inheritance relationships.

[0111] Specifically, when constructing the role nodes in the graph structure, we first construct the role nodes based on weights. By integrating static and dynamic weights, we achieve accurate quantitative evaluation of role permissions, solving the problem of traditional permission systems where role weights are fixed and cannot adapt to dynamic scenarios.

[0112] Specifically, static weights are automatically assigned based on the role's fixed level in the organizational structure through a predefined depth weight table. The organizational chart of all roles is extracted from the established role permission library, and weights are defined based on the depth of the roles at different levels.

[0113] For example, in a school's teaching management system, the "Teacher" role has a hierarchy of different custom roles, such as general teacher, teaching and research group leader, and department head. The system assigns static weights to teachers based on their hierarchical depth. For example, a general teacher has a weight of 1, a teaching and research group leader has a weight of 2, and a department head has a weight of 3.

[0114] Specifically, dynamic weights capture the dynamic features of user operations in real time and convert them into weight correction values ​​through a feature mapping table. Dynamic features can be contextual features of the user operation at the time, such as time, device type, and network environment.

[0115] For example, when a teacher schedules a course, the system dynamically adjusts the weight based on the context of the operation (e.g., whether it involves a cross-disciplinary course, whether it's at the beginning of the semester, etc.). If a research group leader schedules a cross-disciplinary course at the beginning of the semester, the system will dynamically increase the weight based on a pre-set feature mapping table, giving it a higher priority in permission operations, allowing the course scheduling task to be completed more efficiently.

[0116] By empowering each role, when permissions conflict between roles of the same user, conflict decisions can be made based on role weights.

[0117] Optionally, after obtaining the weights of all user role nodes, a directed acyclic graph (DAG) is constructed with roles as nodes and permission dependencies as edges. This approach clearly represents the permission dependencies between roles, making the hierarchy and mutual constraints of permissions clear at a glance. This graph structure not only helps intuitively understand and manage complex permission systems, but also optimizes the allocation and execution order of permissions through graph algorithms (topological sorting), resolving permission conflicts.

[0118] Specifically, role nodes contain attributes such as weight values, permission masks, and effective time. Dependency edges indicate the direction of permission inheritance between roles (e.g., teaching assistant → teacher). The Tarjan algorithm is used to detect circular dependencies. If a ring structure (e.g., A→B→C→A) is found, the edge with the lowest weight is automatically disconnected. Subgraphs are extracted in real time based on the user's currently active role (e.g., if a user holds both the teacher and project mentor roles, only a subgraph of both roles and their ancestor nodes is constructed).

[0119] Optionally, after constructing a directed acyclic graph, this embodiment can accurately determine the permission data set corresponding to each role node by traversing all role nodes in the directed acyclic graph. On this basis, the system further determines whether there is overlapping permission data in each permission data set and prioritizes overlapping permissions according to preset role weight values. This ensures that when multiple roles have the same permission, the system can select and allocate them according to the established priority rules, avoiding permission conflicts and ambiguities.

[0120] Specifically, this embodiment quickly locates conflicting permissions by comparing permission masks through bitwise operations, marks conflict types, determines strong conflicts and weak conflicts, and formulates conflict strategies for each.

[0121] For strong conflicts, that is, mutually exclusive permissions, the permissions of the higher-weight role are prioritized according to weight.

[0122] For example, a user (User_A) is granted both the "Student" and "Teaching Assistant" roles. Both roles include the "Submit Lab Report" permission, but the rules conflict (the teaching assistant can grade, while the student can only submit). In this case, the teaching assistant's grading permission is prioritized based on the weight.

[0123] For weakly conflicting, i.e., coexisting permissions, a permission union is generated. For example, "Edit Document" and "Comment on Document" generate the "Full Edit" permission.

[0124] For example, in a school's online learning platform, students are both course learners and may also participate in the management of course discussion groups. The system traverses the directed acyclic graph to determine the permission data sets of students under different roles. As a course learner, a student has the permission to view course videos and submit assignments; as a discussion group administrator, a student has the permission to view course videos, post discussion topics, and manage members. If the permissions of these two roles overlap (viewing course videos), but the permission rules conflict, for example, as a learner, you can only view course videos; but as a discussion group administrator, you can not only view course videos, but also have the permission to view the course video learning status of discussion group members. In this case, the system will generate a permission union and directly grant the student the permission to view course videos and view learning status, avoiding permission conflicts.

[0125] This step successfully resolves the conflicting permissions rules for multiple roles held by the same user, resulting in the user's permissions being resolved. This approach to inherited permissions and conflict resolution simplifies permissions management and avoids the need to configure complex permissions for each user.

[0126] Step S103: Collect user operation behavior data stream in real time, input the operation behavior data stream into a pre-trained abnormal operation detection model for data processing, determine the corresponding abnormal probability value, call the dynamic token generator according to the abnormal probability value to modify the user authority result, determine the corresponding corrected authority result, and authorize the user according to the corrected authority result, so that the user can perform team management according to the authorized authority.

[0127] Optionally, in this embodiment, this step constructs a highly real-time and adaptive user behavior anomaly detection system.

[0128] Specifically, it first supports real-time collection of operational behavior data (such as HTTP request headers, operation types, timestamps, device fingerprints, etc.) from multiple sources such as terminal device logs, network traffic, API call chains, etc., and performs field extraction, format conversion, and missing value filling through a unified data cleaning pipeline (DataCleaning Pipeline), and outputs structured data streams that comply with the ISO / IEC 15408 standard.

[0129] Next, we segment the continuous data stream into sessions using a sliding time window (60 seconds by default). Each session contains at least three related operation events to ensure contextual integrity for behavioral analysis. We extract keyword weights for the operation type sequence using the TF-IDF weighting algorithm and generate a 128-dimensional time series feature vector based on the time difference between the operation intervals.

[0130] In terms of model selection, the LSTM-attention hybrid model is adopted:

[0131] The LSTM layer (128 neurons) captures long-sequence dependencies and processes habitual patterns of user operations (e.g., teachers typically post homework between 9:00 and 11:00).

[0132] The attention mechanism (Attention Layer) dynamically weights key operation nodes (such as permission change requests), improving anomaly detection sensitivity by 40%.

[0133] The contextual anomaly score (range 0-1) output by the model is compared with the user's historical behavior baseline library (storing behavior patterns of the past 30 days), and the final anomaly probability value is calculated using the Bayesian probability formula.

[0134] Through session slicing and timing modeling, slow attack patterns (such as low-frequency tentative privilege escalation) that traditional rule engines cannot detect can be identified.

[0135] Specifically, after obtaining the abnormal probability value, 5 attenuation levels (L1-L5) are preset, and each level corresponds to a different authority restriction strength.

[0136] For example:

[0137] Abnormal probability P Attenuation level Permission retention ratio P<0.3 L1 100％ 0.3≤P<0.6 L2 70％ P≥0.9 L5 10％

[0138] When P=0.75, the actual attenuation coefficient is calculated between L3 (50%) and L4 (30%) using the interpolation formula.

[0139] The token generator receives the attenuation coefficient and the current timestamp, and generates a token with time-attenuation characteristics through a hash chain algorithm. The token can read the user's current permissions and perform bit mask operations according to the attenuation coefficient value to correct the user's permissions.

[0140] This example demonstrates how this embodiment introduces custom roles into the role permission template library to simplify permission management, and resolves conflicts based on a directed acyclic graph when permissions conflict among multiple roles, thereby achieving efficient team management.

[0141] From the above description, it can be seen that the role-based permission management method provided in the embodiment of the present application can determine the basic role template library by binding basic permissions to preset basic roles; construct a custom role, assign custom permissions to the custom role and bind it to the basic role template library according to the permission inheritance rules to determine the role permission template library; when a user is assigned multiple roles and performs permission operations, a directed acyclic graph is constructed based on multiple roles and corresponding permissions, the directed acyclic graph is traversed, and the permission union operation is performed according to the preset role weight value to determine the corresponding user permission result; the user operation behavior data stream is collected in real time, and the operation behavior data stream is input into the pre-trained abnormal operation detection model for data processing, the corresponding abnormal probability value is determined, the permission result is corrected according to the abnormal probability value, and the user is authorized according to the corrected permission result, thereby improving the efficiency of team management through role permission optimization.

[0142] In one embodiment of the role-based rights management method of this application, see Figure 2 , and can also include the following:

[0143] Step S201: matching a corresponding target basic role from the basic role template library according to the target basic role identifier in the custom role creation request;

[0144] Step S202: establishing a permission inheritance relationship between the custom role and the target basic role according to the permission inheritance rule in the custom role creation request, and obtaining basic permissions associated with the target basic role based on the permission inheritance relationship;

[0145] Step S203: Associating the custom permission with the basic permission and storing them in the basic role template library, and determining the corresponding role permission template library.

[0146] Optionally, in this embodiment, this step is the process of building a role permission template library, which enables the custom role to obtain the corresponding basic permissions based on the permission inheritance rules, and binds its own custom permissions, permission activation parameters and basic permissions into the role permission template library.

[0147] Specifically, let's first talk about the application of permission inheritance rules. Permission inheritance rules are defined by the administrator. Custom roles can inherit all or part of the basic permissions of the basic role through inheritance rules. Let's take a specific implementation scenario as an example:

[0148] Suppose a university needs to create a "laboratory teaching assistant" role for a temporary experimental course. This role must inherit some permissions of the "teacher" basic role, but is restricted from modifying grades or deleting courses.

[0149] First, the administrator submits a custom role creation request, which includes the target basic role identifier and permission inheritance rules. The request example is as follows:

[0150] {Role name: "Experimental Teaching Assistant", inherited from: "Teacher", permission inheritance rule: "Experimental Management Subset"}

[0151] Based on the target basic role identifier "Teacher" in the request, the system locates the teacher and the corresponding basic permission set from the basic role template library:

[0152] ["Publish homework","Grade homework","Edit grades","Create experiments","Delete courses"]

[0153] And based on the permission inheritance rule filtering conditions, a subset is generated to retain the inherited permission set:

[0154] ["Publish homework","Grade homework","Create experiment"]

[0155] At this point, the "Laboratory Teaching Assistant" role obtains some basic permission sets inherited from the teacher, namely the inherited permission set.

[0156] More specifically, the types of permission inheritance rules include:

[0157] Positive inclusion rules: select specific types of permissions from the base role;

[0158] Reverse exclusion rule: remove sensitive permissions from basic roles;

[0159] Conditional inheritance rules: Dynamically decide whether to inherit based on the context:

[0160] Weight override rule: select by weight when multiple inheritance conflicts.

[0161] Specifically, let's look at custom permissions directly bound to custom roles. When customizing roles, we consider their unique permissions and attach them to them when submitting a custom role request. For example, if a lab assistant has unique auxiliary management permissions, then when defining the "Lab Assistant" role, we'd bind "Auxiliary Management" to the custom role. When binding custom permissions to a custom role, we also bind permission activation parameters to the custom role, which trigger the custom permissions and bind them to basic permissions.

[0162] Through step S203, this embodiment binds the custom roles and custom permissions to the original basic role library through the permission inheritance rule to build a role permission library, thereby increasing the reusability of the role template.

[0163] In one embodiment of the role-based rights management method of this application, see Figure 3 , and can also include the following:

[0164] Step S301: when a user is assigned multiple roles and performs permission operations, all role data and corresponding permission data assigned to the user are extracted from the role permission template library;

[0165] Step S302: Assign a role weight value to the role data according to a preset weight configuration rule, determine the corresponding role node, determine the corresponding edge relationship according to the dependency relationship between the permission data, and determine the corresponding directed acyclic graph according to the role node and the edge relationship, wherein the role weight value includes static weight and dynamic weight.

[0166] This step is optional and is used to resolve conflicts in permissions between multiple roles.

[0167] Specifically, the permission conflict problem is solved by constructing a directed acyclic graph based on role weights.

[0168] Specifically, when a user is assigned multiple roles and performs permission operations, this embodiment extracts all the roles assigned to the user and the permissions corresponding to each role from the defined role permission library, and then assigns corresponding weight values ​​to the role nodes through the fusion calculation of static weights and dynamic weights. Construct a directed acyclic graph (DAG) with roles as nodes and permission dependencies as edges. In this way, the permission dependencies between roles can be clearly represented, making the hierarchical structure and mutual constraints of permissions clear at a glance. This graph structure not only helps to intuitively understand and manage complex permission systems, but also can optimize the allocation and execution order of permissions through graph algorithms (topological sorting) to solve the problem of permission conflicts.

[0169] Specifically, role nodes contain attributes such as weight values, permission masks, and effective time. Dependency edges indicate the direction of permission inheritance between roles (e.g., teaching assistant → teacher). The Tarjan algorithm is used to detect circular dependencies. If a ring structure (e.g., A→B→C→A) is found, the edge with the lowest weight is automatically disconnected. Subgraphs are extracted in real time based on the user's currently active role (e.g., if a user holds both the teacher and project mentor roles, only a subgraph of both roles and their ancestor nodes is constructed).

[0170] Through step S302 , this embodiment implements the construction of a directed acyclic graph based on role weights, laying the foundation for the subsequent resolution of authority conflicts.

[0171] In one embodiment of the role-based rights management method of this application, see Figure 4 , and can also include the following:

[0172] Step S401: traverse all role nodes in the directed acyclic graph, determine the permission data sets corresponding to the role nodes, and determine whether there is overlapping permission data in the permission data sets;

[0173] Step S402: If there are overlapping permissions, the overlapping permissions are prioritized according to the preset role weight values, and the corresponding user permission results are determined according to the priority sorting results.

[0174] Optionally, in this embodiment, after constructing a directed acyclic graph, this embodiment can accurately determine the permission data set corresponding to each role node by traversing all role nodes in the directed acyclic graph. On this basis, the system further determines whether there is overlapping permission data in each permission data set, and prioritizes the overlapping permissions according to the preset role weight values, ensuring that when multiple roles have the same permission, the system can select and allocate them according to the established priority rules, avoiding permission conflicts and ambiguities.

[0175] Specifically, this embodiment quickly locates conflicting permissions by comparing permission masks through bitwise operations, marks conflict types, determines strong conflicts and weak conflicts, and formulates conflict strategies for each.

[0176] For strong conflicts, that is, mutually exclusive permissions, the permissions of the higher-weight role are prioritized according to weight.

[0177] For example, a user (User_A) is granted both the "Student" and "Teaching Assistant" roles. Both roles include the "Submit Lab Report" permission, but the rules conflict (the teaching assistant can grade, while the student can only submit). In this case, the teaching assistant's grading permission is prioritized based on the weight.

[0178] For weakly conflicting, i.e., coexisting permissions, a permission union is generated. For example, "Edit Document" and "Comment on Document" generate the "Full Edit" permission.

[0179] For example, in a school's online learning platform, students are both course learners and may also participate in the management of course discussion groups. The system traverses the directed acyclic graph to determine the permission data sets of students under different roles. As a course learner, a student has the permission to view course videos and submit assignments; as a discussion group administrator, a student has the permission to view course videos, post discussion topics, and manage members. If the permissions of these two roles overlap (viewing course videos), but the permission rules conflict, for example, as a learner, you can only view course videos; but as a discussion group administrator, you can not only view course videos, but also have the permission to view the course video learning status of discussion group members. In this case, the system will generate a permission union and directly grant the student the permission to view course videos and view learning status, avoiding permission conflicts.

[0180] Through step S402, this embodiment successfully solves the situation where the same user has multiple roles and their role permission rules conflict, and obtains user permissions after the conflict is resolved. This implementation method of inherited permissions and conflict permission resolution simplifies permission management and avoids directly configuring complex permissions for each user.

[0181] In one embodiment of the role-based rights management method of this application, see Figure 5 , and can also include the following:

[0182] Step S501: obtaining the fixed level depth of character data in real time to determine the corresponding static weight;

[0183] Step S502: Acquire in real time the context features activated when the user performs permission operations, and determine the corresponding dynamic weights based on the context features and a preset feature mapping table;

[0184] Step S503: assigning a role weight value to the role data according to the static weight and the dynamic weight, and determining a corresponding role node.

[0185] This step is optional and is the specific process of assigning weight values ​​to role nodes.

[0186] Specifically, when constructing the role nodes in the graph structure, we first construct the role nodes based on weights. By integrating static and dynamic weights, we achieve accurate quantitative evaluation of role permissions, solving the problem of traditional permission systems where role weights are fixed and cannot adapt to dynamic scenarios.

[0187] Specifically, static weights are automatically assigned based on the role's fixed level in the organizational structure through a predefined depth weight table. The organizational chart of all roles is extracted from the established role permission library, and weights are defined based on the depth of the roles at different levels.

[0188] For example, in a school's teaching management system, the "Teacher" role has a hierarchy of different custom roles, such as general teacher, teaching and research group leader, and department head. The system assigns static weights to teachers based on their hierarchical depth. For example, a general teacher has a weight of 1, a teaching and research group leader has a weight of 2, and a department head has a weight of 3.

[0189] Specifically, dynamic weights capture the dynamic features of user operations in real time and convert them into weight correction values ​​through a feature mapping table. Dynamic features can be contextual features of the user operation at the time, such as time, device type, and network environment.

[0190] For example, when a teacher schedules a course, the system dynamically adjusts the weight based on the context of the operation (e.g., whether it involves a cross-disciplinary course, whether it's at the beginning of the semester, etc.). If a research group leader schedules a cross-disciplinary course at the beginning of the semester, the system will dynamically increase the weight based on a pre-set feature mapping table, giving it a higher priority in permission operations, allowing the course scheduling task to be completed more efficiently.

[0191] Through step S503, this embodiment successfully grants authority to each role. When authority conflicts occur among roles of the same user, conflict resolution can be made based on the role weights.

[0192] In one embodiment of the role-based rights management method of this application, see Figure 6 , and can also include the following:

[0193] Step S601: collecting user operation behavior data streams in real time, performing standardization processing on the behavior data streams, and extracting time series feature vectors from the standardized data streams according to user session slices;

[0194] Step S602: Input the time series feature vector into the pre-trained LSTM attention hybrid model to determine the corresponding context anomaly score, perform dynamic threshold comparison based on the context anomaly score and the user historical behavior baseline library, and determine the corresponding anomaly probability value.

[0195] Optionally, in this embodiment, it first supports real-time collection of operation behavior data (such as HTTP request header, operation type, timestamp, device fingerprint, etc.) from multiple sources such as terminal device logs, network traffic, API call chains, etc., and performs field extraction, format conversion and missing value filling through a unified data cleaning pipeline (Data Cleaning Pipeline), and outputs a structured data stream that complies with the ISO / IEC15408 standard.

[0196] Next, we segment the continuous data stream into sessions using a sliding time window (60 seconds by default). Each session contains at least three related operation events to ensure contextual integrity for behavioral analysis. We extract keyword weights for the operation type sequence using the TF-IDF weighting algorithm and generate a 128-dimensional time series feature vector based on the time difference between the operation intervals.

[0197] In terms of model selection, the LSTM-attention hybrid model is adopted:

[0198] The LSTM layer (128 neurons) captures long-sequence dependencies and processes habitual patterns of user operations (e.g., teachers typically post homework between 9:00 and 11:00).

[0199] The attention mechanism (Attention Layer) dynamically weights key operation nodes (such as permission change requests), improving anomaly detection sensitivity by 40%.

[0200] The contextual anomaly score (range 0-1) output by the model is compared with the user's historical behavior baseline library (storing behavior patterns of the past 30 days), and the final anomaly probability value is calculated using the Bayesian probability formula.

[0201] Through step S602, this embodiment successfully uses session slicing and timing modeling to identify slow attack patterns that traditional rule engines cannot detect.

[0202] In one embodiment of the role-based rights management method of this application, see Figure 7 , and can also include the following:

[0203] Step S701: Matching the preset attenuation level mapping table according to the abnormal probability value, and determining the corresponding authority attenuation coefficient using a linear interpolation algorithm;

[0204] Step S702: calling a dynamic token generator according to the permission decay coefficient combined with the current timestamp to determine a corresponding temporary access token, modifying the user permission result according to the temporary access token, and determining a corresponding modified permission result.

[0205] Optionally, in this embodiment, after obtaining the abnormal probability value, five attenuation levels (L1-L5) are preset, and each level corresponds to a different authority restriction strength.

[0206] For example:

[0207] Abnormal probability P Attenuation level Permission retention ratio P<0.3 L1 100％ 0.3≤P<0.6 L2 70％ P≥0.9 L5 10％

[0208] When P=0.75, the actual attenuation coefficient is calculated between L3 (50%) and L4 (30%) using the interpolation formula.

[0209] The token generator receives the attenuation coefficient and the current timestamp, and generates a token with time-attenuation characteristics through a hash chain algorithm. The token can read the user's current permissions and perform bit mask operations according to the attenuation coefficient value to correct the user's permissions.

[0210] Through step S702, this embodiment successfully implements dynamic modification of user permissions based on the token generator, thereby improving efficiency while ensuring the security of management team operations.

[0211] In order to improve the efficiency of team management through role authority optimization, the present application provides an embodiment of a role-based authority management device for implementing all or part of the content of the role-based authority management method, see Figure 8 The role-based rights management device specifically includes the following contents:

[0212] The role and permission library definition module 10 is configured to receive basic role definition data input, bind each basic role according to preset basic permissions, determine the corresponding basic role template library, receive a custom role creation request, bind the custom role according to preset permission activation parameters, determine the corresponding custom permission, associate the custom role and the custom permission with the basic role template library according to the target basic role identifier and permission inheritance rules in the custom role creation request, and determine the corresponding role and permission template library;

[0213] The permission result determination module 20 is used to parse the user's currently activated multiple role permission sets according to the role permission template library when the user is assigned multiple roles and performs permission operations, construct a directed acyclic graph with roles as nodes and permission dependencies as edges, traverse the directed acyclic graph, perform permission union operations according to preset role weight values, and determine the corresponding user permission results;

[0214] The permission result correction module 30 is used to collect user operation behavior data streams in real time, input the operation behavior data streams into a pre-trained abnormal operation detection model for data processing, determine the corresponding abnormal probability value, call the dynamic token generator according to the abnormal probability value to modify the user permission result, determine the corresponding corrected permission result, and authorize the user according to the corrected permission result so that the user can perform team management according to the authorized authority.

[0215] From the above description, it can be seen that the role-based permission management device provided in the embodiment of the present application can determine the basic role template library by binding basic permissions to preset basic roles; construct a custom role, assign custom permissions to the custom role and bind it to the basic role template library according to the permission inheritance rules to determine the role permission template library; when a user is assigned multiple roles and performs permission operations, a directed acyclic graph is constructed based on multiple roles and corresponding permissions, the directed acyclic graph is traversed, and the permission union operation is performed according to the preset role weight value to determine the corresponding user permission result; the user operation behavior data stream is collected in real time, and the operation behavior data stream is input into the pre-trained abnormal operation detection model for data processing, the corresponding abnormal probability value is determined, the permission result is corrected according to the abnormal probability value, and the user is authorized according to the corrected permission result, thereby improving the efficiency of team management through role permission optimization.

[0216] From a hardware perspective, in order to improve the efficiency of team management through role-based permission optimization, the present application provides an embodiment of an electronic device for implementing all or part of the content of the role-based permission management method. The electronic device specifically includes the following content:

[0217] A processor, a memory, a communications interface, and a bus; wherein the processor, the memory, and the communications interface communicate with each other via the bus; the communications interface is used to implement information transmission between the role-based permission management method and related devices such as the core business system, the user terminal, and related databases; the logic controller can be a desktop computer, a tablet computer, a mobile terminal, etc., but this embodiment is not limited thereto. In this embodiment, the logic controller can be implemented with reference to the embodiment of the role-based permission management method in the embodiment, as well as the embodiment of the role-based permission management method, the contents of which are incorporated herein, and repeated parts are not repeated.

[0218] It is understandable that the user terminal may include a smart phone, a tablet electronic device, a network set-top box, a portable computer, a desktop computer, a personal digital assistant (PDA), a vehicle-mounted device, a smart wearable device, etc. Among them, the smart wearable device may include smart glasses, a smart watch, a smart bracelet, etc.

[0219] In actual applications, part of the role-based rights management method can be executed on the electronic device side as described above, or all operations can be completed on the client device. The specific selection can be based on the processing capabilities of the client device and the limitations of the user's usage scenario. This application does not limit this. If all operations are completed on the client device, the client device may also include a processor.

[0220] The client device may include a communication module (i.e., a communication unit) that can establish a communication connection with a remote server to implement data transmission with the server. The server may include a server on the task scheduling center side, and in other implementation scenarios, may also include a server on an intermediate platform, such as a server on a third-party server platform that has a communication link with the task scheduling center server. The server may include a single computer device, a server cluster consisting of multiple servers, or a server structure of a distributed device.

[0221] Figure 9 Schematic block diagram of the system structure of the electronic device 9600 according to an embodiment of the present application. Figure 9 As shown, the electronic device 9600 may include a central processing unit 9100 and a memory 9140; the memory 9140 is coupled to the central processing unit 9100. It is worth noting that the Figure 9 is exemplary; other types of structures may also be used to supplement or replace this structure to implement telecommunication functions or other functions.

[0222] In one embodiment, the role-based permission management method function can be integrated into the central processing unit 9100. The central processing unit 9100 can be configured to perform the following control:

[0223] Step S101: receiving basic role definition data input, binding each basic role according to preset basic permissions, determining a corresponding basic role template library, receiving a custom role creation request, binding the custom role according to preset permission activation parameters, determining a corresponding custom permission, and associating the custom role and the custom permission with the basic role template library according to a target basic role identifier and permission inheritance rules in the custom role creation request, and determining a corresponding role permission template library;

[0224] Step S102: When a user is assigned multiple roles and performs permission operations, the user's currently activated multiple role permission sets are parsed according to the role permission template library, a directed acyclic graph is constructed with roles as nodes and permission dependencies as edges, the directed acyclic graph is traversed, and a permission union operation is performed according to preset role weight values ​​to determine the corresponding user permission result;

[0225] Step S103: Collect user operation behavior data stream in real time, input the operation behavior data stream into a pre-trained abnormal operation detection model for data processing, determine the corresponding abnormal probability value, call the dynamic token generator according to the abnormal probability value to modify the user authority result, determine the corresponding corrected authority result, and authorize the user according to the corrected authority result, so that the user can perform team management according to the authorized authority.

[0226] From the above description, it can be seen that the electronic device provided in the embodiment of the present application determines the basic role template library by binding basic permissions to preset basic roles; constructs a custom role, assigns custom permissions to the custom role and binds it to the basic role template library according to the permission inheritance rules to determine the role permission template library; when a user is assigned multiple roles and performs permission operations, a directed acyclic graph is constructed based on the multiple roles and corresponding permissions, the directed acyclic graph is traversed, and the permission union operation is performed according to the preset role weight value to determine the corresponding user permission result; the user operation behavior data stream is collected in real time, the operation behavior data stream is input into the pre-trained abnormal operation detection model for data processing, the corresponding abnormal probability value is determined, the permission result is corrected according to the abnormal probability value, and the user is authorized according to the corrected permission result, thereby improving the efficiency of team management through role permission optimization.

[0227] In another embodiment, the role-based permission management method can be configured separately from the central processing unit 9100. For example, the role-based permission management method can be configured as a chip connected to the central processing unit 9100, and the function of the role-based permission management method can be implemented through the control of the central processing unit.

[0228] like Figure 9 As shown, the electronic device 9600 may further include: a communication module 9110, an input unit 9120, an audio processor 9130, a display 9160, and a power supply 9170. It is worth noting that the electronic device 9600 does not necessarily have to include Figure 9 In addition, the electronic device 9600 may also include all components shown in Figure 9 For components not shown, reference may be made to the prior art.

[0229] like Figure 9 As shown, the central processing unit 9100 is sometimes also referred to as a controller or operation control, and may include a microprocessor or other processor device and / or logic device. The central processing unit 9100 receives input and controls the operation of various components of the electronic device 9600.

[0230] Memory 9140 can be, for example, one or more of a cache, flash memory, hard drive, removable media, volatile memory, non-volatile memory, or other suitable devices. It can store the aforementioned failure-related information and also store programs that execute the relevant information. The CPU 9100 can execute the programs stored in memory 9140 to implement information storage or processing.

[0231] The input unit 9120 provides input to the central processing unit 9100. The input unit 9120 may be, for example, a keypad or touch input device. The power supply 9170 is used to provide power to the electronic device 9600. The display 9160 is used to display objects such as images and text. The display may be, for example, an LCD display, but is not limited thereto.

[0232] The memory 9140 may be a solid-state memory, such as a read-only memory (ROM), a random access memory (RAM), or a SIM card. Alternatively, it may be a memory that retains information even when power is off, can be selectively erased, and is provided with more data. Examples of such memory are sometimes referred to as EPROMs. The memory 9140 may also be some other type of device. The memory 9140 includes a buffer memory 9141 (sometimes referred to as a buffer). The memory 9140 may include an application / function storage unit 9142 for storing application programs and function programs or processes for executing the operation of the electronic device 9600 by the central processing unit 9100.

[0233] The memory 9140 may also include a data storage unit 9143 for storing data, such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. The driver storage unit 9144 of the memory 9140 may include various driver programs for communication functions of the electronic device and / or for executing other functions of the electronic device (such as messaging applications, address book applications, etc.).

[0234] The communication module 9110 is a transmitter / receiver that transmits and receives signals via the antenna 9111. The communication module 9110 is coupled to the central processing unit 9100 to provide input signals and receive output signals, which may be the same as the case of a conventional mobile communication terminal.

[0235] Based on different communication technologies, multiple communication modules 9110 can be provided in the same electronic device, such as a cellular network module, a Bluetooth module, and / or a wireless local area network module. The communication module 9110 is also coupled to a speaker 9131 and a microphone 9132 via an audio processor 9130 to provide audio output via the speaker 9131 and receive audio input from the microphone 9132, thereby implementing common telecommunication functions. The audio processor 9130 may include any suitable buffer, decoder, amplifier, etc. Furthermore, the audio processor 9130 is also coupled to the central processing unit 9100, enabling local recording via the microphone 9132 and playback of stored audio via the speaker 9131.

[0236] Embodiments of the present application also provide a computer-readable storage medium capable of implementing all steps of the role-based permission management method in the above-mentioned embodiment, where the execution subject is a server or a client. The computer-readable storage medium stores a computer program. When the computer program is executed by a processor, the computer program implements all steps of the role-based permission management method in the above-mentioned embodiment, where the execution subject is a server or a client. For example, when the processor executes the computer program, the following steps are implemented:

[0237] Step S101: receiving basic role definition data input, binding each basic role according to preset basic permissions, determining a corresponding basic role template library, receiving a custom role creation request, binding the custom role according to preset permission activation parameters, determining a corresponding custom permission, and associating the custom role and the custom permission with the basic role template library according to a target basic role identifier and permission inheritance rules in the custom role creation request, and determining a corresponding role permission template library;

[0238] Step S102: When a user is assigned multiple roles and performs permission operations, the user's currently activated multiple role permission sets are parsed according to the role permission template library, a directed acyclic graph is constructed with roles as nodes and permission dependencies as edges, the directed acyclic graph is traversed, and a permission union operation is performed according to preset role weight values ​​to determine the corresponding user permission result;

[0239] Step S103: Collect user operation behavior data stream in real time, input the operation behavior data stream into a pre-trained abnormal operation detection model for data processing, determine the corresponding abnormal probability value, call the dynamic token generator according to the abnormal probability value to modify the user authority result, determine the corresponding corrected authority result, and authorize the user according to the corrected authority result, so that the user can perform team management according to the authorized authority.

[0240] From the above description, it can be seen that the computer-readable storage medium provided in the embodiment of the present application determines a basic role template library by binding basic permissions to preset basic roles; constructs a custom role, assigns custom permissions to the custom role and binds it to the basic role template library according to the permission inheritance rules to determine the role permission template library; when a user is assigned multiple roles and performs permission operations, a directed acyclic graph is constructed based on multiple roles and corresponding permissions, the directed acyclic graph is traversed, and a permission union operation is performed according to the preset role weight value to determine the corresponding user permission result; the user operation behavior data stream is collected in real time, the operation behavior data stream is input into a pre-trained abnormal operation detection model for data processing, the corresponding abnormal probability value is determined, the permission result is corrected according to the abnormal probability value, and the user is authorized according to the corrected permission result, thereby improving the efficiency of team management through role permission optimization.

[0241] The embodiments of the present application also provide a computer program product capable of implementing all steps of the role-based rights management method in the above embodiments, where the execution subject is a server or a client. When the computer program / instructions are executed by a processor, the computer program / instructions implement the steps of the role-based rights management method. For example, the computer program / instructions implement the following steps:

[0242] Step S101: receiving basic role definition data input, binding each basic role according to preset basic permissions, determining a corresponding basic role template library, receiving a custom role creation request, binding the custom role according to preset permission activation parameters, determining a corresponding custom permission, and associating the custom role and the custom permission with the basic role template library according to a target basic role identifier and permission inheritance rules in the custom role creation request, and determining a corresponding role permission template library;

[0243] Step S102: When a user is assigned multiple roles and performs permission operations, the user's currently activated multiple role permission sets are parsed according to the role permission template library, a directed acyclic graph is constructed with roles as nodes and permission dependencies as edges, the directed acyclic graph is traversed, and a permission union operation is performed according to preset role weight values ​​to determine the corresponding user permission result;

[0244] Step S103: Collect user operation behavior data stream in real time, input the operation behavior data stream into a pre-trained abnormal operation detection model for data processing, determine the corresponding abnormal probability value, call the dynamic token generator according to the abnormal probability value to modify the user authority result, determine the corresponding corrected authority result, and authorize the user according to the corrected authority result, so that the user can perform team management according to the authorized authority.

[0245] From the above description, it can be seen that the computer program product provided in the embodiment of the present application determines a basic role template library by binding basic permissions to preset basic roles; constructs a custom role, assigns custom permissions to the custom role and binds it to the basic role template library according to the permission inheritance rules to determine the role permission template library; when a user is assigned multiple roles and performs permission operations, a directed acyclic graph is constructed based on multiple roles and corresponding permissions, the directed acyclic graph is traversed, and a permission union operation is performed according to the preset role weight value to determine the corresponding user permission result; the user operation behavior data stream is collected in real time, and the operation behavior data stream is input into a pre-trained abnormal operation detection model for data processing, the corresponding abnormal probability value is determined, the permission result is corrected according to the abnormal probability value, and the user is authorized according to the corrected permission result, thereby improving the efficiency of team management through role permission optimization.

[0246] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, apparatus, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0247] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (apparatus), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as a combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0248] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0249] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0250] Specific embodiments are used in the present invention to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core ideas. At the same time, for those skilled in the art, according to the ideas of the present invention, there may be changes in the specific implementation methods and application scopes. In summary, the contents of this specification should not be understood as limiting the present invention.

Claims

1. A role-based rights management method, characterized in that: The method comprises: Receive basic role definition data input, bind each basic role according to preset basic permissions, determine the corresponding basic role template library, receive a custom role creation request, bind the custom role according to preset permission activation parameters, determine the corresponding custom permission, associate the custom role and the custom permission with the basic role template library according to the target basic role identifier and permission inheritance rule in the custom role creation request, and determine the corresponding role permission template library; When a user is assigned multiple roles and performs permission operations, the user's currently activated multiple role permission sets are parsed according to the role permission template library, a directed acyclic graph is constructed with roles as nodes and permission dependencies as edges, the directed acyclic graph is traversed, and a permission union operation is performed according to the preset role weight values ​​to determine the corresponding user permission result; Collect user operation behavior data stream in real time, input the operation behavior data stream into a pre-trained abnormal operation detection model for data processing, determine the corresponding abnormal probability value, call the dynamic token generator according to the abnormal probability value to modify the user authority result, determine the corresponding corrected authority result, and authorize the user according to the corrected authority result, so that the user can perform team management according to the authorized authority.

2. The role-based rights management method according to claim 1, characterized in that: The step of associating the custom role and the custom permission with the basic role template library according to the target basic role identifier and the permission inheritance rule in the custom role creation request, and determining the corresponding role permission template library, includes: Matching a corresponding target basic role from the basic role template library according to the target basic role identifier in the custom role creation request; Establishing a permission inheritance relationship between the custom role and the target basic role according to the permission inheritance rule in the custom role creation request, and obtaining basic permissions associated with the target basic role based on the permission inheritance relationship; The custom permission and the basic permission are associated and stored in the basic role template library, and a corresponding role permission template library is determined.

3. The role-based rights management method according to claim 1, characterized in that: When a user is assigned multiple roles and performs permission operations, the user's currently activated multiple role permission sets are parsed according to the role permission template library, and a directed acyclic graph with roles as nodes and permission dependencies as edges is constructed, including: When a user is assigned multiple roles and performs permission operations, all the role data and corresponding permission data assigned to the user are extracted from the role permission template library; Assign a role weight value to the role data according to a preset weight configuration rule, determine the corresponding role node, determine the corresponding edge relationship according to the dependency relationship between the permission data, and determine the corresponding directed acyclic graph according to the role nodes and the edge relationship, wherein the role weight value includes static weight and dynamic weight.

4. The role-based rights management method according to claim 1, wherein: The traversing the directed acyclic graph, performing a permission union operation according to preset role weight values, and determining corresponding user permission results includes: Traversing all role nodes in the directed acyclic graph, determining the permission data sets corresponding to each role node, and judging whether there is overlapping permission data in each permission data set; If so, the overlapping permissions are prioritized according to the preset role weight values, and the corresponding user permission results are determined according to the priority sorting results.

5. The role-based rights management method according to claim 3, characterized in that: Assigning a role weight value to the role data according to a preset weight configuration rule and determining a corresponding role node includes: Obtain the fixed level depth of character data in real time to determine the corresponding static weight; Acquire in real time the context features activated when the user performs permission operations, and determine the corresponding dynamic weights based on the context features and a preset feature mapping table; A role weight value is assigned to the role data according to the static weight and the dynamic weight, and a corresponding role node is determined.

6. The role-based rights management method according to claim 1, characterized in that: The real-time collection of user operation behavior data streams, inputting the operation behavior data streams into a pre-trained abnormal operation detection model for data processing, and determining corresponding abnormality probability values ​​include: Collecting user operation behavior data streams in real time, performing standardization processing on the behavior data streams, and extracting time series feature vectors from the standardized data streams according to user session slices; The time series feature vector is input into the pre-trained LSTM attention hybrid model to determine the corresponding context anomaly score. A dynamic threshold comparison is performed based on the context anomaly score and the user historical behavior baseline library to determine the corresponding anomaly probability value.

7. The role-based rights management method according to claim 1, characterized in that: The calling of a dynamic token generator to modify the user authority result according to the abnormal probability value and determining a corresponding revised authority result includes: According to the abnormal probability value, a preset attenuation level mapping table is matched and a linear interpolation algorithm is used to determine the corresponding authority attenuation coefficient; The dynamic token generator is called according to the permission decay coefficient in combination with the current timestamp to determine the corresponding temporary access token, and the user permission result is modified according to the temporary access token to determine the corresponding revised permission result.

8. A role-based rights management device, characterized in that: The device comprises: The role and permission library definition module is used to receive basic role definition data input, bind each basic role according to preset basic permissions, determine the corresponding basic role template library, receive a custom role creation request, bind the custom role according to preset permission activation parameters, determine the corresponding custom permission, and associate the custom role and the custom permission with the basic role template library according to the target basic role identifier and permission inheritance rules in the custom role creation request, and determine the corresponding role and permission template library; The permission result determination module is used to parse the user's currently activated multiple role permission sets according to the role permission template library when the user is assigned multiple roles and performs permission operations, construct a directed acyclic graph with roles as nodes and permission dependencies as edges, traverse the directed acyclic graph, perform permission union operations according to preset role weight values, and determine the corresponding user permission results; The permission result correction module is used to collect user operation behavior data streams in real time, input the operation behavior data streams into a pre-trained abnormal operation detection model for data processing, determine the corresponding abnormal probability value, call the dynamic token generator according to the abnormal probability value to modify the user permission result, determine the corresponding corrected permission result, and authorize the user according to the corrected permission result so that the user can perform team management according to the authorized authority.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the role-based rights management method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the role-based rights management method according to any one of claims 1 to 7 are implemented.

Images