Artificial intelligence-based system for automatic generation and dynamic control of user-specific access authorization

Abstract

The present invention relates to an artificial intelligence-based system for the automatic generation and dynamic control of user-specific access rights. The objective of the invention is to simultaneously ensure security and flexibility by integrally analyzing user information, access history information, and access control policy information, automatically generating user-specific access right profiles based on the learning of normal access patterns and the analysis of anomalies and risks, and dynamically adjusting access rights according to policy verification and changes in circumstances. For example, an AI-based automatic generation and dynamic control system for user-specific access rights is disclosed, comprising: a data management unit that manages integrated data including user information, access history information, and access control policy information; an authority determination unit that performs AI analysis based on the integrated data managed by the data management unit to generate an access authority profile indicating the scope of access allowed for each user; and an authority control unit that sets user-specific access rights using the access authority profile generated by the authority determination unit and controls access according to the set access rights.

Description

Technology Field

[0001] Embodiments of the present invention relate to the field of artificial intelligence-based access control technology, and more specifically, to an artificial intelligence-based system for automatically generating and dynamically controlling user-specific access rights, which integrates and analyzes user information, access history information, and access control policy information to automatically generate a range of allowed access for each user and dynamically control the generated access rights. Background Technology

[0002] Recently, environments requiring the simultaneous management of physical access control and information system access control are increasing in corporations, public institutions, and various facilities demanding security. In such environments, it is crucial to precisely control the permitted space, time, and access levels for each user, and to achieve this, access control systems and entry control systems are being operated in combination.

[0003] Conventional access control systems have primarily operated by setting user-specific access rights based on policies predefined by administrators. For example, it is common practice to collectively grant access to specific areas to users belonging to a particular department or to restrict access times based on working hours. However, this approach has limitations as it fails to reflect individual user behavioral characteristics or actual usage patterns and operates solely on a static rule-based system.

[0004] In particular, despite the continuous accumulation of user-specific access history data, conventional systems utilize this data only for simple recording or post-audit purposes, and the functionality to dynamically redesign access rights based on this data is provided only in a limited manner. As a result, inefficient permission management issues may arise, such as the excessive granting of access rights that are rarely used in practice, or conversely, the restriction of necessary access.

[0005] Furthermore, from a security perspective, existing access control methods allow or block access based solely on whether predefined policies have been violated; consequently, they lack the capability to detect abnormal user behavior in advance and adjust permissions accordingly. For instance, this can lead to issues where access is permitted simply because the policy is satisfied, even if a user accesses the system at an unusual time or exhibits abnormal movement patterns.

[0006] Furthermore, as diverse user characteristics and access environments have recently become increasingly complex, managing permissions with simple rule-based access control alone is becoming difficult for granular and flexible control. Unless various factors such as user roles, work characteristics, access frequency, and usage patterns by time of day are comprehensively considered, security risks resulting from excessive authorization and decreased work efficiency due to excessive restrictions may occur simultaneously.

[0007] Meanwhile, with the advancement of artificial intelligence, technologies that analyze large volumes of user behavior data to learn patterns and perform predictions and decision-making based on this are being applied in various fields. However, conventional access control systems have not been able to sufficiently implement technologies that automatically generate user-specific access rights or dynamically adjust them according to changing circumstances through such AI-based analysis.

[0008] Therefore, there is an increasing need for technology that can comprehensively analyze user information, access history, and access control policy information, automatically generate access rights by reflecting user-specific access patterns and risk levels, and dynamically control the generated access rights according to the situation. Prior art literature

[0009] Registered Patent Publication No. 10-1564046 (Registration Date: October 27, 2015) Registered Patent Publication No. 10-1017588 (Registration Date: February 23, 2011) The problem to be solved

[0010] An embodiment of the present invention provides an artificial intelligence-based automatic generation of user-specific access rights and dynamic control system capable of automatically deriving the scope of access permission for each user by integrally analyzing user information, access history information, and access control policy information, and generating an access authority profile based thereon.

[0011] In addition, it provides an AI-based automatic user access control and dynamic control system that learns normal access patterns from user access history and quantitatively analyzes the abnormality and risk level of user behavior to determine both the permitted scope of access rights and the required authentication level.

[0012] In addition, it provides an AI-based automatic user access control generation and dynamic control system that can simultaneously ensure security and flexibility by verifying whether generated access rights satisfy access control policy conditions and dynamically adjusting access rights in the event of policy violations or abnormal situations. means of solving the problem

[0013] An artificial intelligence-based automatic generation and dynamic control system for user-specific access rights according to an embodiment of the present invention comprises: a data management unit that manages integrated data including user information, access history information, and access control policy information; an authority determination unit that performs artificial intelligence analysis based on the integrated data managed by the data management unit to calculate an access right profile indicating the scope of access allowed for each user; and an authority control unit that sets user-specific access rights using the access right profile calculated by the authority determination unit and controls access according to the set access rights.

[0014] Additionally, the data management unit may include: a user information collection unit that collects user information including at least one of user identification information, department information, job title information, working hours information, and security level information; an access history collection unit that collects access history information including at least one of access time, access location, authentication method, authentication success status, number of authentication failures, time of stay, and sequence of movement paths; and a data integration unit that generates integrated data at the user level by combining the user information collected by the user information collection unit and the access history information collected by the access history collection unit based on a user identification value.

[0015] Additionally, the data management unit may further include a time series sorting unit that sorts the integrated data generated by the data integration unit in chronological order to form user-specific access time series data; and a data refinement unit that generates analyzable refined data by performing at least one of missing value correction, outlier removal, and data consistency verification using the access time series data formed by the time series sorting unit.

[0016] Additionally, the data management unit may further include a behavioral feature generation unit that calculates at least one of user-specific access frequency, time-specific access ratio, area dwell time, and movement path pattern as a quantitative value based on refined data generated by the data refinement unit; and a feature normalization unit that converts the quantitative value calculated by the behavioral feature generation unit to the same scale so that it can be compared between users and transmits it to the authority determination unit.

[0017] Additionally, the authority determination unit may include: a clustering operation unit that converts user-specific attribute values ​​into vector form using integrated data managed by the data management unit and performs similarity calculations between the converted vectors to form user groups; a suitability calculation unit that calculates probability values ​​for access allowed zones and access allowed time zones for a specific user using the access history distribution of users included in the user groups formed by the clustering operation unit; a risk calculation unit that calculates at least one indicator among user-specific authentication failure rate, night access rate, and abnormal zone access rate using integrated data managed by the data management unit, and calculates a risk score by applying a preset weight to the calculated indicator; and a profile generation unit that generates an access authority profile including user-specific access allowed zones, access allowed time zones, and authentication required levels by deriving user-specific access candidate zones and access candidate time zones using the probability values ​​calculated by the suitability calculation unit, and determining whether to adopt the access candidate zones and access candidate time zones and the authentication requirement level using the risk score calculated by the risk calculation unit.

[0018] Additionally, the authorization determination unit may further include a pattern learning unit that learns normal access patterns for each user by inputting integrated data managed by the data management unit into a time-series-based model; and an anomaly detection unit that calculates a deviation value by quantifying the difference between the data corresponding to the current access attempt and the normal access pattern learned by the pattern learning unit, and determines an abnormal access if the calculated deviation value exceeds a preset threshold value.

[0019] Additionally, the authority determination unit may further include an initial authority generation unit that, for users whose access history is less than a preset threshold amount, calculates probability values ​​and risk scores for access allowed zones and access allowed time periods through the suitability calculation unit and the risk calculation unit using the access history distribution of user groups formed by the clustering operation unit, and generates an initial access authority profile using the calculation results.

[0020] Additionally, the authority control unit may include: an authority setting unit that sets an access allowance zone, an access allowance time zone, and an authentication requirement level as user-specific access rights based on an access authority profile generated by the authority determination unit; a policy verification unit that determines whether the access rights set by the authority setting unit satisfy policy conditions using access control policy information managed by the data management unit; and an authority confirmation unit that determines the final access rights by maintaining or modifying the access rights set by the authority setting unit according to the determination result of the policy verification unit, and applies the determined access rights to the access control target.

[0021] In addition, the above-mentioned authority control unit may further include an authority adjustment unit that reduces the access allowance zone set in the access authority profile, restricts the access allowance time period, or raises the authentication requirement level when the policy verification unit determines that there is a policy violation.

[0022] In addition, the above-mentioned authority control unit may further include an abnormal response unit that temporarily restricts access rights for the user, blocks access to specific areas, or requires additional authentication procedures when the policy verification unit determines that there is a policy violation.

[0023] Additionally, the system further includes an event detection unit that detects at least one of changes in user information, organizational transfer, changes in working hours, changes in project assignment, and changes in access control policies, and the authority determination unit regenerates an access authority profile based on the change information detected by the event detection unit, and the authority control unit can update access authority based on the access authority profile regenerated by the authority determination unit.

[0024] In addition, it may further include an audit log storage unit that stores at least one of the access rights confirmed by the authority control unit, the access rights change history, the policy verification result, and the abnormal access judgment result. Effects of the invention

[0025] According to the present invention, by integrally analyzing user information, access history information, and access control policy information to automatically generate user-specific access rights, the accuracy and efficiency of setting rights can be improved compared to conventional static rule-based access control methods.

[0026] Furthermore, by determining allowed access zones, permitted time periods, and authentication requirements based on individual user access patterns and behavioral characteristics, balanced access control becomes possible that reduces security risks caused by excessive privilege granting while smoothly allowing necessary access.

[0027] In addition, by reflecting abnormal signs of user behavior in real time to restrict access rights or require additional authentication, abnormal access attempts can be blocked in advance, thereby strengthening the security level.

[0028] In addition, since access rights can be automatically updated by reflecting events such as changes in user information, organizational transfers, and policy changes, a dynamic permission management system can be implemented to maintain up-to-date access rights while minimizing administrator intervention.

[0029] In addition, by systematically recording and managing the history of access rights settings and changes, transparency and traceability of access control can be ensured, and security audits and regulatory responses can be performed efficiently. Brief explanation of the drawing

[0030] FIG. 1 is a schematic diagram showing a hardware-based implementation example of an artificial intelligence-based automatic user access authority generation and dynamic control system according to an embodiment of the present invention. FIG. 2 is a flowchart illustrating a method for automatically generating user-specific access rights according to an embodiment of the present invention. FIG. 3 is a flowchart illustrating a method for detecting abnormal entry / exit patterns and strengthening authentication according to an embodiment of the present invention. FIG. 4 is a block diagram showing the overall configuration of an artificial intelligence-based automatic user access authority generation and dynamic control system according to an embodiment of the present invention. FIG. 5 is a block diagram showing the detailed configuration of a data management unit according to an embodiment of the present invention. FIG. 6 is a block diagram showing the detailed configuration of the authority determination unit according to an embodiment of the present invention. FIG. 7 is a block diagram showing the detailed configuration of an authorization control unit according to an embodiment of the present invention. Specific details for implementing the invention

[0031] The terms used in this specification will be briefly explained, and the invention will be described in detail.

[0032] The terms used in this invention have been selected based on currently widely used general terms, taking into account their functions within the invention; however, these terms may vary depending on the intent of those skilled in the art, case law, the emergence of new technologies, etc. Additionally, in specific cases, terms have been arbitrarily selected by the applicant, and in such cases, their meanings will be described in detail in the relevant description of the invention. Therefore, the terms used in this invention should be defined not merely by their names, but based on their meanings and the overall content of the invention.

[0033] When a part of a specification is described as "comprising" a certain component, this means that, unless specifically stated otherwise, it does not exclude other components but may include additional components. Furthermore, terms such as "...part" or "module" as used in the specification refer to a unit that processes at least one function or operation, and this may be implemented in hardware or software, or as a combination of hardware and software.

[0034] Embodiments of the present invention are described below with reference to the attached drawings so that those skilled in the art can easily implement them. However, the present invention may be embodied in various different forms and is not limited to the embodiments described herein. Furthermore, in order to clearly explain the present invention in the drawings, parts unrelated to the explanation have been omitted, and similar parts throughout the specification are denoted by similar reference numerals.

[0035] FIG. 1 is a schematic diagram showing a hardware-based implementation example of an artificial intelligence-based automatic user access authority generation and dynamic control system according to an embodiment of the present invention.

[0036] Referring to FIG. 1, the artificial intelligence-based automatic user access authority generation and dynamic control system (1000) according to the present embodiment may be implemented by including a personnel linkage server (10), a central processing server (20), an access control terminal (30), an authentication device (40), and an electronic locking device (50), and may form an integrated control flow that automatically generates user access authority by performing artificial intelligence analysis based on user information and access history information, and dynamically controls access according to the generated access authority.

[0037] The above-mentioned HR linkage server (10) can be implemented as a system that generates, stores, and manages user information and personnel data within an organization. For example, the HR linkage server (10) can be implemented as a corporate HR system server, an ERP system, a cloud-based HR management server, or a database server. This HR linkage server (10) can generate or modify user information such as user identification information, department information, job title information, working hours information, and security level information, and can manage events such as new user registration, user information modification, and user deletion. Additionally, the HR linkage server (10) can transmit changes to user information to a central processing server (20) and receive results of granting, changing, or revoking user-specific access rights from the central processing server (20) to reflect in internal data.

[0038] The central processing server (20) described above may be implemented as a device that performs core computation and control of the system (1000). For example, the central processing server (20) may be implemented as a server computer including one or more processors and memory, a cloud-based computation instance, or a distributed server cluster. This central processing server (20) may receive user and organization information from the personnel linkage server (10) and may collect device status, access history, and event information from the access control terminal (30). In addition, the central processing server (20) may integrate the collected data to form integrated data for each user, analyze user access patterns based on the integrated data, and calculate the allowed access range and risk level using an artificial intelligence model. Furthermore, the central processing server (20) may generate an access authority profile including an allowed access zone, an allowed access time zone, and an authentication requirement level, and may set user-specific access rights based on the generated access authority profile and transmit them to the access control terminal (30).

[0039] The access control terminal (30) described above can be implemented as a field device that controls user access in an actual access control environment. For example, the access control terminal (30) can be implemented as an access control terminal, keypad terminal, card reader, or network-connected access control device installed at a building entrance. This access control terminal (30) can receive user-specific access rights and policy information from a central processing server (20), and can generate a user authentication request and transmit it to an authentication device (40). Additionally, the access control terminal (30) can control the operation of an electronic lock device (50) according to the authentication result, and can transmit access attempt history, device status information, and event information to the central processing server (20).

[0040] The authentication device (40) may be implemented as an authentication means for verifying the identity of a user. For example, the authentication device (40) may be implemented as at least one of a fingerprint recognition device, a face recognition camera, an RFID card reader, a mobile authentication device, or a biometric-based authentication device. Such an authentication device (40) may receive an authentication request from an access control terminal (30), perform user authentication, and generate an authentication success or failure result and user identification information. Additionally, the authentication device (40) may transmit the generated authentication result to the access control terminal (30).

[0041] The above electronic locking device (50) can be implemented as a device that controls physical access. For example, the electronic locking device (50) can be implemented as a door lock, an electronic lock module, an electric solenoid lock, or a motor-driven lock. Such an electronic locking device (50) can receive a command to unlock or maintain the lock from an access control terminal (30), and can open the door or maintain the locked state according to the command. In addition, the electronic locking device (50) can transmit lock status, error status, and operation status information to a central processing server (20) through the access control terminal (30).

[0042] Hereinafter, the overall operation process of the artificial intelligence-based user-specific access authority automatic generation and dynamic control system according to the present embodiment will be described with reference to FIGS. 2 and 3.

[0043] FIG. 2 is a flowchart illustrating a method for automatically generating user-specific access rights according to an embodiment of the present invention.

[0044] First, the artificial intelligence-based automatic user access authority generation and dynamic control system (1000) according to the present embodiment can collect and store data when personnel change data occurs. In this step, personnel-related events such as the new registration, change, or deletion of user information are detected, and the information can be reflected within the system. Subsequently, access history data can be collected, which may include various behavioral information such as the user's past access times, locations, authentication methods, and movement paths.

[0045] Next, security policy information may be referenced based on the collected data. This security policy information may include policy rules such as the scope of access allowed per user, access restriction conditions, authentication requirement levels, and access restrictions by time zone, and can be used as a standard for the authorization calculation process performed in subsequent steps. Subsequently, data preprocessing and feature extraction steps may be performed, in which missing values ​​included in the collected user information and access history data are corrected, outliers are removed, and feature values ​​capable of quantitatively expressing user behavior are extracted.

[0046] Next, artificial intelligence analysis can be performed, which can be implemented as a process of learning user-specific access patterns and predicting the range of access based on user characteristics. Based on these analysis results, initial access rights can be generated, and these initial access rights can be configured to include allowed access zones, allowed access time periods, and authentication requirement levels.

[0047] Subsequently, it can be determined whether the generated initial access authority conflicts with the security policy. If a policy conflict occurs, an authority adjustment or authentication enhancement step may be performed; in this step, authority may be reconfigured by reducing the allowed access zone, restricting the permitted time period, or increasing the authentication requirement level. Conversely, if no policy conflict occurs, the access authority may be confirmed as the final access authority.

[0048] Once the final access authority is determined, that authority can be applied to the access control device, thereby enabling actual access control. Additionally, the data and results generated throughout this entire process can be stored as audit logs, which can be utilized for future analysis and security audits.

[0049] FIG. 3 is a flowchart illustrating a method for detecting abnormal entry / exit patterns and strengthening authentication according to an embodiment of the present invention.

[0050] Meanwhile, referring to FIG. 3, the system can detect abnormal access patterns and perform an operation to strengthen the authentication procedure in response. First, information on abnormal access attempts can be collected, which may include events such as access during abnormal times, attempts to access unauthorized areas, or repeated authentication failures. Subsequently, the collected information can be compared with normal access patterns for each user, thereby evaluating whether the current access attempt falls within the normal range.

[0051] Next, a risk score may be calculated based on the comparison results, and this can be used as a value that quantitatively indicates the degree of abnormality of the entry attempt. Subsequently, it may be determined whether the calculated risk score exceeds a preset threshold value. If the risk score does not exceed the threshold value, basic authentication may be performed, and if authentication is successful, entry may be permitted.

[0052] Conversely, if the risk score exceeds a threshold value, access restrictions and administrator notifications may be triggered, additional authentication procedures may be required, or the user's access rights may be temporarily limited. Furthermore, the results of handling such abnormal situations may be stored in audit logs and utilized as training data for future security policy improvements.

[0053] In this way, access rights for each user can be automatically generated by comprehensively analyzing user information, access history data, and security policy information, and authentication procedures can be dynamically strengthened by detecting abnormal patterns occurring during the access process in real time; thereby, an access control environment that ensures both security and efficiency can be implemented.

[0054] Hereinafter, the detailed configuration of an artificial intelligence-based automatic user access authority generation and dynamic control system according to an embodiment of the present invention will be described in more detail with reference to the attached drawings.

[0055] FIG. 4 is a block diagram showing the overall configuration of an artificial intelligence-based user-specific access authority automatic generation and dynamic control system according to an embodiment of the present invention, FIG. 5 is a block diagram showing the detailed configuration of a data management unit according to an embodiment of the present invention, FIG. 6 is a block diagram showing the detailed configuration of an authority determination unit according to an embodiment of the present invention, and FIG. 7 is a block diagram showing the detailed configuration of an authority control unit according to an embodiment of the present invention.

[0056] Referring to FIG. 4, the artificial intelligence-based user-specific access authority automatic generation and dynamic control system (1000) according to the present embodiment may include at least one of a data management unit (100), an authority determination unit (200), an authority control unit (300), an event detection unit (400), and an audit log storage unit (500).

[0057] The above data management unit (100) can manage integrated data including user information, access history information, and access control policy information. To this end, the data management unit (100) may include at least one of a user information collection unit (110), an access history collection unit (120), a data integration unit (130), a time series sorting unit (140), a data refinement unit (150), a behavioral feature generation unit (160), and a feature normalization unit (170), as shown in FIG. 5.

[0058] The above user information collection unit (110) can collect user information including at least one of user identification information, department information, job title information, working hours information and security level information.

[0059] More specifically, the user information collection unit (110) can reliably acquire user identification information from various systems within the organization and, based on this, collect various personnel and authority-related attribute data in an integrated manner. Here, the user identification information may consist of key values ​​that can uniquely distinguish a user, such as an employee number, account ID, email, terminal identification value, or biometric authentication identification value. Based on the identification value, department information, job title information, work location, and security level information can be automatically retrieved and collected by linking with a personnel management system, ERP system, groupware system, or external authentication server. Additionally, working time information can be collected in a structured schedule format according to various work types, such as fixed work, staggered work, or shift work, and can be updated on a weekly, monthly, or event basis to reflect the work patterns of each user.

[0060] In addition, the user information collection unit (110) is configured not only to collect static personnel information but also to dynamically reflect information according to changes in the user's status. For example, when events such as organizational transfer, promotion, project assignment, or security level change occur, the corresponding user information item can be automatically updated by receiving a change event from a personnel linkage server or an external system. In this process, to maintain data consistency, duplicate information for the same user, missing information, and format standardization processing can be performed. For example, if the department name of the same user is expressed differently in different systems, it can be converted into a standard code system and integrated.

[0061] Additionally, the user information collection unit (110) can structure the collected information into a form suitable for authority analysis and store it or transmit it to a higher module. For example, department and job title information can be converted into a hierarchical structure and used for classifying user groups, and security level information can be quantified or leveled and used as a weighting factor when calculating access rights. In addition, working hours information can be used as reference data for determining accessibility by time of day, and these various attribute information can be combined with user behavior patterns in an artificial intelligence analysis engine to be used as input data for generating a more precise access authority profile.

[0062] The above access history collection unit (120) can collect access history information including at least one of the access time, access location, authentication method, whether authentication was successful, number of authentication failures, time of stay, and order of movement path.

[0063] More specifically, the access history collection unit (120) can receive various event logs generated from access control terminals, authentication devices, and electronic locks in real-time or batch mode to collect user-specific access history data in a structured form. Here, the access time can be recorded as timestamp data including the time of the access attempt and the time of authentication completion, and the access location can be expressed as a location identification code subdivided down to the building, floor, zone, and door level. Additionally, the authentication method can be collected as information distinguishing the actual authentication means used, such as card authentication, facial recognition, fingerprint recognition, and mobile authentication, and whether authentication is successful can be stored in the form of a binary value or status code indicating the result of allowing or denying access. This information can be linked based on the same user identification value to form an access history sequence according to the flow of time.

[0064] Additionally, the access history collection unit (120) can generate additional derived data to analyze user behavior characteristics beyond simple event recording. For example, the number of authentication failures can be aggregated as the number of accumulated failures for a specific time interval or specific zone, and can be used as a reference value to detect repetitive failure patterns. The dwell time can be calculated by determining the time difference between the time of entry into a specific zone and the time of exit from that zone, thereby quantitatively expressing the user's actual space usage pattern. The movement path sequence can be generated by reconstructing the sequence of zones passed through by the user in a time-series form based on continuous access location data, and can be used as reference data to determine whether it matches the normal workflow.

[0065] Additionally, the access history collection unit (120) can perform processing to standardize the collected data and maintain consistency by taking into account differences in data formats between various devices and systems. For example, it can convert log formats generated from access terminals of different manufacturers into a common data schema, or perform correction processing for missing data caused by network delays or device errors. For example, if an entry record exists for a specific area but an exit record does not, the time of end of stay can be estimated based on subsequent access events to supplement it. Furthermore, this access history data can be reorganized into user, time, and area units and transmitted to a higher-level analysis module so that it can be used as core input data for subsequent time-series analysis, abnormal behavior detection, and authority profile calculation.

[0066] The above data integration unit (130) can generate user-unit integrated data by combining user information collected from the user information collection unit (110) and access history information collected from the access history collection unit (120) based on user identification values.

[0067] More specifically, the data integration unit (130) can generate a user-unit integrated dataset by aligning static attribute data obtained from the user information collection unit (110) and time-series event data collected from the access history collection unit (120) based on a common identification key. Here, the user identification value can be used as a reference key that can identify the same user even across different systems, such as an employee number, account ID, device identifier, or authentication token, and the data integration unit (130) can match records between distributed data sources based on the identification value and merge them into a single user record. Additionally, if the time references of the data collected from different systems differ, they can be reconstructed into a consistent time-series structure through timestamp alignment or time zone correction processing.

[0068] In addition, the data integration unit (130) can rearrange and expand data into an analyzable structure beyond simple merging. For example, a sequence of accesses can be constructed on a daily or periodic basis by linking consecutive access history events for each user, and by combining user attribute information with the sequence, "what attribute a user accessed, when, where, and how" can be expressed as a single record structure. Furthermore, for attribute values ​​missing during the merging process, default values ​​can be assigned or corrected by referencing data from an adjacent point in time, and if data duplication occurs, consistency can be maintained by applying the latest data first, reliability-based selection, or policy-based merging rules.

[0069] Additionally, the data integration unit (130) can convert the data into a feature-oriented data structure suitable for use in an artificial intelligence analysis engine. For example, user attributes can be encoded in a vector form, and access history can be converted into time-series data based on time order or an event-based log set, and an integrated dataset can be created in a combined form of these two pieces of information. For example, the department, job title, and security level of a specific user, along with the access frequency, night access rate, and major movement path pattern over the last 30 days, can be configured into a single input data structure. This integrated data can be normalized and indexed and stored or transmitted to an upper module so that it can be used as core input data in the process of calculating suitability, analyzing risk, and creating access rights profiles.

[0070] Additionally, the integrated data generated by the data integration unit (130) may be managed in the form of a structured feature dataset suitable for analysis purposes rather than in a simple storage form, and may be configured in a structure in which user-specific time series data, statistical summary data, and behavioral feature data are hierarchically combined. For example, raw event logs, aggregated data over a certain period, and normalized feature vectors may be managed together for the same user, and such multi-layered structured data may be selectively utilized in various analysis modules of the authority determination unit (200) thereafter.

[0071] The above time series sorting unit (140) can sort the integrated data generated by the data integration unit (130) in chronological order to configure user-specific access time series data.

[0072] More specifically, the time series sorting unit (140) can receive user-unit integrated data generated by the data integration unit (130) and sort it based on the timestamps included in each event to reconstruct the user-specific access flow in chronological order. Here, the timestamps can be recorded based on various criteria, such as the time of entry / exit attempt, the time of authentication completion, or the time of device log generation, and the time series sorting unit (140) can ensure sorting accuracy by integrating time information of these different criteria into a single reference time. In addition, to correct time discrepancies that may occur due to network delays or time errors between devices, a alignment algorithm based on synchronization with a reference server time or an allowable error range can be applied.

[0073] Additionally, the time series sorting unit (140) can restructure the data structure to analyze user behavior flow beyond simple time sorting. For example, access events that occur consecutively for the same user can be connected into a single sequence to express an access pattern such as "entry → movement → stay → exit" in chronological order. In this process, for events recorded duplicately at the same time or logs that are out of order, priority rules or event type-based sorting criteria can be applied to rearrange them into a normal order. For example, authentication success events can be forcibly sorted to be positioned after authentication request events, or priority can be assigned to multiple events that occurred at the same time based on device ID or event type.

[0074] Additionally, the time series sorting unit (140) can convert the sorted data into a form suitable for subsequent analysis and provide it. For example, access time series data for each user can be generated by dividing it into a sliding window for a certain period, and base data can be configured to extract access frequency, movement path patterns, and behavioral characteristics by time period for each segment. For example, the access history of a specific user over the past 7 days can be arranged in chronological order, and based on this, repetitive access patterns or access during abnormal time periods can be identified. This time series data can be used as key input data in the process of calculating risk, detecting abnormal behavior, and creating access authority profiles.

[0075] The above data refinement unit (150) can generate analyzable refined data by performing at least one of missing value correction, outlier removal, and data consistency verification using access time series data configured in the time series alignment unit (140).

[0076] More specifically, the data refinement unit (150) may receive access time series data arranged in chronological order from the time series sorting unit (140) and perform a preprocessing process to process it to a quality level suitable for analysis. Here, missing value correction may be performed by estimating and supplementing the value by referring to data from adjacent times or past patterns for the same user when the access location, authentication method, or user identification value is missing in some events. For example, if a specific user's exit record exists but an entry record is missing, the entry time can be back-estimated and corrected based on the previous access event or the average travel time information of the area. In addition, interpolation or rule-based supplementation processing may be applied to data gaps caused by device errors or communication delays.

[0077] Additionally, the data refinement unit (150) can filter out abnormal data or data that may cause distortion in analysis by removing outliers. Here, outliers can be defined as physically impossible movement times, abnormally short or long stay times, access events occurring at different locations at the same time, etc., and can be identified using a predefined threshold criterion or a statistical distribution-based method. For example, if a record of movement within 1 minute exists even though movement between two doors should take at least 5 minutes, the data can be judged as an outlier and removed or corrected. Additionally, if authentication failure logs that occur repeatedly within a short period for the same user are judged to be due to a specific device error, the reliability of the data can be improved by excluding the corresponding log.

[0078] Additionally, the data refinement unit (150) can maintain the structural consistency of the entire dataset by performing data consistency verification. For example, it can verify whether all access events follow a logical flow such as "entry → stay → exit," and if the flow is broken, it can automatically correct the order or supplement missing events. In addition, it can check whether the relationship between user identification values, time information, and location information is maintained consistently, and if there is conflicting data, it can harmonize them into a single value by applying priority rules or reliability-based selection criteria. The refined data generated through this process can be maintained in a state where noise is removed and reliability is ensured, and can subsequently be used as input data for generating behavioral features, risk analysis, and calculating access rights profiles.

[0079] The above behavioral feature generation unit (160) can calculate at least one of the user-specific access frequency, time-specific access ratio, area stay time, and movement path pattern as a quantitative value based on the refined data generated by the data refinement unit (150).

[0080] More specifically, the behavioral feature generation unit (160) receives access time series data with consistency secured through the data refinement unit (150) and can generate various feature values ​​that can numerically express the behavioral patterns of each user. Here, the access frequency can be calculated by aggregating the number of accesses that occurred for a specific area or the entire system over a certain period, and the access ratio by time period can quantify the user's activity time pattern by calculating the proportion of access occurrences based on daily or weekly time intervals. In addition, the area dwell time can be calculated in the form of an average time spent in a specific space, a maximum dwell time, or a variance value based on the time difference between each access event, thereby allowing for the analysis of the user's space usage characteristics.

[0081] In addition, the behavioral feature generation unit (160) can generate complex features that reflect the flow of user movement beyond the calculation of simple statistical values. For example, the movement path pattern can be expressed as a quantitative value by extracting the order between areas that a user repeatedly moves between over a certain period in the form of a sequence, and calculating the frequency, transition probability, or path similarity of the sequence. For example, if a specific user repeatedly uses a path such as "Office → Conference Room → Common Area → Office," that path can be defined as a high-frequency normal pattern and can be used as a reference pattern in the subsequent analysis process. Furthermore, it can be expanded into a feature value capable of detecting abnormal movement paths by measuring deviations between movement paths.

[0082] Additionally, the behavioral feature generation unit (160) can be configured in the form of a vector or a multidimensional feature set so that the generated feature values ​​can be effectively utilized in artificial intelligence analysis. For example, the access frequency, night access rate, average time of stay, and major movement path patterns of a specific user can be combined into a single feature vector, and this vector can be used as input data for comparing similarity between users, clustering analysis, or risk calculation. In addition, various aggregation criteria can be applied in the process of generating feature values ​​in units of time period, zone, or event type, and, for example, behavioral features during the last 7 days, 30 days, or a specific project period can be calculated separately and utilized for situational analysis.

[0083] The above feature normalization unit (170) can convert the quantitative value calculated by the behavior feature generation unit (160) into the same scale so that it can be compared between users and transmit it to the authority determination unit (200).

[0084] More specifically, the feature normalization unit (170) can perform a process of converting each feature value to a common standard scale to resolve the problem that various quantitative values ​​produced by the behavioral feature generation unit (160) have different units and ranges. For example, access frequency can be expressed as a value of tens of times or more, whereas the access rate by time period can be expressed as a value between 0 and 1; therefore, if these heterogeneous values ​​are used as they are, a specific feature may be excessively affected. Accordingly, the feature normalization unit (170) can convert all feature values ​​into a comparable form by applying a non-linear transformation method such as a Min-Max normalization method that converts values ​​between 0 and 1 based on minimum and maximum values, a standardization method (Z-score) that readjusts the distribution based on mean and standard deviation, or a log transformation.

[0085] Additionally, the feature normalization unit (170) can calculate a statistical reference value based on the entire user group and use it to express individual user features as relative positions. For example, by converting the level of a specific user's access frequency relative to the overall user average into a standardized score, it is possible to relatively compare behavioral characteristics between users. Furthermore, if it is desirable for a specific feature value to be ideally high or low, denormalization or weighted transformation can be performed to reflect that directionality. For example, in the case of a feature where the risk increases as the value increases, such as an authentication failure rate, the scale can be adjusted during the normalization process so that the contribution to the risk is more clearly reflected.

[0086] Additionally, the feature normalization unit (170) can organize the normalized feature values ​​into a single consistent data structure and transmit them to the authority determination unit (200). For example, user-specific behavioral features can be aligned and transmitted in the form of fixed-length vectors, and each dimension can be defined as access frequency, access rate by time period, dwell time, and movement path characteristics. These normalized feature vectors can be used as input data in the processes of calculating similarity between users, clustering analysis, risk calculation, and access authority profile generation, and through the normalization process, can support balanced analysis that is not biased toward specific features.

[0087] In addition, the normalized feature vector generated in the feature normalization unit (170) can be aligned to the same dimension and same order structure so that it can be used as common input data in the clustering operation, suitability calculation, and risk calculation processes of the authority determination unit (200). For example, by maintaining the same feature index system for all users, the problem of dimension mismatch can be prevented when inputting to the model.

[0088] The above authority determination unit (200) can perform artificial intelligence analysis based on integrated data managed by the data management unit (100) to produce an access authority profile indicating the range of access allowed per user. To this end, the authority determination unit (200) may include at least one of a clustering operation unit (210), a suitability calculation unit (220), a risk calculation unit (230), a profile generation unit (240), a pattern learning unit (250), an anomaly detection unit (260), and an initial authority generation unit (270), as shown in FIG. 6.

[0089] The above clustering operation unit (210) can form user groups by converting user-specific attribute values ​​into vector forms using integrated data managed by the data management unit (100) and performing similarity calculations between the converted vectors.

[0090] More specifically, the clustering operation unit (210) can quantify user-specific attributes and behavioral features based on the integrated data transmitted from the data management unit (100) and convert them into a multidimensional vector form. Here, the vector can be quantified by applying one-hot encoding or embedding techniques to categorical information such as department, job title, and security level, and continuous data such as access frequency, dwell time, and access rate by time zone can be included as normalized values. Additionally, sequence data such as movement path patterns can be converted into path frequency-based vectors or transition probability-based features and included, and a high-dimensional feature vector combining these various attribute values ​​can be generated on a user-by-user basis.

[0091] Additionally, the clustering operation unit (210) can calculate the similarity between the generated user vectors and group users with similar characteristics into the same group. Here, the similarity calculation can utilize various distance-based indicators such as Euclidean distance, cosine similarity, or Manhattan distance, and an appropriate similarity criterion can be selected depending on the data characteristics. For example, cosine similarity can be used when the directionality of behavioral patterns is important, and Euclidean distance can be used when the absolute difference in value is important. Based on the results of this similarity calculation, algorithms such as K-means, hierarchical clustering, or density-based clustering (DBSCAN) can be applied to form user groups, and each group can be defined as a set of users that share similar access patterns and permission request characteristics.

[0092] Additionally, the clustering operation unit (210) can continuously update and reconfigure the formed user groups. For example, if a new user is added or the behavioral pattern of an existing user changes, the corresponding user vector can be reassigned to the existing cluster structure or the entire cluster can be retrained to maintain the latest user group. Furthermore, the number or density criteria of the clusters can be dynamically adjusted according to changes in the system environment or the number of users, and, for example, if the number of users increases, a more granular cluster structure can be formed. This user group information can subsequently be used as a standard for calculating suitability, generating initial permissions, and comparing abnormal behavior, and can contribute to generating a more precise access permission profile based on patterns among similar users.

[0093] Additionally, the clustering operation unit (210) can perform cluster assignment even for new users or users who only have attribute information, and can assign the user's attribute vector to the most similar cluster by comparing it with existing cluster centroid values. Through this, analysis results based on existing user groups can be utilized even for users with insufficient access history, and consistency in the creation of initial permissions can be ensured.

[0094] The above suitability calculation unit (220) can calculate probability values ​​for an access allowance zone and an access allowance time period for a specific user by using the access history distribution of users included in the user group formed by the clustering operation unit (210).

[0095] More specifically, the suitability calculation unit (220) can derive a probability-based range of access permission suitable for a specific user by aggregating access history data of users belonging to the same group based on the user group formed by the clustering operation unit (210). Here, the access history distribution may consist of statistical values ​​such as access frequency by zone, access ratio by time of day, time of stay distribution, and access success rate, and based on these statistical values, the "accessibility" for a specific zone or time of day can be calculated in the form of a probability value. For example, if users of the same group perform more than 70% of total access to a specific research zone and access it intensively during daytime hours, that zone and time of day can be calculated with a high suitability probability value.

[0096] In addition, the suitability calculation unit (220) can calculate a more sophisticated suitability by applying conditional probability and weight-based analysis beyond simple frequency-based calculation. For example, the probability of accessing a specific area can be calculated in the form of a conditional probability while considering specific user attributes (e.g., department, job title, etc.) and time zone conditions simultaneously, and the suitability for each situation can be adjusted by giving higher weight to recent data or reflecting only data from a specific project period. In addition, the stability of the suitability result can be determined by calculating a confidence interval of the probability value together with the reliability of the access history data or the quantity of data. For example, if there is insufficient data, a conservative suitability can be applied by determining that the variability of the probability value is high.

[0097] Additionally, the suitability calculation unit (220) can select candidate access zones and candidate access time zones based on the calculated probability values, and the probability values ​​can be used as important criteria values ​​in the subsequent authority determination and generation process. For example, if the access probability for a specific zone is above a preset threshold, that zone can be included as a candidate for access, while conversely, zones with low probability values ​​can be excluded or classified as subjects for further review. Since this probability-based suitability reflects not only the individual user history but also the collective behavioral patterns of similar user groups, it can enable reasonable access authority recommendations even for new users or users with insufficient history.

[0098] The above risk calculation unit (230) can calculate at least one indicator among the user-specific authentication failure rate, night access rate, and abnormal zone access rate using integrated data managed by the data management unit (100), and calculate a risk score by applying a preset weight to the calculated indicator.

[0099] More specifically, the risk calculation unit (230) can generate an indicator capable of quantitatively expressing the risk level by analyzing user-specific access behavior from various angles based on integrated data provided by the data management unit (100). Here, the authentication failure rate can be calculated as the ratio of the number of failures to the total number of authentication attempts over a certain period, and repeated authentication failures can be used as an indicator indicating the possibility of abnormal access attempts or account theft. Additionally, the night access rate can refer to the proportion of access attempts that occur outside of normal working hours, and can identify access patterns outside the normal range by comparing them with user-specific working hour information. Furthermore, the abnormal zone access rate can be defined as the ratio of access attempts to zones that are less related to the user's job or authority scope, and can be calculated by comparing them with predefined zone-role mapping information.

[0100] Additionally, the risk calculation unit (230) can calculate a final risk score by applying pre-set weights to reflect the importance of each indicator. For example, if the authentication failure rate is high, a high weight may be assigned as it is determined that there is a high possibility of security breach, and the night access rate may be assigned a medium weight according to the organization's operational policy. Furthermore, the abnormal zone access rate may be assigned a higher weight in environments with high security sensitivity, such as specific industrial environments, for example, research institutes or data centers. These weights may be defined in advance as a policy and may also be dynamically adjusted based on security event data accumulated during the operation process.

[0101] Additionally, the risk calculation unit (230) may apply a time-weighted model that assigns a higher weight to recent access history to reflect behavioral changes over time. For example, authentication failure events within the last 7 days may be reflected with a higher weight than past events, thereby allowing for a more accurate reflection of the actual security risk at the current point in time.

[0102] Additionally, the risk calculation unit (230) can normalize or grade the calculated risk score to a certain range so that it can be utilized in subsequent analysis and control processes. For example, the risk score can be expressed as a continuous value between 0 and 1, or classified into range grades such as "low, medium, high." In addition, to reflect the trend of risk change over time, a dynamic risk model can be constructed by giving higher weight to recent data or by temporarily increasing the risk after a specific event occurs. For example, the user status can be reflected by rapidly increasing the risk score when repeated authentication failures occur within a short period of time, and then gradually decreasing it after a certain period of time. This risk score can be used as a key criterion to determine whether to strengthen authentication, restrict access, or require administrator approval during the subsequent access authority profile creation and authority control stages.

[0103] The profile generation unit (240) can generate an access authority profile including an access permission zone, an access permission time zone, and an authentication requirement level for each user by using the probability value calculated by the suitability calculation unit (220) to derive a candidate access zone and a candidate access time zone for each user, and using the risk score calculated by the risk calculation unit (230) to determine whether to adopt the candidate access zone and the candidate access time zone and the authentication requirement level.

[0104] More specifically, the profile generation unit (240) can primarily select candidate access zones and candidate access time zones for each user based on the access probability value transmitted from the suitability calculation unit (220). Here, the probability value can be used as a quantitative value representing the possibility of access to a specific zone or time zone, and the profile generation unit (240) can derive access candidates by applying a pre-set threshold or the top N selection criteria. For example, only zones with an access probability above a certain standard can be selected as candidates, or zones and time zones with the highest similarity to user behavior patterns can be prioritized. In addition, regarding time zones, instead of a simple specific point in time, they can be reorganized into policy units such as "weekday daytime," "nighttime," and "weekend" to be set as candidate time zones.

[0105] Additionally, the profile generation unit (240) can internally distinguish and manage the "recommended authority status" prior to policy application for the calculated access candidate zones and time zones, and the recommended authority can be used as an input value for the subsequent policy verification and adjustment process in the authority control unit (300).

[0106] Additionally, the profile generation unit (240) can determine the final adoption of candidate zones and time zones and the level of authentication required by reflecting the risk score calculated by the risk calculation unit (230). For example, even if the accessibility suitability for a specific zone is high, if the user's risk score is above a threshold value, the zone may be excluded or configured to be allowed only under limited conditions. Furthermore, in cases of high risk, the authentication intensity may be increased to require multi-factor authentication, biometric authentication, or an administrator approval procedure instead of basic authentication for the same zone. Conversely, for users with low risk, flexible authorization configuration may be possible by expanding the scope of allowed access or simplifying the authentication procedure.

[0107] Additionally, the profile generation unit (240) can ultimately generate a structured access authority profile that includes access permission zones, access permission time zones, and authentication requirement levels for each user. For example, a specific user's profile may be defined in the form of "access allowed to the 1st floor of the research building and common areas, weekdays from 09:00 to 18:00, basic authentication applied," and additionally, for specific high-security zones, detailed conditions such as "access subject to administrator approval" or "multi-factor authentication required" may be included. These access authority profiles can be stored on a per-user basis or transmitted to the authority control unit (300) to be converted into actual access control policies, and can subsequently be dynamically updated according to environmental changes or changes in user behavior. The pattern learning unit (250) can learn normal access patterns for each user by inputting integrated data managed by the data management unit (100) into a time-series-based model.

[0108] More specifically, the pattern learning unit (250) can learn the characteristics of normal access behavior over time by utilizing user-specific access time series data provided by the data management unit (100) as input. Here, the time series data may be configured in a form where the user's access time, access area, authentication method, time spent, and movement path sequence are arranged in chronological order, and the user's daily access pattern can be modeled based on this data. For example, if a pattern is repeatedly observed where a specific user enters the office on a weekday morning and then sequentially uses the meeting room and common areas, that flow can be defined and learned as a normal access pattern.

[0109] Additionally, the pattern learning unit (250) can perform learning that considers time dependency by applying algorithms such as a recurrent neural network, a long short-term memory network, or a time series-based probabilistic model to reflect the characteristics of the time series data. Such a model can be trained to predict the next access location or time zone based on the flow of past access history, and can internalize the access sequence, time interval, and zone movement patterns that appear repeatedly for a specific user. Furthermore, a more generalized normal pattern can be formed by utilizing time series data of a single user as well as a group of similar users.

[0110] Additionally, the pattern learning unit (250) can store the learned normal access pattern in the form of a reference model and use it as reference data for comparison with subsequent access attempts. For example, the average access time range, major movement path, and access frequency distribution of a specific user can be stored as a single normal pattern profile, and this information can be used as a criterion by the anomaly detection unit (260) to determine whether the current access attempt falls within the normal range. Furthermore, to respond to changes in user behavior or organizational environment, the model can be retrained at regular intervals or based on events to maintain the latest normal pattern.

[0111] The above anomaly detection unit (260) can calculate a deviation value by quantifying the difference between the data corresponding to the current access attempt and the normal access pattern learned by the pattern learning unit (250), and can determine that it is an abnormal access if the calculated deviation value exceeds a preset threshold value.

[0112] More specifically, the anomaly detection unit (260) can receive data on a currently occurring access attempt and quantitatively determine whether the access falls within the normal behavioral range. Here, the data on the current access attempt may consist of a single event or a short-term time series segment including the time of access, access zone, authentication method, previous movement path, and authentication result, and the anomaly detection unit (260) can use this as input data to compare with a normal access pattern generated by the pattern learning unit (250). In this comparison process, not only simple value comparisons but also complex factors such as time zones, movement order, and access frequency may be considered together.

[0113] Additionally, the anomaly detection unit (260) may apply various deviation calculation methods to quantify the difference between the normal pattern and the current access attempt. For example, the deviation can be calculated based on distance to determine how different a specific access attempt is from the access location predicted in the normal pattern, or by using the probability value of the current access time relative to the normal time zone distribution. Additionally, in the case of a movement path, the deviation value can be calculated by comparing the similarity between the normal path sequence and the current path, and the final deviation value can be derived by weighting and summing these various deviation factors. For example, if a user who normally repeats a pattern of moving from an office to a conference room suddenly moves to a high-security zone, the path deviation can be calculated as a high value.

[0114] Additionally, the anomaly detection unit (260) can determine whether there is an abnormal access by comparing the calculated deviation value with a preset reference value. Here, the reference value can be set differently for each user, zone, or time period, and can be dynamically adjusted according to the operating environment. For example, for zones with high security sensitivity, the standard can be set strictly so that even a low deviation value is judged as an abnormality, while for general zones, a relatively relaxed standard can be applied. Furthermore, the anomaly can be determined based on deviation values ​​accumulated over a certain period of time as well as a single access event, and can be linked to increasing the risk level when repeated abnormal signs are detected.

[0115] Additionally, the anomaly detection unit (260) may be configured to calculate a deviation value in real time at the time of an access attempt, and may determine whether there is an anomaly within a certain delay time to enable immediate response. For example, the determination of whether there is an anomaly may be performed simultaneously with the authentication request to determine whether entry is permitted, thereby enabling security control based on pre-blocking.

[0116] For users whose access history is less than a preset threshold amount, the above initial authority generation unit (270) can calculate probability values ​​and risk scores for access allowed zones and access allowed time zones through the suitability calculation unit (220) and the risk calculation unit (230) using the access history distribution of user groups formed in the clustering operation unit (210), and generate an initial access authority profile using the calculation results.

[0117] More specifically, the initial authority generation unit (270) can generate reasonable initial access rights by utilizing alternative criteria in situations where individual history-based analysis is difficult, targeting new users or users for whom access history has not been sufficiently accumulated. Here, the fact that the access history is less than the standard amount may mean that the number of access events over a certain period does not meet the pre-set minimum number of data. In such cases, the initial authority generation unit (270) can identify user groups having attributes similar to the user's department, job title, security level, and work type through the clustering operation unit (210).

[0118] Additionally, the initial authority generation unit (270) can input the access history distribution of the derived user group into the suitability calculation unit (220) to calculate access probability values ​​for specific zones and time periods, and simultaneously calculate a risk score reflecting the average or representative risk level of the group through the risk calculation unit (230). For example, if users of the same department and rank mainly access a specific work area and show characteristics of a low night access rate, a similar access permission range can be granted to new users based on that pattern.

[0119] Additionally, the initial authority generation unit (270) can generate an initial access authority profile for each user by comprehensively reflecting the calculated probability value and risk score. For example, initial authority such as "allowing daytime access to public work areas and affiliated department areas, applying basic authentication" may be set for a specific user, and conditions such as exclusion from access or administrator approval may be granted for some restricted areas. Furthermore, these initial authority may be gradually readjusted as actual access history accumulates, and may be switched to a general authority calculation process once a certain level of data is secured.

[0120] The above authority control unit (300) can set access rights for each user using an access rights profile calculated by the authority determination unit (200) and control access according to the set access rights. To this end, the authority control unit (300) may include at least one of an authority setting unit (310), a policy verification unit (320), an authority confirmation unit (330), an authority adjustment unit (340), and an anomaly response unit (350), as shown in FIG. 7.

[0121] The above-mentioned authority setting unit (310) can set the access permission zone, access permission time zone, and authentication requirement level as user-specific access permissions based on the access permission profile generated by the authority determination unit (200).

[0122] More specifically, the authorization setting unit (310) can receive an access authorization profile generated by the authorization judgment unit (200) as input and convert it into an authorization rule form applicable to the actual system. Here, the access authorization profile may be an abstract structure including an allowed zone, an allowed time zone, and a required authentication level for each user, and the authorization setting unit (310) can concretize it into a policy data form that can be understood by an access control device or an authentication system. For example, if a specific user's profile includes "access to the 1st floor of the research building allowed, weekdays from 09:00 to 18:00, basic authentication required," this can be converted into an access control list or policy table form applicable to the access door terminal of the corresponding zone and set.

[0123] Additionally, the permission setting unit (310) can configure user-specific access rights in units of detailed conditions to respond to various situations. For example, different time zone conditions or authentication methods can be set for each zone for the same user, and multi-factor authentication or administrator approval conditions can be added for specific zones. Furthermore, the validity period of the permission can be set to allow access only for a certain period, and in the case of project-based permissions, time conditions including a start date and an end date can be set together. For example, access to restricted zones can be allowed only during a specific project period, and the permission can be set to expire automatically upon the end of the period.

[0124] Additionally, the authorization setting unit (310) may configure the authorization setting method differently depending on the type of access control device. For example, in the case of a card reader, it may be set in the form of a time-based access control table, in the case of a face recognition device, it may be set in the form of a policy including authentication strength and additional authentication conditions, and in the case of a mobile access card system, it may be converted into token-based access authorization data and distributed.

[0125] Additionally, the authorization setting unit (310) can manage the configured access rights in conjunction with user identification values ​​and transmit them to a lower access control system or an external authentication system. For example, data can be configured in a form where a list of allowed access zones, time conditions, and authentication requirement levels are mapped together with a user ID, and the information can be distributed to an access control terminal or a central control server to be reflected in actual access control. Furthermore, processing can be performed to check in advance for conflicts with existing configured rights or to reflect only the changed rights in an incremental manner, thereby reducing system load and ensuring the stability of the authorization application.

[0126] The above policy verification unit (320) can determine whether the access rights set in the authority setting unit (310) satisfy the policy conditions by using access control policy information managed by the data management unit (100).

[0127] More specifically, the policy verification unit (320) can systematically verify whether the user-specific access rights generated by the authority setting unit (310) match the organization's security rules by referring to the access control policy information stored in the data management unit (100). Here, the access control policy information may include various rules such as security grades by zone, allowed zone ranges by user grade, access restriction conditions by time zone, authentication level requirements, and administrator approval requirements. The policy verification unit (320) can interpret these rules in the form of conditional expressions or rule sets and compare them with the authority setting results. For example, if a specific zone is set to a high security grade and a minimum security grade is required for access to that zone, the policy verification unit can determine whether the user's security grade falls short of this to identify whether there is a policy violation.

[0128] In addition, the policy verification unit (320) can perform more sophisticated verification by simultaneously applying combination rules between multiple conditions as well as verifying a single condition. For example, if a specific area must simultaneously satisfy two conditions, such as "no night access" and "multiple authentication required," the time condition and authentication level set in the authorization setting unit (310) can be verified to satisfy both of these policies. Furthermore, if there are exception policies for each user group, the scope of policy application can be determined by determining whether the user falls under the exception target. For example, for users belonging to the administrator group, a policy can be applied that applies a different scope of access permission than for general users or relaxes some restrictions.

[0129] Additionally, the policy verification unit (320) can clearly identify whether there is a policy conflict based on the verification results, and if a conflict occurs, classify the type of conflict to use for subsequent processing. For example, violations for each condition can be recorded by classifying them into types such as violation of zone access conditions, violation of time zone conditions, and failure to meet authentication levels. These verification results can be transmitted to the authority confirmation unit (330) or the authority adjustment unit (340) to be used as a standard for authority modification or restriction measures, and at the same time, they can be recorded in the audit log storage unit (500) to be used as supporting data for tracking policy compliance.

[0130] The above authority confirmation unit (330) can determine the final access authority by maintaining or modifying the access authority set in the authority setting unit (310) according to the judgment result of the policy verification unit (320), and apply the determined access authority to the access control target.

[0131] More specifically, the authority confirmation unit (330) finally determines the validity of the access authority generated by the authority setting unit (310) based on the verification results transmitted from the policy verification unit (320), and can determine the status of the authority as confirmed by maintaining or modifying the authority as necessary. Here, if the policy verification results satisfy all conditions, the set access authority can be confirmed as is without any separate changes, and if a conflict occurs in some conditions, the authority can be modified by restricting or supplementing it according to the type of conflict. For example, if access to a specific area is allowed but the time zone condition violates the policy, the authority can be adjusted by restricting the access time zone of that area.

[0132] Additionally, the authority determination unit (330) can determine the method of modifying authority based on priority criteria when multiple policy conflicts occur simultaneously. For example, a security level-related policy may have a higher priority than a time zone policy, and accordingly, access to the area itself may be blocked if the security level is not met. In addition, in some cases, instead of completely removing the authority, conditional access may be allowed by adding administrator approval conditions or raising the authentication requirement level. For example, if a specific user has a business need to access a high-security area, access may be blocked by default, but access may be allowed only if administrator approval or multi-factor authentication conditions are satisfied.

[0133] Additionally, the authority confirmation unit (330) can convert the finally confirmed access authority into a data format and transmit it so that it can be applied to an actual access control system. For example, policy data including a list of allowed access zones, time conditions, authentication requirement levels, and conditional approval status along with a user identification value can be generated, and such data can be distributed to an access control terminal, a central control server, or an external security system. Furthermore, an incremental update method can be applied by comparing the change history with existing authority and reflecting only the changed parts, thereby allowing authority changes to be applied quickly while minimizing system load. In this process, the confirmed access authority can be used as a standard for actual access control operations thereafter, and at the same time, it can be recorded in an audit log to ensure traceability.

[0134] The above-mentioned authority adjustment unit (340) can reduce the access permission zone set in the access permission profile, restrict the access permission time period, or increase the authentication requirement level when the policy verification unit (320) determines that there is a policy violation.

[0135] More specifically, the authority adjustment unit (340) can perform adjustment processing to reconfigure the access rights set by the authority setting unit (310) to conform to the policy based on the policy violation results transmitted from the policy verification unit (320). Here, policy violations can occur in various forms, such as failure to meet zone security grades, access to unauthorized time zones, or insufficient authentication levels, and the authority adjustment unit (340) can apply different adjustment strategies depending on the type of violation. For example, if access to a specific zone does not meet the user security grade criteria, the scope of authority can be reduced by excluding that zone from the access allowance list or by replacing it with an accessible sub-zone.

[0136] Additionally, the authority adjustment unit (340) can adjust the access permission time zone by resetting the access permission time zone for policy violations related to time conditions. For example, if a user's access permission is set to 24 hours but night access is restricted by policy, access can be restricted to only the time zone excluding that time interval. Also, if there is a policy that allows access only during a specific period, time-based access control can be performed by setting an access validity period or adding an automatic expiration condition.

[0137] Additionally, the authorization adjustment unit (340) can strengthen the security level by adjusting the authentication requirement level. For example, if the access rights set to basic authentication do not meet policy criteria, the authentication strength can be increased by adding multi-factor authentication, biometric authentication, or an administrator approval procedure. Additionally, for specific high-risk situations or sensitive areas, a conditional authentication policy can be applied to dynamically change the authentication requirement level depending on the situation. For example, basic authentication can be allowed under normal circumstances, but additional authentication can be required during nighttime hours or when abnormal access patterns are detected.

[0138] The above abnormal response unit (350) may temporarily restrict access rights for the user, block access to a specific area, or require an additional authentication procedure if the policy verification unit (320) determines that there is a policy violation.

[0139] More specifically, the anomaly response unit (350) receives the result determined by the policy verification unit (320) as a policy violation or abnormal access, and can perform immediate security response measures against the user. Here, policy violations may include not only simple rule inconsistencies but also cases where the deviation value calculated by the anomaly detection unit (260) exceeds a standard, and the anomaly response unit (350) can change the access control status by reflecting these situations in real-time or near-real-time. For example, if repeated authentication failures, attempts to access during abnormal time periods, or attempts to access unauthorized high-security zones occur, the response can be taken by restricting the user's access rights for a certain period of time or temporarily suspending all access.

[0140] Additionally, the anomaly response unit (350) can apply a step-by-step response policy according to the type of violation and the level of risk. For example, in the case of a minor violation, the response can be limited to restricting access to specific areas or requiring additional authentication, and in the case of a serious violation, access to the entire system can be blocked or access can be made impossible without administrator approval. Furthermore, the blocking of access to specific areas can be applied in a subdivided manner on an area-by-area basis, for example, general business areas can be maintained while access to high-security areas such as data centers or research institutes can be selectively blocked.

[0141] Additionally, the anomaly response unit (350) can enhance the security level by reconfirming the user's identity through an additional authentication procedure. For example, in cases where access was previously possible only through card authentication, if an anomaly is detected, a multi-authentication procedure such as facial recognition, fingerprint authentication, or mobile authorization may be required. Furthermore, it may be configured to undergo a pre- or post-authorization process for specific access attempts, including an administrator authorization procedure, and such authorization requests may be transmitted to an administrator terminal or a security monitoring system. The results of these responses are recorded in the audit log storage unit (500) and can be utilized for future security analysis and policy improvement, and for repetitive anomalies, a more strengthened response policy may be automatically switched.

[0142] The above event detection unit (400) can detect at least one of a change in user information, organizational transfer, change in working hours, change in project assignment, and change in access control policy.

[0143] More specifically, the event detection unit (400) can detect changes in the user status and system environment in real time or periodically through integration with the HR integration server (10), the central processing server (20), or an external system. Here, changes in user information may refer to changes in HR attributes such as department, job title, security level, and work location, and the event detection unit (400) can recognize such changes through change logs or API calls transmitted from the HR system. Additionally, since events such as organizational transfers or changes in project assignments are factors that directly affect the user's role and scope of work, they can be used as trigger signals indicating that access rights need to be recalculated when such events occur.

[0144] Additionally, the event detection unit (400) can detect changes in time-based attributes, such as changes in working hours, and reflect them in access control. For example, if a user's work type changes from daytime work to shift work, the existing available time zone may no longer be valid, so this can be reflected immediately. Furthermore, an access control policy change event may occur when a policy is modified or a new policy is added by a security administrator, and the event detection unit (400) can detect change history occurring in the policy storage unit or management system to induce a review of the rights of the relevant users. For example, if the security level of a specific area is raised, the rights of users who have access rights to that area may be re-evaluated.

[0145] In addition, the event detection unit (400) can go beyond simply recording the detected event and can transmit it to the authority determination unit (200) and the authority control unit (300) to automatically perform subsequent processing steps. For example, if a user information change event is detected, a request to recalculate the access authority profile for the user may be generated, and if a policy change event is detected, a process for re-verifying authority for all users or a specific user group may be executed. Additionally, the time of the event occurrence and the change details can be recorded together and transmitted to the audit log storage unit (500).

[0146] Meanwhile, the authority determination unit (200) can regenerate an access authority profile based on change information detected by the event detection unit (400). More specifically, the authority determination unit (200) can receive change information transmitted from the event detection unit (400), re-evaluate the previously calculated access authority profile, and regenerate a new access authority profile that reflects the latest status. Here, the change information may include various factors affecting access authority, such as changes in user attributes, changes in organizational structure, changes in working hours, or changes in security policies, and the authority determination unit (200) can update the analysis input values ​​by reflecting these change factors in the existing integrated data. For example, if a user's department changes, the new user group to which the user belongs can be re-identified, and the allowed access zone and time zone can be recalculated by reflecting the access patterns of that group. In addition, if the security level is raised or lowered, the profile can be readjusted in a direction that expands or reduces the existing scope of authority.

[0147] In addition, the authority determination unit (200) can reinterpret the overall access pattern by combining it with existing behavioral characteristics, rather than simply reflecting only the changed items. For example, if working hours are changed, suitability and risk can be recalculated based on access patterns within that time period, and if a policy change occurs, the adoption of candidate access zones and the level of authentication requirements can be re-determined by reflecting the new policy criteria. Furthermore, the scope of recalculation can be adjusted according to the frequency or importance of events; for example, in the case of a single user change, recalculation is performed only on that user, and in the case of a global event such as a policy change, batch recalculation can be performed on all users or specific groups. This recalculation process can be performed in real-time or at regular intervals, thereby ensuring that the access authority profile always remains up to date.

[0148] Meanwhile, the authority control unit (300) can update access rights based on the access rights profile regenerated by the authority determination unit (200). More specifically, the authority control unit (300) can receive the access rights profile regenerated by the authority determination unit (200) and update the previously set access rights. Here, the update can be performed with the concept of adding new rights, modifying existing rights, or removing unnecessary rights, and the authority control unit (300) can identify only the parts that need to be changed by comparing the regenerated profile with the existing rights information. For example, if access to a specific area is newly allowed, that area can be added to the access rights list, and conversely, rights that are no longer needed can be automatically removed. In addition, if time conditions or authentication requirement levels are changed, only those conditions can be partially modified and reflected.

[0149] Additionally, the authority control unit (300) can perform an application procedure to reliably reflect the updated access authority in the actual access control system. For example, the changed authority information can be transmitted to an access control terminal or a central control server to be applied immediately, or it can be processed using an incremental update method considering the system load. Furthermore, to prevent temporary access errors during the authority update process, the timing of the transition between the existing authority and the new authority can be controlled, or a method of applying them in parallel for a certain period of time can be considered. For example, the existing authority and the new authority can be set to be valid simultaneously for a certain period of time immediately after a change of workplace to ensure business continuity. The results of such authority updates can be recorded in an audit log and utilized for subsequent security audits and history tracking.

[0150] The above audit log storage unit (500) can store at least one of the access rights confirmed by the access control unit (300), access rights change history, policy verification result, and abnormal access judgment result.

[0151] More specifically, the audit log storage unit (500) can structure and store various historical data generated during the process of creating or changing the authority, along with user-specific access authority information confirmed by the authority control unit (300). Here, the storage targets may include not only authority configuration information such as the final access allowed zone, allowed time zone, and authentication requirement level, but also the time when the authority was created or changed, the reason for the change, and event information that triggered the change. In addition, by recording user identification values, applied policy versions, and summary information of key input values ​​used to create the authority, trace-based data capable of accurately reproducing the authority status at a specific point in time can be constructed.

[0152] Additionally, the audit log storage unit (500) can record the entire security decision-making process by storing the verification results of the policy verification unit (320) and the results related to abnormal access determined by the abnormal detection unit (260) or the abnormal response unit (350). For example, if a specific access right is reduced or the authentication requirement level is raised due to a policy violation, the relevant policy conditions and violation type may be recorded in the log, and if abnormal access is detected, the deviation value, judgment criteria, and details of response measures may be stored together. Beyond simply recording results, this information can function as analysis-based data that can be utilized for future policy improvement or as training data for artificial intelligence models.

[0153] In addition, data stored in the audit log storage unit (500) can be reused as training data for an artificial intelligence analysis engine, and model performance can be continuously improved by analyzing the difference between the permission generation result and the actual access result. For example, information on access zones where permission was granted but not actually used can be used as a criterion for reducing permission in the future.

[0154] Additionally, the audit log storage unit (500) can be configured to systematically manage stored log data in chronological order and by user, and to enable inquiry and analysis when necessary. For example, it can query the history of authority changes for a specific user over a certain period or track the history of access policy changes for a specific area. Furthermore, to prevent tampering with the log data, hash value generation, encrypted storage, or blockchain-based recording methods may be applied, and the log data can be used as evidence for external security audits or regulatory compliance. For example, in the event of a specific security incident, cause analysis can be performed based on the access authority status and change history at that time.

[0155] Meanwhile, the AI-based automatic generation of user-specific access rights and dynamic control system according to the present invention may be implemented as a computing device comprising one or more processors and memory that stores program instructions executed by the processors. Here, the processor may be composed of a central processing unit (CPU), a graphics processing unit (GPU), a neural network processing unit (NPU), or a combination thereof, and may be responsible for data processing, AI model computation, and the execution of authority control logic. Additionally, the memory may include volatile memory (RAM) and non-volatile memory (ROM, flash memory, SSD, etc.), and may store user information, access history data, policy information, and AI model parameters. Such a computing device may not only be implemented in the form of a single server, but may also be configured in a cloud environment or a distributed processing structure, allowing functions to be distributed and executed across multiple physical or virtual servers.

[0156] The program instructions stored in the memory above can be executed by a processor to implement functional modules corresponding to a data management unit (100), an authority determination unit (200), an authority control unit (300), an event detection unit (400), and an audit log storage unit (500). For example, the data management unit (100) can be implemented as a software module that performs functions such as collecting user information, collecting access history, and integrating and refining data, and the authority determination unit (200) can be implemented as an analysis engine that calculates an access authority profile using an artificial intelligence model. Additionally, the authority control unit (300) can be implemented as control logic that performs policy verification, authority setting, and authority adjustment, and the event detection unit (400) can be composed of an interface module that detects change events through linkage with an external system. Each of these modules can be separated and executed as an independent service and can perform the operation of the entire system while communicating with each other through an internal API or message queue.

[0157] In addition, the present system (1000) can be integrated with an actual access control environment through linkage with external devices and systems. For example, the computing device can communicate with an access control terminal (30), an authentication device (40), and an electronic lock device (50) through a network interface, and transmit user-specific access authority information to the corresponding device to be reflected in actual access control. In addition, user information and policy information can be periodically synchronized through linkage with a personnel linkage server (10) or an external security system, and when an event occurs, data can be received in real time to recalculate and update authority. For example, when a user information change event occurs, the information is immediately transmitted to the computing device, and the processor can recalculate the access authority profile based on this to maintain the latest authority status.

[0158] The computing device records access rights, policy verification results, and abnormal access detection results generated as a result of program execution in memory or external storage, and can analyze or visualize them as needed. For example, audit log data can be stored in a database format and viewed through an administrator interface, and upon the occurrence of a security event, it may be possible to analyze the cause and formulate response strategies based on the logs. Furthermore, the artificial intelligence model can continuously improve its performance by utilizing the stored log data as training data, thereby enabling the implementation of a dynamic access control system that adapts to changes in user behavior.

[0159] According to the present embodiment, user-specific access rights can be automatically generated and updated by integrally analyzing user information, access history information, and access control policy information, thereby reducing the burden on administrators who previously had to manually set and maintain rights. Accordingly, the efficiency of right management can be improved even in environments with a large number of users and frequent changes in organizational structure, while simultaneously ensuring consistency and accuracy in right settings.

[0160] Furthermore, since the scope of permitted access can be determined by reflecting each user's actual access patterns and behavioral characteristics, the problem of granting unnecessary and excessive privileges can be prevented, while conversely, access necessary for task performance can be permitted in a timely manner. Accordingly, a balance between security and work efficiency can be maintained, and customized access control tailored to individual user characteristics becomes possible.

[0161] Furthermore, by reflecting abnormal signs in user behavior in real-time or near-real-time to restrict access or require additional authentication, abnormal access attempts can be blocked in advance. In particular, since judgments can be made by considering not only simple policy violations but also changes in behavioral patterns, more sophisticated security responses can be implemented, enabling early intervention against potential security threats.

[0162] Furthermore, access permissions can be automatically recalculated and reflected in response to various environmental changes, such as organizational transfers, shifts in working conditions, or policy changes, thereby minimizing issues like missing permissions or the retention of unnecessary permissions. Consequently, access permissions can always be kept up-to-date, enabling stable security management even in dynamic operating environments.

[0163] Furthermore, since the process of setting and changing access rights and their results can be systematically recorded and managed, this can be utilized for post-audits, security incident analysis, and policy improvement. This ensures transparency and traceability in system operations and enhances compliance with security regulations and the level of internal control.

[0164] Furthermore, by combining data-driven analysis with automated decision-making, repetitive management tasks can be reduced and operator intervention minimized, enabling autonomous system optimization and continuous performance improvement in the long term.

[0165] The above description is merely one embodiment for implementing an AI-based automatic user access authority generation and dynamic control system according to the present invention. The present invention is not limited to the above embodiment, and the technical spirit of the present invention extends to the scope in which various modifications can be made by anyone with ordinary knowledge in the field to which the invention belongs, without departing from the gist of the invention as claimed in the following patent claims. Explanation of the symbols

[0166] 1000: AI-based automatic user access authorization generation and dynamic control system 100: Data Management Department 110: User Information Collection Department 120: Access History Collection Unit 130: Data Integration Department 140: Time series sorting section 150: Data Cleansing Department 160: Behavioral Feature Generation Section 170: Feature Normalization Section 200: Authority Judgment Department 210: Clustering Operation Unit 220: Goodness of fit calculation unit 230: Risk Calculation Unit 240: Profile Generation Section 250: Pattern learning section 260: Anomaly Detection Unit 270: Initial Authority Creation Section 300: Authority Control Unit 310: Permission Settings Section 320: Policy Verification Department 330: Authority Confirmation 340: Authority Coordination Department 350: Anomaly Response Unit 400: Event detection unit 500: Audit Log Storage 10: HR Integration Server 20: Central Processing Server 30: Access control terminal 40: Authentication device 50: Electronic lock

Claims

Claim 1 A system implemented as a computing device having one or more processors and memory for storing a program that controls them, comprising: a data management unit that manages integrated data including user information, access history information, and access control policy information; and an authority determination unit that performs artificial intelligence analysis based on the integrated data managed by the data management unit to produce an access authority profile indicating the range of access allowed per user. The system includes an access control unit that sets user-specific access rights using an access rights profile calculated by the authority determination unit and controls access according to the set access rights. The authority determination unit comprises: a clustering operation unit that converts user-specific attribute values ​​into vector form using integrated data managed by the data management unit and performs similarity calculations between the converted vectors to form user groups; a suitability calculation unit that calculates probability values ​​for access allowed zones and access allowed time periods for specific users using the access history distribution of users included in the user groups formed by the clustering operation unit; and a risk calculation unit that calculates at least one indicator among user-specific authentication failure rate, night access rate, and abnormal zone access rate using integrated data managed by the data management unit, and calculates a risk score by applying a preset weight to the calculated indicator. An artificial intelligence-based automatic user access control and dynamic control system comprising a profile generation unit that generates an access authority profile including a user-specific access allowance zone, an access allowance time zone, and an authentication requirement level by deriving user-specific access candidate zones and access candidate time zones using probability values ​​calculated by the suitability calculation unit and determining whether to adopt the access candidate zones and access candidate time zones and the authentication requirement level using risk scores calculated by the risk calculation unit. Claim 2 The AI-based automatic generation of access rights and dynamic control system for each user, wherein the data management unit comprises: a user information collection unit that collects user information including at least one of user identification information, department information, job rank information, working hours information, and security level information; an access history collection unit that collects access history information including at least one of access time, access location, authentication method, authentication success status, number of authentication failures, time of stay, and movement path sequence; and a data integration unit that generates integrated data at the user level by combining the user information collected by the user information collection unit and the access history information collected by the access history collection unit based on a user identification value. Claim 3 The AI-based automatic generation of user-specific access rights and dynamic control system according to claim 2, wherein the data management unit further comprises: a time series sorting unit that sorts the integrated data generated by the data integration unit in chronological order to form user-specific access time series data; and a data refinement unit that generates analyzable refined data by performing at least one of missing value correction, outlier removal, and data consistency verification using the access time series data formed by the time series sorting unit. Claim 4 In claim 3, the data management unit further comprises: a behavioral feature generation unit that calculates at least one of user-specific access frequency, time-specific access ratio, zone dwell time, and movement path pattern as a quantitative value based on refined data generated by the data refinement unit; and a feature normalization unit that converts the quantitative value calculated by the behavioral feature generation unit to the same scale so that it can be compared between users and transmits it to the authority determination unit, characterized in that the AI-based automatic generation of user-specific access rights and dynamic control system. Claim 5 delete Claim 6 The AI-based automatic generation of user-specific access rights and dynamic control system according to claim 1, wherein the authority determination unit further comprises: a pattern learning unit that learns normal access patterns for each user by inputting integrated data managed by the data management unit into a time-series-based model; and an anomaly detection unit that calculates a deviation value by quantifying the difference between the data corresponding to the current access attempt and the normal access pattern learned by the pattern learning unit, and determines an abnormal access if the calculated deviation value exceeds a preset threshold value. Claim 7 The AI-based automatic user access authority generation and dynamic control system according to claim 1, wherein the authority determination unit calculates probability values ​​and risk scores for an access-allowed zone and an access-allowed time period through the suitability calculation unit and the risk calculation unit using the access history distribution of a user group formed by the clustering operation unit for a user whose access history is less than a preset threshold amount, and further includes an initial authority generation unit that generates an initial access authority profile using the calculation results. Claim 8 The AI-based automatic generation and dynamic control system for user-specific access rights according to claim 1, wherein the authorization control unit comprises: an authorization setting unit that sets an access allowance zone, an access allowance time zone, and an authentication requirement level as user-specific access rights based on an access rights profile generated by the authorization determination unit; a policy verification unit that determines whether the access rights set by the authorization setting unit satisfy policy conditions using access control policy information managed by the data management unit; and an authorization confirmation unit that determines the final access rights by maintaining or modifying the access rights set by the authorization setting unit according to the determination result of the policy verification unit, and applies the determined access rights to an access control target. Claim 9 In claim 8, the AI-based automatic generation and dynamic control system for user-specific access rights is characterized in that the authorization control unit further includes an authorization adjustment unit that reduces the access allowance zone set in the access authority profile, restricts the access allowance time period, or raises the authentication requirement level when the policy verification unit determines a policy violation. Claim 10 In claim 8, the authority control unit further comprises an abnormal response unit that temporarily restricts access rights for the user, blocks access to a specific area, or requires an additional authentication procedure when the policy verification unit determines a policy violation, characterized in that the AI-based user-specific access authority automatic generation and dynamic control system. Claim 11 The AI-based automatic generation and dynamic control system for user-specific access rights according to claim 1, further comprising an event detection unit that detects at least one of a change in user information, organizational transfer, change in working hours, change in project assignment, and change in access control policy, wherein the authority determination unit regenerates an access right profile based on the change information detected by the event detection unit, and the authority control unit updates the access right based on the access right profile regenerated by the authority determination unit. Claim 12 An artificial intelligence-based automatic user access control and dynamic control system according to claim 1, further comprising an audit log storage unit that stores at least one of an access right determined by the authority control unit, an access right change history, a policy verification result, and an abnormal access judgment result.

Images