Cross-department knowledge sharing and security isolation authority dynamic allocation method and device, computer equipment, storage medium and computer program product

Abstract

The invention relates to a dynamic authority allocation method and device for cross-department knowledge sharing and security isolation, computer equipment, a storage medium and a computer program product. The method comprises the steps that user access logs are collected and preprocessed, modeling is conducted on a user behavior sequence through a recurrent neural network model for the preprocessed user access logs, and a behavior analysis result is obtained; constructing an enterprise knowledge graph in combination with natural language processing and social network analysis technologies, and generating a knowledge demand evaluation result according to the enterprise knowledge graph; determining an optimal permission scheme in combination with a behavior analysis result and a knowledge demand evaluation result; according to the user access context and the behavior analysis result, matching an adaptive security isolation strategy from a preset strategy library; and executing real-time permission updating according to the optimal permission scheme and the security isolation strategy. By adopting the method, the management cost and the compliance risk can be reduced, and the method has high expandability and scene adaptability.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a method, apparatus, computer device, storage medium, and computer program product for dynamic allocation of permissions for cross-departmental knowledge sharing and secure isolation. Background Technology

[0002] As enterprises deepen their digital transformation, technologies in the fields of enterprise knowledge management and data security continue to develop, giving rise to role-based access control, attribute-based access control, and some zero-trust security products. Among them, role-based access control assigns permissions by assigning fixed organizational roles, attribute-based access control introduces multi-dimensional references such as time, location, and device, and zero-trust products incorporate risk scoring mechanisms to assist in security assessment.

[0003] In traditional technologies, enterprises often handle access control and security issues through static configuration and manual assistance: role-based access control requires administrators to manually adjust the association between roles and permissions, attribute-based access control requires preset attribute rules and manual review for changes, and risk scoring in zero-trust products is mostly used for post-event auditing or anomaly alerts, without participating in real-time decision-making for permission allocation.

[0004] However, these traditional methods have significant problems: rigid permission configurations make them difficult to adapt to cross-departmental collaboration or project changes, and they are prone to insufficient or excessive permissions; they rely on manual intervention, resulting in low efficiency in permission processing. In cross-departmental knowledge-sharing scenarios, automatically identifying the boundaries between knowledge needs and security risks remains a technical challenge. Summary of the Invention

[0005] Therefore, it is necessary to provide a method, device, computer equipment, storage medium, and computer program product for dynamic permission allocation that can reduce management costs and compliance risks, and has high scalability and scenario adaptability for cross-departmental knowledge sharing and secure isolation, in order to address the above-mentioned technical problems.

[0006] Firstly, this application provides a method for dynamic permission allocation that enables cross-departmental knowledge sharing and secure isolation, applied to a dynamic permission allocation system. The dynamic permission allocation system includes a user behavior analysis module, a knowledge demand assessment module, a dynamic permission calculation module, a strategy intelligent matching module, and a collaborative optimization control module. The method includes:

[0007] The user access logs are collected and preprocessed by the user behavior analysis module. The user behavior sequence is modeled by a recurrent neural network model on the preprocessed user access logs to obtain the behavior analysis results.

[0008] A knowledge graph is constructed by combining natural language processing and social network analysis technologies through a knowledge needs assessment module, and knowledge needs assessment results are generated based on the enterprise knowledge graph.

[0009] The optimal permission scheme is determined by combining the behavior analysis results and the knowledge demand assessment results through the permission dynamic calculation module.

[0010] The policy intelligent matching module matches appropriate security isolation policies from a preset policy library based on the user access context and the behavior analysis results.

[0011] The collaborative optimization control module performs real-time permission updates based on the optimal permission scheme and the security isolation policy.

[0012] In some embodiments of the method, the step of collecting and preprocessing user access logs through the user behavior analysis module includes:

[0013] Collect log data from user access logs, wherein the log data includes at least one of timestamp, accessed resource type, operation behavior, and access result information;

[0014] Perform data cleaning on the log data to remove duplicate logs, fill in missing fields, and filter invalid operation records;

[0015] The cleaned data is standardized according to a preset format and converted into structured data suitable for the input of a recurrent neural network model.

[0016] In some embodiments of the method, the construction of an enterprise knowledge graph through a knowledge requirements assessment module combined with natural language processing and social network analysis techniques includes:

[0017] Natural language processing technology is used to segment, identify entities, and extract topics from internal enterprise text data to determine knowledge entities.

[0018] By using social network analytics, we can statistically analyze the frequency of collaboration among users, information transmission paths, and the number of knowledge interactions to identify key nodes in knowledge dissemination.

[0019] A knowledge graph containing node attributes is constructed by using knowledge entities as knowledge nodes, users as user nodes, and collaborative interaction relationships as edges.

[0020] In some embodiments of the method, determining the optimal permission scheme by combining the behavior analysis results and the knowledge requirement assessment results through the permission dynamic calculation module includes:

[0021] We assign weights to roles based on priority, data sensitivity, and collaboration tightness, and then conduct a comprehensive evaluation to simulate the security risks and knowledge-sharing benefits under different permission settings, and select the optimal permission scheme.

[0022] In some embodiments of the method, the method further includes:

[0023] After matching the security isolation policy, a corresponding policy fit score is generated;

[0024] If the strategy fit score does not meet the fit conditions, the collaborative optimization control module drives the strategy intelligent matching module to re-select suboptimal strategies until the score meets the fit conditions.

[0025] In some embodiments of the method, the step of performing real-time permission updates by the collaborative optimization control module based on the optimal permission scheme and the security isolation policy includes:

[0026] Send permission configuration instructions to the permission management subsystem through the application programming interface and verify the effective status of the target user's permissions;

[0027] Generate a permission update log, recording the update time, the permission content before and after the update, and the triggering reason;

[0028] If the update fails, roll back to the valid permission configuration before the update and generate an alert message.

[0029] According to a second aspect of the present disclosure, a dynamic permission allocation device for cross-departmental knowledge sharing and secure isolation is provided. The device includes:

[0030] The first module is used to collect user access logs through the user behavior analysis module and preprocess them. The preprocessed user access logs are then modeled using a recurrent neural network model to obtain the behavior analysis results.

[0031] The second module is used to construct an enterprise knowledge graph by combining natural language processing and social network analysis technologies with the knowledge demand assessment module, and to generate knowledge demand assessment results based on the enterprise knowledge graph.

[0032] The third module is used to determine the optimal permission scheme by combining the behavior analysis results and the knowledge demand assessment results through the permission dynamic calculation module;

[0033] The fourth module is used to match a suitable security isolation policy from a preset policy library based on the user access context and the behavior analysis results through the policy intelligent matching module.

[0034] The fifth module is used to perform real-time permission updates based on the optimal permission scheme and the security isolation policy through the collaborative optimization control module.

[0035] According to a third aspect of the present disclosure, a computer device is provided. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program performing the following steps:

[0036] The user access logs are collected and preprocessed by the user behavior analysis module. The user behavior sequence is modeled by a recurrent neural network model on the preprocessed user access logs to obtain the behavior analysis results.

[0037] A knowledge graph is constructed by combining natural language processing and social network analysis technologies through a knowledge needs assessment module, and knowledge needs assessment results are generated based on the enterprise knowledge graph.

[0038] The optimal permission scheme is determined by combining the behavior analysis results and the knowledge demand assessment results through the permission dynamic calculation module.

[0039] The policy intelligent matching module matches appropriate security isolation policies from a preset policy library based on the user access context and the behavior analysis results.

[0040] The collaborative optimization control module performs real-time permission updates based on the optimal permission scheme and the security isolation policy.

[0041] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:

[0042] The user access logs are collected and preprocessed by the user behavior analysis module. The user behavior sequence is modeled by a recurrent neural network model on the preprocessed user access logs to obtain the behavior analysis results.

[0043] A knowledge graph is constructed by combining natural language processing and social network analysis technologies through a knowledge needs assessment module, and knowledge needs assessment results are generated based on the enterprise knowledge graph.

[0044] The optimal permission scheme is determined by combining the behavior analysis results and the knowledge demand assessment results through the permission dynamic calculation module.

[0045] The policy intelligent matching module matches appropriate security isolation policies from a preset policy library based on the user access context and the behavior analysis results.

[0046] The collaborative optimization control module performs real-time permission updates based on the optimal permission scheme and the security isolation policy.

[0047] According to a fifth aspect of the present disclosure, a computer program product is provided. The computer program product includes a computer program that, when executed by a processor, performs the following steps:

[0048] The user access logs are collected and preprocessed by the user behavior analysis module. The user behavior sequence is modeled by a recurrent neural network model on the preprocessed user access logs to obtain the behavior analysis results.

[0049] A knowledge graph is constructed by combining natural language processing and social network analysis technologies through a knowledge needs assessment module, and knowledge needs assessment results are generated based on the enterprise knowledge graph.

[0050] The optimal permission scheme is determined by combining the behavior analysis results and the knowledge demand assessment results through the permission dynamic calculation module.

[0051] The policy intelligent matching module matches appropriate security isolation policies from a preset policy library based on the user access context and the behavior analysis results.

[0052] The collaborative optimization control module performs real-time permission updates based on the optimal permission scheme and the security isolation policy.

[0053] The dynamic permission allocation scheme for cross-departmental knowledge sharing and secure isolation provided in this application uses a recurrent neural network model to model user behavior sequences, enabling accurate capture of user behavior characteristics. By combining natural language processing and social network analysis to construct an enterprise knowledge graph, it can accurately identify knowledge needs. Through dynamic calculation of the optimal permission scheme and matching security isolation strategies, it achieves real-time permission updates. This effectively solves the problems of rigid permission configuration and difficulty in adapting to cross-departmental collaboration needs in traditional permission management. While ensuring data security, it promotes efficient knowledge sharing, reduces reliance on manual intervention, and improves the efficiency and flexibility of permission management. It is suitable for permission management scenarios in complex architectures such as large enterprises and multinational organizations. It enables the transformation of permission allocation from traditional static configuration to dynamic intelligent control.

[0054] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0055] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure, and are not intended to unduly limit this disclosure.

[0056] Figure 1 This is a flowchart illustrating a method for dynamically allocating permissions for cross-departmental knowledge sharing and secure isolation, according to an exemplary embodiment.

[0057] Figure 2 This is a flowchart illustrating the steps of constructing an enterprise knowledge graph according to an exemplary embodiment;

[0058] Figure 3 This is a structural block diagram of a cross-departmental knowledge sharing and security isolation permission dynamic allocation device according to an exemplary embodiment;

[0059] Figure 4 This is a diagram illustrating the internal structure of a computer device according to an exemplary embodiment. Detailed Implementation

[0060] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0061] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure. The terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitations, the presence of other identical or equivalent elements in a process, method, product, or apparatus that includes said elements is not excluded. For example, the use of terms such as "first," "second," etc., to denote names does not indicate any specific order.

[0062] In some implementation schemes provided in this disclosure, the execution of the dynamic allocation method for cross-departmental knowledge sharing and secure isolation permissions can be controlled by a unified controller or by multiple controllers. These controllers may include controllers on local terminals or controllers on remote servers. In some implementations, the controllers on local terminals and servers may jointly assist in completing the dynamic allocation control processing for cross-departmental knowledge sharing and secure isolation permissions. The local terminals mentioned in this disclosure may include, but are not limited to, various robotic devices, in-vehicle devices, personal computers, laptops, smartphones, tablets, wearable devices, medical devices, VR (Virtual Reality) devices, etc. The servers may also be servers, server clusters, distributed subsystems, cloud processing platforms, servers containing blockchain nodes, and combinations thereof. The controllers described in this disclosure may include various control units capable of implementing logic processing functions, including but not limited to CPU (Central Processing Unit), PLC (Programmable Logic Controller), ECU (Electronic Control Unit), MCU (Microcontroller Unit), FPGA (Field Programmable Gate Array), and CPLD (Complex Programmable Logic Device), as well as controllers composed of one or more logic function units, chips, etc.

[0063] In some embodiments of this disclosure, a method for dynamic permission allocation with cross-departmental knowledge sharing and secure isolation is provided, applied to a dynamic permission allocation system. The dynamic permission allocation system includes a user behavior analysis module, a knowledge demand assessment module, a dynamic permission calculation module, a strategy intelligent matching module, and a collaborative optimization control module. Figure 1 As shown, it includes the following steps:

[0064] S20. Collect user access logs through the user behavior analysis module and preprocess them. Then, model the user behavior sequence using a recurrent neural network model on the preprocessed user access logs to obtain the behavior analysis results.

[0065] User access logs typically refer to information generated when users access or operate knowledge within an enterprise's internal systems. Recurrent Neural Networks (RNNs) are deep learning models capable of processing sequential data and possessing the ability to memorize temporal information. RNNs can be used to learn long-term behavioral sequence characteristics of users, thereby accurately identifying normal access patterns and abnormal behaviors, and obtaining behavioral analysis results.

[0066] S22. Construct an enterprise knowledge graph by combining natural language processing and social network analysis technologies through the knowledge needs assessment module, and generate knowledge needs assessment results based on the enterprise knowledge graph.

[0067] Natural Language Processing (NLP) is a technology used to process internal text data within enterprises. It can perform word segmentation, entity recognition, topic extraction, and topic mining on text materials such as meeting minutes and email correspondence, thereby identifying knowledge entities, recognizing popular topics and key issues, and providing text analysis support for building enterprise knowledge graphs and assessing knowledge needs.

[0068] Social network analytics is a technology used to uncover knowledge flow and collaborative relationships within an enterprise. By statistically analyzing the frequency of collaboration among users, tracing information transmission paths, and recording the number of knowledge interactions, it can create a knowledge exchange graph within the enterprise and identify key nodes in the knowledge dissemination process.

[0069] An enterprise knowledge graph is a structured representation of an enterprise's internal knowledge resources and personnel collaboration relationships. It can use various knowledge units within the enterprise as knowledge nodes, employees as user nodes, and the collaborative interactions between employees as edges connecting these nodes. It also includes attribute information for each node, such as the content category of the knowledge node and the role information of the user node, clearly demonstrating the distribution and flow of knowledge within the enterprise.

[0070] The knowledge needs assessment results are generated based on natural language processing and social network analysis technologies, combined with a constructed enterprise knowledge graph. It includes information such as knowledge needs trends across various departments and the distribution of knowledge assets. This provides guidance for dynamic adjustments to access permissions and helps management understand the company's knowledge resources through visual reports.

[0071] S24. The optimal permission scheme is determined by combining the behavior analysis results and the knowledge requirement assessment results through the permission dynamic calculation module.

[0072] The optimal permission scheme is determined by the dynamic permission calculation module, which combines behavioral analysis results with knowledge demand assessment results. During the determination process, weights can be assigned based on role priority, data sensitivity, and collaboration tightness, and a comprehensive score can be calculated. Simultaneously, the security risks and knowledge sharing benefits under different permission settings are simulated to ultimately select the permission scheme that maximizes knowledge sharing efficiency while ensuring data security.

[0073] S26. The policy intelligent matching module matches a suitable security isolation policy from the preset policy library based on the user access context and the behavior analysis results.

[0074] User access context refers to the relevant environmental information when a user accesses knowledge. The preset policy library is a pre-built collection of various security isolation policies. These policies can address different security needs, ranging from strict confidentiality to relaxed sharing. Each policy clearly defines the restrictions and permitted rules for data access under specific circumstances, providing a basis for subsequently matching and adapting policies based on actual scenarios.

[0075] Security isolation policies typically refer to a set of rules pre-defined in a policy library, covering different security scenarios ranging from strict confidentiality to relaxed sharing. They can intelligently match rules based on user behavior analysis, access context, and data sensitivity levels, ensuring data remains within boundaries and preventing data leaks while flexibly granting necessary knowledge access permissions.

[0076] S28. The collaborative optimization control module performs real-time permission updates based on the optimal permission scheme and the security isolation policy.

[0077] In some embodiments of this disclosure, user behavior sequences are modeled using recurrent neural network models, enabling accurate capture of user behavior characteristics; enterprise knowledge graphs are constructed by combining natural language processing and social network analysis, accurately identifying knowledge needs; and real-time permission updates are achieved through dynamic calculation of optimal permission schemes and matching security isolation strategies. This effectively solves the problems of rigid permission configuration and difficulty in adapting to cross-departmental collaboration needs in traditional permission management. While ensuring data security, it promotes efficient knowledge sharing, reduces reliance on manual intervention, and improves the efficiency and flexibility of permission management. It is suitable for permission management scenarios in complex architectures such as large enterprises and multinational organizations. It enables the transformation of permission allocation from traditional static configuration to dynamic intelligent control.

[0078] In some embodiments of this disclosure, S20 includes:

[0079] Collect log data from user access logs, wherein the log data includes at least one of timestamp, accessed resource type, operation behavior, and access result information;

[0080] Perform data cleaning on the log data to remove duplicate logs, fill in missing fields, and filter invalid operation records;

[0081] The cleaned data is standardized according to a preset format and converted into structured data suitable for the input of a recurrent neural network model.

[0082] In some implementations, log data may include information such as the time of user access, the specific type of resource accessed, the operation performed, and whether the operation was ultimately successful. This information serves as the basic data source for subsequent analysis of user behavior patterns.

[0083] In some examples, when processing user access data through a user behavior analysis module, relevant information can be collected from user access logs. This log data is then preprocessed. During preprocessing, duplicate log entries are removed, missing fields are supplemented, and invalid operation records, such as meaningless records generated by erroneous operations, are filtered out. After data cleaning, the data is standardized according to a pre-defined format, converting unstructured or semi-structured data into structured data suitable for the input requirements of a recurrent neural network (RNN) model. Subsequently, the RNN model is used to model and analyze the processed user behavior sequences. By learning users' long-term access habits and behavioral characteristics, the model identifies normal access patterns and abnormal behaviors that deviate from normal patterns, ultimately generating behavioral analysis results that provide a behavioral basis for subsequent permission adjustments.

[0084] In some embodiments of this disclosure, data cleaning removes redundant and invalid data, preventing these data from interfering with the accuracy of model building; data standardization ensures that the data can adapt to the input requirements of the recurrent neural network model, laying the foundation for the model to accurately analyze user behavior sequences; through these operations, the accuracy of behavior analysis results is improved, making subsequent permission adjustments based on behavior analysis more targeted, reducing permission allocation deviations caused by data quality issues, and further ensuring the reliability of permission management.

[0085] In some embodiments of this disclosure, reference is made to Figure 2 S22 includes:

[0086] S222. Use natural language processing technology to segment, identify entities, and extract topics from internal enterprise text data to determine knowledge entities;

[0087] S224. Use social network analysis technology to statistically analyze the frequency of collaboration among users, information transmission paths, and the number of knowledge interactions to identify key nodes in knowledge dissemination.

[0088] S226. Construct an enterprise knowledge graph containing node attributes, with knowledge entities as knowledge nodes, users as user nodes, and collaborative interaction relationships as edges.

[0089] In some implementations, natural language processing (NLP) techniques can be used to process internal enterprise text data, including text segmentation, knowledge entity identification, and text topic extraction. These operations help identify core knowledge entities within the enterprise. Simultaneously, social network analytics can be used to analyze the frequency of collaboration among employees, trace the paths of information transmission between employees, and record the number of knowledge interactions. This data helps identify key nodes in the knowledge dissemination process—employees who frequently participate in knowledge sharing or transmission. By using identified knowledge entities as knowledge nodes, enterprise employees as user nodes, and collaborative interactions between employees as edges connecting nodes, an enterprise knowledge graph containing node attributes can be constructed. Based on this enterprise knowledge graph, the distribution of enterprise knowledge and the impact of personnel collaboration on knowledge flow can be clearly understood, thereby analyzing the knowledge acquisition needs of various departments or employees and generating knowledge demand assessment results.

[0090] In some embodiments of this disclosure, natural language processing technology can accurately identify knowledge entities, ensuring the accuracy of knowledge nodes; social network analysis technology is used to identify key nodes in knowledge dissemination, clearly understanding the flow path of knowledge within the enterprise. The constructed enterprise knowledge graph can intuitively present the relationship between knowledge resources and personnel collaboration. The knowledge demand assessment results generated based on this are more in line with the actual business needs of the enterprise, avoiding the bias of subjective judgment in previous knowledge demand assessments. This enables subsequent permission allocation to more accurately match knowledge needs, satisfying users' knowledge acquisition needs while avoiding unnecessary permission granting, thus balancing knowledge sharing and data security.

[0091] In some embodiments of this disclosure, S24 includes:

[0092] We assign weights to roles based on priority, data sensitivity, and collaboration tightness, and then conduct a comprehensive evaluation to simulate the security risks and knowledge-sharing benefits under different permission settings, and select the optimal permission scheme.

[0093] In some implementations, weights can be assigned based on key factors influencing permission allocation, such as role priority, data sensitivity, and collaboration tightness, according to the enterprise's actual business situation and security requirements. Role priority is determined by the importance of an employee's responsibilities within the organizational structure; data sensitivity is categorized based on the confidentiality level of the data itself; and collaboration tightness is assessed based on the frequency of employees participating in joint projects or collaborations. These factors, combined with their corresponding weights, can be comprehensively scored. Simultaneously, the potential security risks under different permission settings can be simulated. By comparing and analyzing the risks and benefits of different permission schemes, the optimal permission scheme can be selected that maximizes knowledge-sharing efficiency while ensuring security.

[0094] In some embodiments of this disclosure, the weight setting ensures that different influencing factors can play a corresponding role in the allocation of permissions according to the actual needs of the enterprise. For example, the weight of data sensitivity can be increased for highly sensitive data to prioritize security. Risk and benefit simulation can predict the actual effect of different permission schemes in advance, avoiding the security risks or insufficient sharing problems that may be caused by blindly allocating permissions. The generated optimal permission scheme not only meets the enterprise's security standards, but also maximizes the efficiency improvement brought by knowledge sharing, effectively solving the problems of over-authorization or insufficient permissions in traditional permission allocation.

[0095] In some embodiments of this disclosure, the method further includes:

[0096] After matching the security isolation policy, a corresponding policy fit score is generated;

[0097] If the strategy fit score does not meet the fit conditions, the collaborative optimization control module drives the strategy intelligent matching module to re-select suboptimal strategies until the score meets the fit conditions.

[0098] In some implementations, the user access context includes the device status used by the user when making the access, such as whether the device has been securely authenticated, its geographical location, and the time period of access. This contextual information can be combined with previously obtained behavioral analysis results to select security isolation policies that meet the needs of the current scenario from a pre-defined policy library.

[0099] In some examples, after a preliminary strategy is matched, its suitability with the current scenario is evaluated, generating a strategy suitability score. If the score does not meet the preset suitability criteria, the collaborative optimization control module will re-select suboptimal strategies from the strategy library and re-evaluate them until a strategy with a score that meets the suitability criteria is found. This ensures that the matched security isolation strategy can both protect data security and avoid unduly restricting knowledge sharing.

[0100] In some embodiments of this disclosure, when the initially matched policy does not meet the adaptation conditions, it is re-selected under the drive of the collaborative optimization control module, avoiding security vulnerabilities or sharing restrictions caused by insufficient policy adaptation. This dynamically adjusted policy matching method allows the security isolation policy to flexibly adapt to different access scenarios. For example, a stricter policy can be matched when the user is in an untrusted geographical location, while a relatively lenient policy can be matched in an internal security environment, further enhancing the protection of data security and providing a more reasonable environment for knowledge sharing.

[0101] In some embodiments of this disclosure, S28 includes:

[0102] Send permission configuration instructions to the permission management subsystem through the application programming interface and verify the effective status of the target user's permissions;

[0103] Generate a permission update log, recording the update time, the permission content before and after the update, and the triggering reason;

[0104] If the update fails, roll back to the valid permission configuration before the update and generate an alert message.

[0105] In some implementations, when the collaborative optimization control module performs real-time permission updates, it first sends permission configuration instructions, generated based on the optimal permission scheme and security isolation strategy, to the enterprise's permission management subsystem via an application programming interface (API). After sending the instructions, it can promptly verify whether the target user's permissions have been successfully updated and taken effect according to the instructions, ensuring that the permission configuration accurately applies to the user. Simultaneously, a permission update log is generated, detailing the time of the permission update, the user's permissions before the update, the permissions after the update, and the reason for triggering the update, such as whether it was based on changes in user behavior or adjustments to knowledge requirements, for subsequent auditing and traceability. If a failure occurs during the permission update process, such as a system malfunction causing the configuration to fail to apply, the module immediately rolls back the user's permissions to the valid configuration state before the update, preventing permission anomalies from affecting the user's normal work. It also generates alarm information to notify relevant administrators for timely investigation and resolution of the issues causing the update failure.

[0106] In some embodiments of this disclosure, the sending of application programming interface (API) instructions ensures that permission configurations can be quickly transmitted to the permission management subsystem; the effectiveness status verification avoids management vulnerabilities caused by permission configurations not actually taking effect; update log recording provides a basis for subsequent auditing and troubleshooting; the failure rollback mechanism prevents permission anomalies from affecting user work, and alarm information can promptly remind administrators to handle problems. These operations collectively ensure the reliability and security of permission updates, reduce business interruptions or data security risks caused by abnormal situations during the permission update process, and improve the stability of the entire permission management system.

[0107] This disclosure provides several methods for dynamic permission allocation in cross-departmental knowledge sharing and secure isolation. By modeling user behavior sequences using recurrent neural networks, it can accurately capture user behavior characteristics. Combining natural language processing and social network analysis to construct an enterprise knowledge graph, it can accurately identify knowledge needs. Through dynamic calculation of the optimal permission scheme and matching security isolation strategies, it achieves real-time permission updates. This effectively solves the problems of rigid permission configuration and difficulty in adapting to cross-departmental collaboration needs in traditional permission management. While ensuring data security, it promotes efficient knowledge sharing, reduces reliance on manual intervention, and improves the efficiency and flexibility of permission management. It is suitable for permission management scenarios in complex architectures such as large enterprises and multinational organizations. It enables the transformation of permission allocation from traditional static configuration to dynamic intelligent control.

[0108] It is understood that the various embodiments of the methods described in this specification are presented in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. Related details can be found in the descriptions of other method embodiments.

[0109] It should be understood that although the steps in the flowcharts shown in the accompanying drawings are displayed sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in the accompanying drawings may include multiple steps or stages, which are not necessarily completed at the same time, but may be executed at different times, and the execution order of these steps or stages is not necessarily sequential, but may be performed alternately or in turn with other steps or at least a portion of the steps or stages of other steps.

[0110] Based on the description of the above-described embodiments of the dynamic permission allocation method for cross-departmental knowledge sharing and security isolation, this disclosure also provides a device for implementing the aforementioned dynamic permission allocation method for cross-departmental knowledge sharing and security isolation. The device may include a system (including a distributed system), software (application), module, component, controller, server, terminal, etc., using the method described in the embodiments of this specification, combined with necessary hardware implementation. Based on the same innovative concept, the devices in one or more embodiments provided in this disclosure are as described in the following embodiments. Since the implementation schemes and methods for solving the problem by the devices are similar, the implementation of specific devices in the embodiments of this specification can refer to the implementation of the aforementioned method, and repeated details will not be repeated. As used below, the terms "unit" or "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0111] Figure 3 This is a schematic block diagram illustrating a dynamic permission allocation device for cross-departmental knowledge sharing and secure isolation, according to an exemplary embodiment. The device can be the aforementioned terminal, a server, or a module, component, device, control unit, etc., integrated into the terminal. For details, please refer to... Figure 3 The device 100 may include: a first module 120, a second module 140, a third module 160, a fourth module 180, and a fifth module 190. Specifically, the first module 120 is used to collect and preprocess user access logs through a user behavior analysis module, and then use a recurrent neural network model to model user behavior sequences from the preprocessed user access logs to obtain behavior analysis results; the second module 140 is used to construct an enterprise knowledge graph using a knowledge demand assessment module combined with natural language processing and social network analysis technologies, and generate knowledge demand assessment results based on the enterprise knowledge graph; the third module 160 is used to determine the optimal permission scheme by combining the behavior analysis results and the knowledge demand assessment results through a dynamic permission calculation module; the fourth module 180 is used to match an appropriate security isolation policy from a preset policy library based on the user access context and the behavior analysis results through a policy intelligent matching module; and the fifth module 190 is used to perform real-time permission updates based on the optimal permission scheme and the security isolation policy through a collaborative optimization control module.

[0112] In some embodiments of the device, the first module 120 is further configured to collect log data from user access logs, the log data including at least one of timestamp, access resource type, operation behavior and access result information; and to perform data cleaning on the log data, removing duplicate logs, completing missing fields, and filtering invalid operation records; and to standardize the cleaned data according to a preset format, converting it into structured data that is compatible with the input of a recurrent neural network model.

[0113] In some embodiments of the device, the second module 140 is also used to perform word segmentation, entity recognition, and topic extraction on internal enterprise text data using natural language processing technology to determine knowledge entities; and to use social network analysis technology to statistically analyze the frequency of collaboration between users, information transmission paths, and the number of knowledge interactions to identify key nodes in knowledge dissemination; and to construct an enterprise knowledge graph containing node attributes with knowledge entities as knowledge nodes, users as user nodes, and collaborative interaction relationships as edges.

[0114] In some embodiments of the device, the third module 160 is also used to set weights and perform comprehensive scoring according to role priority, data sensitivity, and collaboration tightness, to simulate the security risks and knowledge sharing benefits under different permission settings, and to select the optimal permission scheme.

[0115] In some embodiments of the device, the fourth module 180 is further configured to generate a corresponding policy fit score after matching a security isolation policy; and to drive the policy intelligent matching module to re-select suboptimal policies through the collaborative optimization control module when the policy fit score does not meet the fit conditions, until the score meets the fit conditions.

[0116] In some embodiments of the device, the fifth module 190 is also used to send permission configuration instructions to the permission management subsystem through the application programming interface and verify the permission status of the target user; and to generate a permission update log, recording the update time, permission content before and after the update, and the triggering reason; and to roll back to the valid permission configuration before the update and generate alarm information in the event of update failure.

[0117] The modules in the aforementioned cross-departmental knowledge sharing and secure isolation permission dynamic allocation device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the computer device's memory as software, so that the processor can invoke and execute the operations corresponding to each module.

[0118] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 4As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements a dynamic permission allocation method for cross-departmental knowledge sharing and secure isolation.

[0119] Those skilled in the art will understand that Figure 4 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0120] Based on the foregoing description of the relevant methods and apparatus embodiments, this disclosure also provides a computer device, including a memory and a processor. The memory stores a computer program, which, when executed by the processor, implements the dynamic permission allocation method for cross-departmental knowledge sharing and security isolation as described in any embodiment of this specification.

[0121] Based on the foregoing description of the relevant methods and apparatus embodiments, this disclosure also provides a computer-readable storage medium that, when the instructions in the computer-readable storage medium are executed by the processor of a computer device, enables the computer device to implement the cross-departmental knowledge sharing and security isolation permission dynamic allocation method as described in any embodiment of this disclosure.

[0122] Based on the foregoing description of the relevant methods and apparatus embodiments, this disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the dynamic permission allocation method for cross-departmental knowledge sharing and security isolation as described in any embodiment of this specification.

[0123] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on its differences from other embodiments. In particular, hardware + program embodiments are relatively simple in description because they are fundamentally similar to method embodiments; relevant parts can be referred to the descriptions in the method embodiments.

[0124] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0125] It should be noted that the apparatus, computer equipment, storage medium, and computer program products described above may also include other implementation methods according to the description of the method embodiments. Specific implementation methods can be found in the description of the relevant method embodiments. Furthermore, new embodiments formed by combinations of features from various methods, apparatuses, devices, and server embodiments still fall within the scope of this disclosure and will not be elaborated upon here.

[0126] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, when implementing one or more of these specifications, the functions of each module can be implemented in the same or different software and / or hardware, or a module that performs the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are merely illustrative. For example, the division of modules or units is only a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling and communication connections between the devices or units shown or described can be implemented through direct and / or indirect coupling / connection, through standard or custom interfaces or protocols, and can be implemented electrically, mechanically, or in other forms.

[0127] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the following claims.

[0128] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope.

Claims

1. A method for dynamically allocating permissions for cross-departmental knowledge sharing and secure isolation, characterized in that, The method is applied to a dynamic permission allocation system, which includes a user behavior analysis module, a knowledge requirement assessment module, a dynamic permission calculation module, a strategy intelligent matching module, and a collaborative optimization control module. The user access logs are collected and preprocessed by the user behavior analysis module. The user behavior sequence is modeled by a recurrent neural network model on the preprocessed user access logs to obtain the behavior analysis results. A knowledge graph is constructed by combining natural language processing and social network analysis technologies through a knowledge needs assessment module, and knowledge needs assessment results are generated based on the enterprise knowledge graph. The optimal permission scheme is determined by combining the behavior analysis results and the knowledge demand assessment results through the permission dynamic calculation module. The policy intelligent matching module matches appropriate security isolation policies from a preset policy library based on the user access context and the behavior analysis results. The collaborative optimization control module performs real-time permission updates based on the optimal permission scheme and the security isolation policy.

2. The method according to claim 1, characterized in that, The step of collecting and preprocessing user access logs through the user behavior analysis module includes: Collect log data from user access logs, wherein the log data includes at least one of timestamp, accessed resource type, operation behavior, and access result information; Perform data cleaning on the log data to remove duplicate logs, fill in missing fields, and filter invalid operation records; The cleaned data is standardized according to a preset format and converted into structured data suitable for the input of a recurrent neural network model.

3. The method according to claim 1, characterized in that, The construction of an enterprise knowledge graph through a knowledge needs assessment module combined with natural language processing and social network analysis technologies includes: Natural language processing technology is used to segment, identify entities, and extract topics from internal enterprise text data to determine knowledge entities. By using social network analytics, we can statistically analyze the frequency of collaboration among users, information transmission paths, and the number of knowledge interactions to identify key nodes in knowledge dissemination. A knowledge graph containing node attributes is constructed by using knowledge entities as knowledge nodes, users as user nodes, and collaborative interaction relationships as edges.

4. The method according to claim 1, characterized in that, The step of determining the optimal permission scheme by combining the behavior analysis results and the knowledge demand assessment results through the permission dynamic calculation module includes: We assign weights to roles based on priority, data sensitivity, and collaboration tightness, and then conduct a comprehensive evaluation to simulate the security risks and knowledge-sharing benefits under different permission settings, and select the optimal permission scheme.

5. The method according to claim 1, characterized in that, The method further includes: After matching the security isolation policy, a corresponding policy fit score is generated; If the strategy fit score does not meet the fit conditions, the collaborative optimization control module drives the strategy intelligent matching module to re-select suboptimal strategies until the score meets the fit conditions.

6. The method according to claim 1, characterized in that, The step of performing real-time permission updates through the collaborative optimization control module based on the optimal permission scheme and the security isolation policy includes: Send permission configuration instructions to the permission management subsystem through the application programming interface and verify the effective status of the target user's permissions; Generate a permission update log, recording the update time, the permission content before and after the update, and the triggering reason; If the update fails, roll back to the valid permission configuration before the update and generate an alert message.

7. A dynamic permission allocation device for cross-departmental knowledge sharing and secure isolation, characterized in that, The device includes: The first module is used to collect user access logs through the user behavior analysis module and preprocess them. The preprocessed user access logs are then modeled using a recurrent neural network model to obtain the behavior analysis results. The second module is used to construct an enterprise knowledge graph by combining natural language processing and social network analysis technologies with the knowledge demand assessment module, and to generate knowledge demand assessment results based on the enterprise knowledge graph. The third module is used to determine the optimal permission scheme by combining the behavior analysis results and the knowledge demand assessment results through the permission dynamic calculation module; The fourth module is used to match a suitable security isolation policy from a preset policy library based on the user access context and the behavior analysis results through the policy intelligent matching module. The fifth module is used to perform real-time permission updates based on the optimal permission scheme and the security isolation policy through the collaborative optimization control module.

8. A computer device, characterized in that, It includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, It stores a computer program thereon, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the steps of the method according to any one of claims 1 to 6.

Images