User permission verification and data updating method and system

Abstract

The invention relates to the technical field of data processing, and discloses a user permission verification and data updating method and system, and the user permission verification and data updating method comprises the following steps: S101, calculating to obtain gateway side parameters; step S102, calculating to obtain a service side parameter; step S103, generating a plan submission moment; step S104, calculating to obtain an actual submission moment and recording scheduling jitter; step S105, constructing an audit vector; and step S106, updating the exponential moving average and generating a time consumption estimation value of the next round of processing. Aiming at the problems that the submission time is out of control and compliance auditing is difficult in an access control system based on a token, an instant feasible interval and a planned submission time are determined by uniformly integrating two layers of time limits of a gateway and resource service and combining link time delay calculation; and the unauthorized writing risk that the token is still submitted after expiration or is submitted before being effective is effectively avoided.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, more particularly, it relates to a user permission verification and data updating method and system. BACKGROUND

[0002] The current enterprise distributed system generally adopts micro-service and gateway architecture. When a user initiates a data updating request, the user needs to carry a token containing permission information. The request first enters the gateway. The gateway determines whether to release according to the expiration time and the non-effective time built in the token. In order to offset the misjudgment risk caused by the different machine clock and network jitter, the gateway will introduce a time allowance of several seconds to several minutes. In order to strengthen the security boundary, the resource service will re-verify the token validity after receiving the request, and also set an independent time allowance. At the same time, data writing often involves asynchronous links such as message queue, batch processing, transaction external sending, retry, and is not completed synchronously.

[0003] From the gateway release to the actual submission of the resource service, a data update needs to go through multiple links such as network transmission, service queuing and business execution. There is an objective time difference. The gateway determines that the token is available according to the local time and its own allowance when it is released. The resource service determines that the token is available according to its own time and the local allowance when it is verified subsequently. However, the two determinations are independent of each other and are not associated with the actual delay in the link. During this period, the token may have exceeded the expiration time or still not reached the starting point of the non-effective time. Adding the uncertain delay of the transmission and queuing links, the request may complete the data writing at a time when it should be logically rejected.

[0004] The existing scheme either only relies on the single determination of the gateway or independently verifies each layer without unified control over the submission beat. The default allowance value of the system, the clock deviation of each service and the uncertainty of the asynchronous link jointly cause the uncontrollability of the submission time, which not only causes the risk of unauthorized writing, but also causes the token to be submitted after expiration or before non-effectiveness. In addition, the audit log only records scattered time points, which makes it difficult to prove that the permission verification event actually occurred before the data submission. When encountering retry or batch processing scenarios, the above problems will be further magnified, which brings great difficulty to the permission revocation and compliance trace work, and it is difficult to meet the needs of enterprises for data operation security and traceability. SUMMARY

[0005] The present application provides a user permission verification and data updating method and system to solve the technical problems in the background art.

[0006] The present application provides a user permission verification and data updating method, which comprises the following steps: Step S101, obtaining the gateway side parameter when the user permission verification is passed, and calculating the expiration remaining budget and the effectiveness advance of the gateway side according to the gateway side parameter, and transmitting the gateway side parameter to the resource service with the request. The gateway-side parameters include: a gateway release time, a token expiration time, a token effective time, and a gateway tolerance; In step S102, when the resource service receives the request, the service entry time is recorded, and the gateway-side parameters and the service tolerance are obtained, based on which the service-side parameters are calculated, and the expiration remaining budget and the effective advance of the arrival time are converted; The service-side parameters include: a path delay, an earliest submission time, a latest submission time, and an instant feasible interval upper and lower bound; In step S103, the processing time estimation value is obtained by processing the time consumption prediction model, the compression factor is calculated based on the expiration remaining budget and the effective advance of the arrival time, and the planned submission time is generated; In step S104, the waiting and submission are performed within the instant feasible interval upper and lower bound according to the planned submission time, the actual submission time is obtained, and the scheduling jitter is recorded; In step S105, the normalized utilization rate, the expiration-side remaining budget, and the effective-side advance are calculated based on the actual submission time and the earliest submission time and the latest submission time, the audit vector is constructed, and is persisted; In step S106, the actual processing time is obtained based on the actual submission time and the service entry time, the exponential moving average is updated, and the next round of processing time estimation value is generated.

[0007] Further, the sum of the token expiration time and the gateway tolerance is calculated, the difference between the sum and the gateway release time is calculated, the maximum value between 0 and the difference is taken, and the expiration remaining budget on the gateway side is obtained; the difference between the token effective time and the gateway tolerance is calculated, and the gateway release time is subtracted by the difference, to obtain the effective advance on the gateway side; the gateway-side parameters, the expiration remaining budget on the gateway side, and the effective advance on the gateway side are collectively composed into a time budget vector, and the time budget vector is set to read-only and passed to the resource service with the request.

[0008] Further, step S102 includes the following steps: In step S201, the difference between the service entry time and the gateway release time is calculated as the path delay; In step S202, the sum of the gateway tolerance and the service tolerance is calculated, and the token effective time is subtracted by the sum to obtain the earliest submission time; In step S203, the sum of the gateway tolerance and the service tolerance is calculated, and the token expiration time is added by the sum to obtain the latest submission time; In step S204, the maximum value between the earliest submission time and the service entry time is taken as the lower bound of the instant feasible interval, and the latest submission time is taken as the upper bound of the instant feasible interval; In step S205, the difference between the expiration remaining budget on the gateway side and the path delay is calculated to obtain the expiration remaining budget of the arrival time; Step S206, the sum of the effective advance and the path delay on the gateway side is calculated to obtain the arrival time.

[0009] Further, the difference between the earliest submission time and the service queue time is calculated, and the maximum value between 0 and the difference is obtained as the earliest submission required waiting amount; the input of the processing time prediction model is processed as a feature vector composed of the average processing time of historical requests of the same type, the data size of the current request, the current CPU usage rate of the resource service, and the service type of the current request; during the operation of the resource service, the feature vector of each request is recorded, and the service queue time and the actual submission time of the request are recorded synchronously, the difference between the actual submission time and the service queue time is calculated as the sample label of a training sample, and the processing time prediction model is constructed based on a multilayer perceptron.

[0010] Further, the difference between the latest submission time and the service queue time is calculated first, and then the ratio of the difference to the processing time is calculated, and the minimum value between 1 and the ratio is obtained as the service side compression factor; the ratio of the expired remaining budget at the arrival time to the processing time estimate value is calculated, and the minimum value between 1 and the ratio is obtained as the gateway side compression factor; the minimum value between the service side compression factor and the gateway side compression factor is taken as the target compression factor; the sum of the service queue time and the earliest submission required waiting amount is calculated first, and then the product of the target compression factor and the processing time estimate value is added to the sum, and the minimum value between the calculation result and the latest submission time is taken as the planned submission time.

[0011] Further, the maximum value between the current time and the lower bound of the instant feasible interval is taken as the waiting baseline, and the difference between the planned submission time and the waiting baseline is calculated, and the maximum value between 0 and the difference is taken as the waiting time; the waiting operation is performed according to the waiting time, and when the time reaches the planned submission time, the data submission operation is immediately performed, and the actual submission time of this data submission is recorded; the difference between the actual submission time and the planned submission time is calculated as the scheduling jitter.

[0012] Further, the difference between the latest submission time and the actual submission time is calculated to obtain the expired side remaining budget; the difference between the actual submission time and the earliest submission time is calculated to obtain the effective side advance; the difference between the actual submission time and the lower bound of the instant feasible interval is taken as the numerator, the difference between the latest submission time and the lower bound of the instant feasible interval is taken as the denominator, and the ratio of the numerator to the denominator is taken as the normalized utilization rate; and the gateway side parameter, the service side parameter, the service queue time, the service tolerance, the actual submission time, the expired side remaining budget, the effective side advance, and the normalized utilization rate are collectively composed into an audit vector and are persistently stored.

[0013] Further, the difference between the actual submission time and the service queue time is calculated to obtain the actual processing time consumption, the product of the smoothing coefficient and the current stored exponential moving average is calculated to obtain a first product, the difference between 1 and the smoothing coefficient is calculated, and the product of the difference and the actual processing time consumption is calculated to obtain a second product, and the sum of the first product and the second product is calculated to obtain the updated exponential moving average.

[0014] Further, the difference between the latest submission time and the earliest submission time is calculated to obtain the post-effect write window width, the normalized utilization rate is first reduced by 0.5, and then the difference is multiplied by the post-effect write window width to obtain the position offset correction amount, and the updated exponential moving average, the scheduling jitter and the position offset correction amount are added to obtain the next round processing time consumption estimation value.

[0015] The application provides a user permission verification and data updating system, comprising: The gateway side parameter calculation module is used to obtain the gateway side parameters when the user permission verification is passed, and the expired remaining budget and the effective advance amount of the gateway side are calculated and obtained, and are transmitted to the resource service with the request; The service side parameter calculation module is used to record the service queue time when the resource service receives the request, and obtain the gateway side parameters and the service tolerance, and the service side parameters are calculated and obtained, and the expired remaining budget and the effective advance amount of the arrival time are converted; The planned submission time generation module is used to obtain the processing time consumption estimation value through the processing time consumption prediction model, calculate the compression factor according to the expired remaining budget and the effective advance amount of the arrival time, and generate the planned submission time; The scheduling jitter calculation module is used to execute the waiting and submission within the upper and lower bounds of the real-time feasible interval according to the planned submission time, obtain the actual submission time and record the scheduling jitter; The audit vector construction module is used to calculate the normalized utilization rate, the expired side remaining budget and the effective side advance amount according to the actual submission time, the earliest submission time and the latest submission time, construct the audit vector and persist; The processing time consumption estimation module is used to obtain the actual processing time consumption according to the actual submission time and the service queue time, update the exponential moving average and generate the next round processing time consumption estimation value.

[0016] The application has the beneficial effects that: the application aims at the problems of submission time out of control and compliance audit difficulty in the token-based access control system, determines the instant feasible interval and the planned submission time by uniformly integrating the two-layer time allowance of the gateway and the resource service, combining with the link delay calculation, effectively avoids the risk of unauthorized writing after the token expires or before it takes effect; at the same time, the audit vector containing the gateway side parameter, the service side parameter, the submission deviation data and the like is constructed and persisted, the whole process time logic from the gateway release to the resource service submission can be restored, the compliance audit and problem tracing requirements are met; in addition, the actual processing time consumption is updated by the exponential moving average, the adaptive next round processing time consumption estimation value is generated, the subsequent planned submission time is more suitable for the actual execution scene, the resource waste is reduced, and the safety, compliance and process stability of data operation are overall improved. BRIEF DESCRIPTION OF DRAWINGS

[0017] Fig. 1 is a flowchart of a user permission verification and data updating method of the application; Fig. 2 is a flowchart of step S102 of the application; Fig. 3 is a schematic diagram of a user permission verification and data updating system of the application.

[0018] In the figure: gateway side parameter calculation module 301, service side parameter calculation module 302, planned submission time generation module 303, scheduling jitter calculation module 304, audit vector construction module 305, processing time consumption estimation module 306. DETAILED DESCRIPTION

[0019] The subject matter described herein will now be discussed with reference to example implementations. It should be understood that the discussion of these implementations is merely meant to provide a better understanding of the subject matter described herein and can be changed in function and arrangement without departing from the scope of the present description. Various examples can omit, substitute, or add various procedures or components as appropriate. Also, features described in relation to some examples can also be combined in other examples.

[0020] It should be noted that unless otherwise defined, technical and scientific terms used in one or more embodiments of the application have the meanings commonly understood by one of ordinary skill in the art in the field of the application. The words "first", "second", and similar words of distinction do not imply any order, quantity, or importance, but are used to distinguish one element from another, unless otherwise defined. The words "include", "contain", and similar words mean that the elements or objects before the word encompass the elements or objects listed after the word and their equivalents, and do not exclude other elements or objects. The words "connected" or "connected" do not mean physical or mechanical connection, but can include electrical connection, whether direct or indirect. The words "up", "down", "left", "right", and the like are used only to indicate relative positional relationships, which may change accordingly when the absolute position of the described object changes.

[0021] As shown in Figs. 1-3 A user permission verification and data updating method includes the following steps: Step S101, when the user permission verification is passed, the gateway side parameters are obtained, from which the expired remaining budget and the effective advance of the gateway side are calculated and passed to the resource service with the request; The gateway side parameters include: gateway release time, token expiration time, token effective time, and gateway tolerance; Step S102, when the resource service receives the request, the service entry time is recorded, and the gateway side parameters and service tolerance are obtained, from which the service side parameters are calculated, and the expired remaining budget and effective advance of the arrival time are converted; The service side parameters include: path delay, earliest submission time, latest submission time, and upper and lower bounds of the instant feasible interval; Step S103, the processing time prediction model is processed to obtain the processing time estimate value, the compression factor is calculated according to the expired remaining budget and the effective advance of the arrival time, and the planned submission time is generated; Step S104, according to the planned submission time, the waiting and submission within the upper and lower bounds of the instant feasible interval are executed, the actual submission time is obtained, and the scheduling jitter is recorded; Step S105, according to the actual submission time and the earliest submission time, the latest submission time, the normalized utilization rate, the expired side remaining budget, and the effective side advance are calculated, the audit vector is constructed, and the persistence is performed; Step S106, according to the actual submission time and the service entry time, the actual processing time is obtained, the exponential moving average is updated, and the next round of processing time estimate value is generated.

[0022] It should be noted that the application is applied to a token-based access control system, which includes a gateway and a resource service two-layer architecture, when a user initiates a data access or update request, a token containing identity and permission information needs to be carried, after the request reaches the gateway, the gateway verifies the legality of the token and the user permission, and enters step S101 after the verification; wherein the resource service represents an application service that receives and processes specific business requests of the user, which needs to perform subsequent time constraint verification and submission time control based on the time budget vector transmitted by the gateway to ensure that the data operation meets the time validity rules of the token; record the time when the verification is passed as the gateway release time; read the preset token expiration time and token effective time from the token carried by the user; read the gateway tolerance pre-configured by the gateway, which is a time allowance set by the gateway to cope with the clock deviation of different machines.

[0023] Specifically, the gateway release time represents the specific time point at which the gateway completes user permission verification and allows the request to continue to the resource service; the token expiration time represents the time point at which the token is set to be no longer valid, that is, after the time point, the token should be rejected; the token effective time represents the time point at which the token is set to start being valid, that is, before the time point, the token should be rejected; the gateway tolerance represents the time allowance set by the gateway when verifying the validity of the token to offset the clock asynchronization problem between different machines, for example, if the tolerance is 5 seconds and the token expiration time is 10:00:00, the gateway will consider the request before 10:00:05 as not expired.

[0024] In an embodiment of the application, the sum of the token expiration time and the gateway tolerance is calculated, and the difference between the sum and the gateway release time is calculated, and the maximum value between 0 and the difference is obtained, to obtain the expiration remaining budget on the gateway side.

[0025] In an embodiment of the application, the difference between the token effective time and the gateway tolerance is calculated, and the gateway release time is subtracted by the difference to obtain the effective advance amount on the gateway side.

[0026] In an embodiment of the application, the gateway side parameters, the expiration remaining budget and the effective advance amount on the gateway side are jointly composed into a time budget vector, and the time budget vector is set to be read-only and transmitted to the resource service with the request.

[0027] Specifically, the expiration remaining budget on the gateway side The calculation formula is as follows: , wherein represents the token expiration time, represents the gateway tolerance, represents the gateway release time.

[0028] Specifically, the effective advance amount on the gateway side The calculation formula of the gateway side expiration remaining budget is as follows: wherein represents the token effective time.

[0029] It should be noted that the gateway side expiration remaining budget represents the remaining time of the gateway release time from the token expiration time plus the latest acceptable time point of the gateway tolerance, which is used to quantify the time margin of the request that can still be used on the expiration side when the gateway is released. If the result is 0, it means that the latest acceptable time has been exceeded; the gateway side effective advance amount represents the time difference between the gateway release time and the token effective time minus the earliest acceptable time point of the gateway tolerance, which is used to quantify the degree of advance of the request relative to the earliest acceptable time point when the gateway is released. If the result is negative, it means that the earliest acceptable time has not been reached.

[0030] In an embodiment of the present application, as shown in Fig. 2 Step S102 includes the following steps: Step S201, calculate the difference between the service entry time and the gateway release time as the path delay; Step S202, calculate the sum of the gateway tolerance and the service tolerance, and then subtract the sum from the token effective time to obtain the earliest submission time; Step S203, calculate the sum of the gateway tolerance and the service tolerance, and then add the sum to the token expiration time to obtain the latest submission time; Step S204, take the maximum value between the earliest submission time and the service entry time as the lower bound of the instant feasible interval, and take the latest submission time as the upper bound of the instant feasible interval; Step S205, calculate the difference between the gateway side expiration remaining budget and the path delay to obtain the expiration remaining budget of the arrival time; Step S206, calculate the sum of the gateway side effective advance amount and the path delay to obtain the effective advance amount of the arrival time.

[0031] It should be noted that the path delay represents the time difference between the time when the gateway releases the request and the time when the resource service receives the request and completes the entry, which is used to quantify the time consumed in the transmission, queuing and other links between the gateway and the resource service; the earliest submission time represents the earliest time point allowed by the token effective time to perform the submission action, which ensures that the submission action is not earlier than the logical effective range of the token; the latest submission time represents the latest time point allowed by the token expiration time to perform the submission action, which ensures that the submission action is not later than the logical expiration range of the token; the lower bound of the instant feasible interval is used to limit the earliest time boundary of the submission that can be dispatched from the service entry time; the upper bound of the instant feasible interval is used to limit the latest time boundary of the submission that can be dispatched from the service entry time, and the lower and upper bounds of the instant feasible interval together constitute the time range of the current executable submission on the service side.

[0032] It should be noted that the expired remaining budget of the arrival time is used to measure the available time remaining from the service entry time to the allowed latest submission time, the effective advance of the arrival time is used to measure the advance degree of the service entry time relative to the allowed earliest submission time, if the result is negative, it indicates that the earliest submission time has not arrived; the service tolerance represents the time allowance set by the resource service when checking the validity of the token to offset the clock synchronization problem between itself and other machines (such as gateways and token issuers, etc.), that is, the gateway tolerance is the time allowance used by the gateway when checking the token, and the service tolerance is the time allowance used by the resource service when checking the token, both of which are custom parameters, which are configured in the system parameters of the gateway and the resource service by the system administrator or the developer according to the clock stability, network jitter and other factors of the deployment environment, and will not be repeated here.

[0033] In an embodiment of the application, the difference between the earliest submission time and the service entry time is calculated, the maximum value between 0 and the difference is taken, and the waiting amount required for the earliest submission is obtained.

[0034] In an embodiment of the application, the difference between the negative effective advance of the arrival time and the service tolerance can also be calculated, the maximum value between 0 and the difference is taken, and the waiting amount required for the earliest submission is obtained.

[0035] It should be noted that the waiting amount required for the earliest submission represents the time length required to wait from the service entry time to the time when the earliest submission action can be performed, if the service entry time is later than the earliest submission time, the waiting amount is 0, that is, no waiting is required and the submission can be prepared directly, if the service entry time is earlier than the earliest submission time, the waiting amount is the time difference between the two, that is, the submission needs to be prepared after waiting until the earliest submission time.

[0036] In an embodiment of the application, the input of the processing time prediction model is a feature vector composed of the average processing time of historical requests of the same type, the data size of the current request, the current CPU usage of the resource service, and the business type of the current request; during the running of the resource service, the feature vector of each request is recorded, and the service entry time and the actual submission time of the request are recorded synchronously, the difference between the actual submission time and the service entry time is calculated as the sample label of a training sample, and the processing time prediction model is constructed based on a multilayer perceptron.

[0037] It should be noted that the requested business types include query, add, modify, and delete, etc. The average processing time of historical requests of the same type can be obtained manually. The multilayer perceptron consists of an input layer, a first hidden layer, a second hidden layer, and an output layer. For example, the number of neurons in the first hidden layer can be set to 64, and the number of neurons in the second hidden layer can be set to 32. The activation function can be ReLU or PReLU, etc. In addition, the training samples are divided into training set and validation set in a 7:3 ratio. During the training of the processing time prediction model, the mean squared error function is selected as the loss function, and the Adam optimizer is used for model training. The iteration continues until the loss on the validation set is stable and converges, which will not be elaborated here.

[0038] In one embodiment of the present invention, the difference between the latest submission time and the service enqueue time is first calculated, and then the ratio of the difference to the processing time is calculated. The minimum value between 1 and the ratio is taken to obtain the service-side compression factor. The ratio of the expired remaining budget at the arrival time to the estimated processing time is calculated, and the minimum value between 1 and the ratio is taken to obtain the gateway-side compression factor. The minimum value between the service-side compression factor and the gateway-side compression factor is taken to obtain the target compression factor.

[0039] It should be noted that the service-side compression factor is a coefficient used to control the planned submission time to be no later than the latest submission time. If the ratio involved in the calculation is greater than 1, it means that the estimated time can fall completely within the interval from the service enqueue time to the latest submission time, and the compression factor is 1, meaning no compression is needed. If the ratio involved in the calculation is less than 1, it means that the estimated time exceeds this interval, and the compression factor is the ratio, meaning that the estimated time needs to be compressed proportionally to avoid the planned submission time exceeding the latest submission time. The gateway-side compression factor is a coefficient used to control the planned submission time to not exceed the remaining budget expired at the arrival time. If the ratio involved in the calculation is greater than 1, it means that the estimated time can fall completely within the remaining budget expired at the arrival time, and the compression factor is 1, meaning no compression is needed. If the ratio involved in the calculation is less than 1, it means that the estimated time exceeds this budget, and the compression factor is the ratio, meaning that the estimated time needs to be compressed proportionally to avoid the planned submission time exceeding the budget. The target compression factor is the final coefficient that simultaneously satisfies the constraints of the service side and the gateway side, ensuring that the planned submission time is neither later than the latest submission time nor exceeds the expired remaining budget at the arrival time.

[0040] In one embodiment of the present invention, the sum of the service enqueue time and the waiting time required for the earliest submission is first calculated. Then, the sum is added to the product of the target compression factor and the estimated processing time. The minimum value between the calculated result and the latest submission time is taken to obtain the planned submission time.

[0041] Specifically, the planned submission time The calculation formula is as follows: ,in The 'h' indicates the service enqueue time, and 'h' indicates the waiting time required for the earliest submission. Indicates the target compression factor. Indicates the latest submission time.

[0042] It should be noted that the processing time estimate represents the estimated time required from the time the service is enqueued to the time the request actually completes the data submission and storage. This time includes the total time spent on internal queuing, business logic processing, and data writing and storage.

[0043] It should be noted that the planned submission time cannot be earlier than the lower bound of the immediately feasible interval to avoid the earliest possible submission time. Similarly, the planned submission time cannot be earlier than the effective advance of the arrival time, which indirectly ensures that the planned submission time is not earlier than the earliest submission time and that the planned submission time must fall before the latest submission time. This ensures that the subsequent actual submission action will not exceed the time range allowed by the token and avoids the situation of submission after expiration.

[0044] In one embodiment of the present invention, the maximum value between the lower bound of the immediately feasible interval and the current time is taken as the waiting baseline. Then, the difference between the planned submission time and the waiting baseline is calculated, and the maximum value between 0 and the difference is taken as the waiting time. The waiting operation is performed according to the waiting time. When the time reaches the planned submission time, the data submission operation is immediately performed, and the actual submission time of this data submission is recorded. The difference between the actual submission time and the planned submission time is calculated as the scheduling jitter.

[0045] It should be noted that waiting and committing are performed according to the planned commit time, which is no earlier than the lower bound of the immediately feasible interval and no later than the upper bound of the immediately feasible interval. The earliest allowed commit boundary is locked by the waiting baseline, and the latest allowed commit boundary is locked by the early constraint of the planned commit time. Ultimately, the actual commit action must fall within the compliant time interval, avoiding ineffective or expired commits. The non-negative calculation of waiting time avoids early or invalid waiting, ensuring that the planned commit time is accurately reached after waiting, reducing resource waste or commit delays. Scheduling jitter is used to quantify the deviation between the actual commit and the planned commit, providing a clear time trace for each commit action, which can facilitate the reconstruction of the complete timeline from the waiting operation to the commit operation during auditing, and achieve operation traceability.

[0046] In one embodiment of the present invention, the difference between the latest submission time and the actual submission time is calculated to obtain the remaining budget on the expired side; the difference between the actual submission time and the earliest submission time is calculated to obtain the advance amount on the effective side.

[0047] It should be noted that the remaining budget on the expired side represents the available time remaining between the actual submission time and the latest allowed submission boundary. If the difference is positive, it means that the actual submission is before the latest boundary, indicating time redundancy. If the difference is negative, it means that the actual submission exceeds the latest boundary, indicating compliance risk. The advance amount on the effective side represents the offset of the actual submission time relative to the earliest allowed submission boundary. If the difference is positive, it means that the actual submission is after the earliest boundary, meeting the effectiveness requirements. If the difference is negative, it means that the actual submission is earlier than the earliest boundary, indicating compliance risk of an ineffective submission. Both are only involved in compliance measurement and audit traceability and do not directly participate in the calculation of subsequent steps.

[0048] In one embodiment of the present invention, the difference between the actual submission time and the lower bound of the immediate feasible interval is used as the numerator, and the difference between the latest submission time and the lower bound of the immediate feasible interval is used as the denominator. The ratio of the numerator to the denominator is used as the normalized utilization rate. The gateway-side parameters, service-side parameters, service enqueue time, service tolerance, actual submission time, expired remaining budget, effective advance amount, and normalized utilization rate are combined to form an audit vector and persistently stored.

[0049] It should be noted that the normalized utilization rate is used to quantify the relative position of the actual submission time within the immediate feasible interval. When the ratio is close to 0, it indicates that the actual submission time is close to the lower bound of the immediate feasible interval, i.e., close to the earliest possible submission time; when the ratio is close to 1, it indicates that the actual submission time is close to the upper bound of the immediate feasible interval, i.e., close to the latest possible submission time. This ratio can be used to quickly determine the time distribution characteristics of the actual submission within the compliance interval. In addition, an audit vector is constructed to cover the entire process from gateway approval to service queuing to actual submission, including time and budget dimensions. Persistent storage allows for quick retrieval of the entire process parameters in subsequent compliance checks and issue tracing, meeting the needs of audit tracing and risk assessment. Common storage methods include writing to a dedicated audit log file, storing in a relational database or time-series database, and backing up to a distributed storage system.

[0050] In one embodiment of the present invention, the difference between the actual submission time and the service enqueue time is calculated to obtain the actual processing time; the product of the smoothing coefficient and the currently stored exponential moving average is calculated to obtain the first product; the difference between 1 and the smoothing coefficient is calculated, and the product of the difference and the actual processing time is calculated to obtain the second product; the sum of the first product and the second product is calculated to obtain the updated exponential moving average.

[0051] It should be noted that the smoothing coefficient is a custom parameter ranging from 0 to 1. Preferably, the smoothing coefficient is set to 0.9. When the smoothing coefficient is close to 1, the calculation of the updated exponential moving average will focus more on historical data, resulting in a stronger smoothing effect and reducing the impact of single abnormal time consumption on the results. When the smoothing coefficient is close to 0, it will focus more on the current actual time consumption data, making it more sensitive to the latest time consumption changes, but the smoothing effect is weaker and it is more susceptible to short-term fluctuations. The exponential moving average achieves smoothing of data fluctuations by assigning different weights to data at different time points, obtaining a more stable time consumption baseline and avoiding the impact of single abnormal data on the overall estimate. The default value of the currently stored exponential moving average used for the initial calculation can be set to the actual processing time of the first request or the industry experience average time consumption of similar requests.

[0052] In one embodiment of the present invention, the difference between the latest submission time and the earliest submission time is calculated to obtain the subsequent write window width; the normalized utilization rate is subtracted from 0.5, and the difference is multiplied by the subsequent write window width to obtain the position offset correction amount; the updated exponential moving average, scheduling jitter and position offset correction amount are added together to obtain the estimated processing time for the next round.

[0053] Specifically, the estimated processing time for the next round. The calculation formula is as follows: ,in This represents the updated exponential moving average. Indicates scheduling jitter. U represents the normalization utilization rate, U represents the latest submission time, and L represents the earliest submission time.

[0054] It should be noted that the updated exponential moving average is a stable time baseline formed by balancing historical processing times with current actual processing times; scheduling jitter is the time deviation between the actual submission time and the planned submission time in the previous round; the position offset correction is an amount used to adjust the estimate based on the position of the actual submission in the previous round within the immediate feasible interval; the updated exponential moving average, scheduling jitter, and position offset correction are added together to integrate the stable time baseline, compensate for fluctuations in actual submissions, and make fine adjustments based on the submission position, thereby forming the estimated processing time for the next round.

[0055] It should be noted that the next round of processing time estimation is directly applied to step S103. This estimation replaces the processing time estimation output by the processing time prediction model. Combined with the expired remaining budget and the effective lead time at the arrival time, it helps to calculate the compression factor and finally generate the planned submission time. The next round of processing time estimation integrates the stable baseline of historical processing time, the compensation amount for the scheduling jitter in the previous round, and the fine-tuning amount of the submission position, which is closer to the actual execution situation than the initial model estimation. Applying it to step S103 makes the generated planned submission time more consistent with the real business scenario, avoiding the need for long waiting times due to estimation deviations or exceeding the compliance boundary due to the planned submission time being too early, thereby reducing resource waste and the risk of overdue, and improving the stability and compliance of the entire scheduling process.

[0056] In one embodiment of the present invention, such as Fig. 3 As shown, a user permission verification and data update system includes: The gateway-side parameter calculation module 301 is used to obtain gateway-side parameters when the user permission verification is passed, calculate the expired remaining budget and effective advance amount on the gateway side, and pass them to the resource service with the request. The service-side parameter calculation module 302 is used to record the service enqueue time when the resource service receives a request, and obtain the gateway-side parameters and service tolerance. Based on this, the service-side parameters are calculated, and the expired remaining budget and effective lead time at the arrival time are converted. The planned submission time generation module 303 is used to obtain the estimated processing time through the processing time prediction model, calculate the compression factor based on the overdue remaining budget and the effective lead time at the arrival time, and generate the planned submission time. The scheduling jitter calculation module 304 is used to perform waiting and submission within the upper and lower bounds of the immediate feasible interval according to the planned submission time, obtain the actual submission time and record the scheduling jitter. Audit vector construction module 305 is used to calculate the normalized utilization rate, the remaining budget on the expired side and the advance amount on the effective side based on the actual submission time, the earliest submission time, and the latest submission time, and to construct and persist the audit vector. The processing time estimation module 306 is used to obtain the actual processing time based on the actual submission time and the service enqueue time, update the exponential moving average, and generate the next round of processing time estimation value.

[0057] It should be noted that the interval and threshold sizes are set for ease of comparison. The size of the threshold depends on the amount of sample data and the base number set by those skilled in the art for each set of sample data, as long as it does not affect the proportional relationship between the parameter and the quantized value. Furthermore, the above formulas are all dimensionless calculations, and the formulas are derived from software simulations using a large amount of collected data to obtain the most recent real-world results. The preset parameters in the formulas are set by those skilled in the art according to the actual situation.

[0058] The embodiments of this example have been described above. However, this example is not limited to the specific implementation methods described above. The specific implementation methods described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms based on the guidance of this example, and all of them are within the protection scope of this example.

Claims

1. A method for user permission verification and data update, characterized in that, Includes the following steps: Step S101: When the user permission verification is passed, obtain the gateway side parameters, calculate the expired remaining budget and effective advance amount on the gateway side, and pass them to the resource service with the request. Gateway-side parameters include: gateway grant time, token expiration time, token effective time, and gateway tolerance. Step S102: When the resource service receives a request, record the service enqueue time, obtain the gateway side parameters and service tolerance, calculate the service side parameters accordingly, and convert the expired remaining budget and effective lead time at the arrival time. Server-side parameters include: path latency, earliest commit time, latest commit time, and upper and lower bounds of the immediate feasible interval; Step S103: Obtain the estimated processing time through the processing time prediction model, calculate the compression factor based on the overdue remaining budget and the effective lead time at the arrival time, and generate the plan submission time. Step S104: According to the planned submission time, perform waiting and submission within the upper and lower bounds of the immediate feasible interval, obtain the actual submission time and record the scheduling jitter; Step S105: Calculate the normalized utilization rate, the remaining budget on the expired side and the advance amount on the effective side based on the actual submission time, the earliest submission time, and the latest submission time; construct the audit vector and persist it. Step S106: Obtain the actual processing time based on the actual submission time and the service enqueue time, update the exponential moving average, and generate the estimated processing time for the next round.

2. The user permission verification and data update method according to claim 1, characterized in that, Calculate the sum of the token expiration time and the gateway tolerance, then calculate the difference between this sum and the gateway release time, and take the maximum value between 0 and this difference to obtain the remaining expiration budget on the gateway side; calculate the difference between the token activation time and the gateway tolerance, and then subtract this difference from the gateway release time to obtain the activation lead time on the gateway side. The gateway-side parameters, along with the gateway-side expired remaining budget and effective lead time, are combined to form a time budget vector, which is then set to read-only and passed to the resource service with the request.

3. The user permission verification and data update method according to claim 1, characterized in that, Step S102 includes the following steps: Step S201: Calculate the difference between the service enqueue time and the gateway release time as the path delay; Step S202: Calculate the sum of the gateway tolerance and the service tolerance, and then subtract this sum from the token effective time to obtain the earliest submission time; Step S203: Calculate the sum of the gateway tolerance and the service tolerance, and then add the token expiration time to the sum to obtain the latest submission time; Step S204: Take the maximum value between the earliest submission time and the service enqueue time as the lower bound of the immediate feasible interval, and take the latest submission time as the upper bound of the immediate feasible interval. Step S205: Calculate the difference between the expired remaining budget on the gateway side and the path delay to obtain the expired remaining budget at the arrival time; Step S206: Calculate the sum of the effective advance and path delay on the gateway side to obtain the effective advance at the arrival time.

4. The user permission verification and data update method according to claim 1, characterized in that, The difference between the earliest submission time and the service enqueue time is calculated, and the maximum value between 0 and this difference is taken to obtain the waiting time required for the earliest submission. The input of the processing time prediction model is a feature vector representation composed of the average processing time of historical requests of the same type, the data size of the current request, the current CPU utilization of the resource service, and the business type of the current request. During the operation of the resource service, the feature vector of each request is recorded, and the service enqueue time and the actual submission time of the request are recorded synchronously. The difference between the actual submission time and the service enqueue time is calculated and used as the sample label of a training sample. The processing time prediction model is built based on a multilayer perceptron.

5. The user permission verification and data update method according to claim 4, characterized in that, First, calculate the difference between the latest submission time and the service enqueue time. Then, calculate the ratio of this difference to the processing time. Take the minimum value between 1 and this ratio to obtain the service-side compression factor. Calculate the ratio of the expired remaining budget at the arrival time to the estimated processing time. Take the minimum value between 1 and this ratio to obtain the gateway-side compression factor. Take the minimum value between the service-side compression factor and the gateway-side compression factor to obtain the target compression factor. First, calculate the sum of the service enqueue time and the waiting time required for the earliest submission. Then, add this sum to the product of the target compression factor and the estimated processing time. Take the minimum value between this calculation result and the latest submission time to obtain the planned submission time.

6. The user permission verification and data update method according to claim 1, characterized in that, Take the maximum value between the lower bound of the immediate feasible interval and the current time as the waiting baseline, then calculate the difference between the plan submission time and the waiting baseline, and take the maximum value between 0 and the difference as the waiting time; The waiting operation is performed according to the waiting time. When the time reaches the planned submission time, the data submission operation is performed immediately, and the actual submission time of this data submission is recorded. Calculate the difference between the actual submission time and the planned submission time as the scheduling jitter.

7. The user permission verification and data update method according to claim 1, characterized in that, Calculate the difference between the latest submission time and the actual submission time to obtain the remaining budget on the expired side; Calculate the difference between the actual submission time and the earliest submission time to obtain the lead time on the effective side; The difference between the actual submission time and the lower bound of the immediate feasible interval is used as the numerator, and the difference between the latest submission time and the lower bound of the immediate feasible interval is used as the denominator. The ratio of the numerator to the denominator is used as the normalization utilization rate. The gateway-side parameters, service-side parameters, service enqueue time, service tolerance, actual commit time, expired remaining budget, effective advance amount, and normalization utilization rate are combined to form an audit vector and persistently stored.

8. The user permission verification and data update method according to claim 1, characterized in that, Calculate the difference between the actual submission time and the service enqueue time to obtain the actual processing time; Calculate the product of the smoothing coefficient and the currently stored exponential moving average to obtain the first product. Calculate the difference between 1 and the smoothing coefficient, and then calculate the product of this difference and the actual processing time to obtain the second product. Calculate the sum of the first product and the second product to obtain the updated exponential moving average.

9. A user permission verification and data update method according to claim 8, characterized in that, Calculate the difference between the latest commit time and the earliest commit time to obtain the subsequent write window width; First, subtract the normalized utilization rate from 0.5, then multiply the difference by the post-processing window width to obtain the position offset correction. Add the updated exponential moving average, scheduling jitter, and position offset correction to obtain the estimated processing time for the next round.

10. A user permission verification and data update system, characterized in that, Performing a user permission verification and data update method as described in any one of claims 1 to 9, comprising: The gateway-side parameter calculation module is used to obtain gateway-side parameters when the user's permission verification is successful, calculate the expired remaining budget and effective advance amount on the gateway side, and pass them to the resource service with the request. The service-side parameter calculation module is used to record the service enqueue time when the resource service receives a request, obtain the gateway-side parameters and service tolerance, calculate the service-side parameters based on these parameters, and convert them into the expired remaining budget and effective lead time at the arrival time. The planned submission time generation module is used to obtain the estimated processing time through the processing time prediction model, calculate the compression factor based on the overdue remaining budget and the effective lead time at the arrival time, and generate the planned submission time. The scheduling jitter calculation module is used to perform waiting and submission within the upper and lower bounds of the immediate feasible interval according to the planned submission time, obtain the actual submission time and record the scheduling jitter. The audit vector construction module is used to calculate the normalized utilization rate, the remaining budget on the expired side and the advance amount on the effective side based on the actual submission time, the earliest submission time, and the latest submission time, and to construct and persist the audit vector. The processing time estimation module is used to obtain the actual processing time based on the actual submission time and the service enqueue time, update the exponential moving average, and generate the processing time estimate for the next round.

Images