Access permission control method, device and equipment based on tag data

Abstract

The present application discloses a method, device and equipment for access rights control based on label data, which relates to the field of computer technology and can use different types of entity label data to comprehensively evaluate access rights, greatly enriching the attribute information required for access rights control and improving the accuracy of access rights evaluation results. The method includes: obtaining entity attribute data in different data systems; performing feature mining on the entity attribute data using the characteristic fields of the entity in different attribute dimensions to generate different types of entity label data, and the different types of entity label data correspond to different confidence levels; selecting target entity label data with a confidence level greater than a preset threshold from the different types of entity label data to perform access rights control on the entity.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device and equipment for access control based on tag data. Background Art

[0002] With the rapid development of emerging technologies such as big data, cloud computing, and the Internet of Things, enterprise applications are being integrated on a large scale and application boundaries are gradually disappearing. Traditional role-based access control for closed environments is limited by the explosive growth of roles, and the configuration complexity of access control is increasing exponentially.

[0003] In the related art, attribute-based access control uses the attributes of various access subjects, environments, and access objects to evaluate in real time whether the current access subject should be authorized, and controls the user's access rights based on the evaluation results. However, the attributes referenced by current access control usually only consider the device's perception items, simple time and space attributes, or a fuzzy user behavior score. For example, access rights are controlled by setting the user's login time, whether the user has enabled permissions, etc. This process is difficult to dig deeper attributes to comprehensively evaluate the user's access rights, resulting in the omission of attribute evaluations in the access control process, affecting the accuracy of the access rights evaluation results. Summary of the invention

[0004] In view of this, the present application provides a method, device and equipment for access rights control based on tag data, the main purpose of which is to solve the problem that the access rights control process in the prior art misses the evaluation of attributes, affecting the accuracy of the access rights evaluation results.

[0005] According to a first aspect of the present application, a method for access control based on tag data is provided, the method comprising:

[0006] Obtain entity attribute data from different data systems;

[0007] Performing feature mining on the entity attribute data using the entity's feature fields in different attribute dimensions to generate different types of entity label data, wherein the different types of entity label data have corresponding different confidence levels;

[0008] Select target entity label data with a confidence level greater than a preset threshold from among the different types of entity label data to perform access permission control on the entity.

[0009] Furthermore, the obtaining of entity attribute data in different data systems specifically includes:

[0010] Connecting to different data systems through a pre-set protocol interface to obtain entity data of different data types generated in different system environments, wherein the entity data includes at least one or more of log data, identity data, and business data;

[0011] The entity data generated in the different system environments are processed to obtain entity attribute data.

[0012] Furthermore, the entity data generated in the different system environments are processed to obtain entity attribute data, specifically including:

[0013] Using a preset data format, cleaning the entity data generated in the different system environments to remove redundant information in the entity data;

[0014] By utilizing the correlation between entity attribute data, primary key association and fuzzy matching processing are performed on the entity data generated in the different system environments to obtain entity attribute data.

[0015] Furthermore, the attribute dimension includes a fact attribute dimension and a prediction attribute dimension, and the feature fields of the entity in different attribute dimensions are used to perform feature mining on the entity attribute data to generate different types of entity label data, specifically including:

[0016] Using the characteristic field of the entity in the fact attribute dimension, feature extraction and statistics are performed on the entity attribute data to generate fact label data representing the entity, wherein the fact label data has a first confidence level;

[0017] Utilizing the feature fields of the entity in the prediction attribute dimension, the entity attribute data is input into a pre-trained machine model for feature clustering and analysis to generate prediction label data representing the entity. The machine model is trained using historical entity attribute data as sample data, and the prediction label data has a second confidence level.

[0018] Furthermore, the characteristic fields on the fact attribute dimension include static fields and dynamic fields, the static fields are triggered by the current state of the entity attribute data, and the dynamic fields are triggered by the historical accumulated state of the entity attribute data. The characteristic fields of the entity on the fact attribute dimension are used to extract and count the entity attribute data to generate fact label data representing the entity, specifically including:

[0019] For the static fields of the entity in the fact attribute dimension, extract the feature values ​​triggered by the entity attribute data in the current state as the fact label data representing the entity;

[0020] For the dynamic fields of the entity in the fact attribute dimension, the characteristic values ​​triggered by the historical accumulation state of the entity attribute data within a preset time period are counted as the fact label data representing the entity.

[0021] Furthermore, after the entity attribute data is input into a pre-trained machine model for feature clustering and analysis by using the feature field of the entity in the prediction attribute dimension to generate prediction label data representing the entity, the method further includes:

[0022] Using the fact label data to judge the predefined label data, and using the judgment result to generate model label data representing the entity, the model label data has a third confidence level, and the third confidence level is calculated by using the first confidence level; and / or

[0023] After associating the fact label data and the predicted label data using a pre-defined logical rule, the pre-defined label data is judged, and the model label data representing the entity is generated using the judgment result, wherein the model label data has a third confidence level, and the third confidence level is calculated by weighted sum of the first confidence level and the second confidence level;

[0024] The third confidence level is greater than the second confidence level, and less than or equal to the first confidence level.

[0025] Furthermore, the method further comprises:

[0026] Determine whether a third confidence level corresponding to the model label data is greater than a first preset threshold;

[0027] If not, the model tag data is sent to the physical device for authentication using a tag feedback mechanism, and the model tag data is updated based on the authentication result.

[0028] Furthermore, before the fact label data and the predicted label data are associated with each other using the pre-defined logical rules, the method further includes:

[0029] Update the predicted label data by deleting the predicted label data whose second confidence is less than a second preset threshold; or

[0030] The predicted tag data is sent to the physical device for authentication using a tag feedback mechanism, and the predicted tag data is updated based on the authentication result.

[0031] Furthermore, the selecting target entity label data with a confidence level greater than a preset threshold from the different types of entity label data to perform access permission control on the entity specifically includes:

[0032] In response to an entity access authority evaluation instruction, extracting attribute information of the entity session information on different attribute tags for the entity session information carried in the evaluation instruction;

[0033] Traversing and matching the target entity tag data based on the attribute information of the entity session information on different attribute tags, and using the target entity tag data that matches consistently as the session tag data that characterizes the entity;

[0034] The session tag data is used to evaluate the entity access rights, and the access rights are controlled according to the evaluation results.

[0035] Furthermore, the use of the session tag data to evaluate entity access rights and performing access rights control according to the evaluation results specifically includes:

[0036] Using the tag determination rule pre-set for the access authority, determining whether the session tag data matches the tag determination rule;

[0037] If so, an evaluation result is generated that the entity has access rights, otherwise, an evaluation result is generated that the entity does not have access rights.

[0038] According to a second aspect of the present application, a device for access rights control based on tag data is provided, the device comprising:

[0039] An acquisition unit, used to acquire entity attribute data from different data systems;

[0040] A generating unit, configured to perform feature mining on the entity attribute data using the characteristic fields of the entity in different attribute dimensions, and generate different types of entity label data, wherein the different types of entity label data have corresponding different confidence levels;

[0041] The control unit is used to select target entity label data with a confidence level greater than a preset threshold from the different types of entity label data to perform access permission control on the entity.

[0042] Furthermore, the acquisition unit includes:

[0043] An acquisition module, used to connect to different data systems through a preset protocol interface to acquire entity data of different data types generated in different system environments, wherein the entity data includes at least one or more of log data, identity data, and business data;

[0044] The processing module is used to process the entity data generated in the different system environments to obtain entity attribute data.

[0045] Furthermore, the processing module is specifically used to clean the entity data generated in the different system environments using a preset data format to remove redundant information in the entity data;

[0046] The processing module is specifically used to utilize the correlation between entity attribute data to perform primary key association and fuzzy matching processing on the entity data generated in the different system environments to obtain entity attribute data.

[0047] Furthermore, the attribute dimension includes a fact attribute dimension and a prediction attribute dimension, and the generating unit includes:

[0048] A first generating module, configured to extract and count the entity attribute data using the feature fields of the entity in the fact attribute dimension, and generate fact label data representing the entity, wherein the fact label data has a first confidence level;

[0049] The second generation module is used to utilize the characteristic fields of the entity in the prediction attribute dimension, input the entity attribute data into a pre-trained machine model for feature clustering and analysis, and generate prediction label data representing the entity, wherein the machine model is trained using historical entity attribute data as sample data, and the prediction label data has a second confidence level.

[0050] Furthermore, the characteristic fields on the fact attribute dimension include static fields and dynamic fields, the static fields are triggered by the current state of the entity attribute data, and the dynamic fields are triggered by the historical accumulated state of the entity attribute data, and the first generating module is specifically used to extract the characteristic values ​​triggered by the entity attribute data in the current state for the static fields on the fact attribute dimension of the entity as the fact label data representing the entity;

[0051] The first generation module is further specifically used to count the characteristic values ​​triggered by the historical accumulation state of the entity attribute data within a preset time period for the dynamic field of the entity in the fact attribute dimension as the fact label data representing the entity.

[0052] Furthermore, the generating unit further includes:

[0053] A third generation module is used to use the fact label data to judge the predefined label data after inputting the entity attribute data into a pre-trained machine model for feature clustering and analysis using the feature field of the entity in the prediction attribute dimension to generate prediction label data representing the entity, and use the judgment result to generate model label data representing the entity, wherein the model label data has a third confidence level, and the third confidence level is calculated by the first confidence level; and / or

[0054] After associating the fact label data and the predicted label data using a pre-defined logical rule, the pre-defined label data is judged, and the model label data representing the entity is generated using the judgment result, wherein the model label data has a third confidence level, and the third confidence level is calculated by weighted sum of the first confidence level and the second confidence level;

[0055] The third confidence level is greater than the second confidence level, and less than or equal to the first confidence level.

[0056] Furthermore, the third generating module is specifically used to determine whether the third confidence level corresponding to the model label data is greater than a first preset threshold;

[0057] The third generation module is further specifically used to, if not, use a label feedback mechanism to send the model label data to the physical device for authentication, and update the model label data based on the authentication result.

[0058] Furthermore, the third generation module is further specifically used to update the predicted label data by deleting the predicted label data whose second confidence is less than a second preset threshold before associating the fact label data and the predicted label data using the pre-established logical rule; or

[0059] The predicted tag data is sent to the physical device for authentication using a tag feedback mechanism, and the predicted tag data is updated based on the authentication result.

[0060] Furthermore, the control unit comprises:

[0061] An extraction module, configured to extract attribute information of the entity session information on different attribute tags in response to an entity access authority evaluation instruction and for the entity session information carried by the evaluation instruction;

[0062] A matching module, configured to traverse and match the target entity tag data based on the attribute information of the entity session information on different attribute tags, and use the target entity tag data that matches consistently as the session tag data representing the entity;

[0063] An evaluation module is used to evaluate entity access rights using the session tag data and perform access rights control based on the evaluation results.

[0064] Furthermore, the evaluation module is specifically used to use the tag determination rule pre-set for the access authority to determine whether the session tag data hits the tag determination rule;

[0065] The evaluation module is further specifically configured to generate an evaluation result indicating that the entity has access rights if yes, and otherwise, generate an evaluation result indicating that the entity does not have access rights.

[0066] According to a third aspect of the present application, a storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the above-mentioned access permission control method based on tag data is implemented.

[0067] According to a fourth aspect of the present application, there is provided an access permission control device based on tag data, comprising a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor implements the above-mentioned access permission control method based on tag data when executing the program.

[0068] Through the above technical solution, the present application provides a method, device and equipment for access permission control based on label data, which obtains entity attribute data from different data systems, and uses the characteristic fields of entities in different attribute dimensions to perform feature mining on entity attribute data, generates different types of entity label data, and further selects target entity label data with a confidence level greater than a preset threshold in different types of entity label data to perform access permission control on entities. Compared with the current attribute-based access permission control method, the different types of entity label data in the present application can mine deeper attribute information, have higher interpretability and flexibility, and greatly enrich the attribute information required for access permission control. The session label data uses different types of entity label data to conduct a comprehensive assessment of access permissions, which can support the trust assessment of access entities and improve the accuracy of access permission assessment results.

[0069] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0071] Figure 1 A schematic diagram of a process of access rights control method based on tag data provided by an embodiment of the present application is shown;

[0072] Figure 2 A schematic diagram of a process of another access rights control method based on tag data provided in an embodiment of the present application is shown;

[0073] Figure 3 A flowchart of a method for controlling access rights based on tag data provided by an embodiment of the present application is shown;

[0074] Figure 4 A structural block diagram of the access permission control platform provided by an embodiment of the present application is shown;

[0075] Figure 5 A schematic diagram of a process of another access rights control method based on tag data provided in an embodiment of the present application is shown;

[0076] Figure 6 A schematic structural diagram of an access rights control device based on tag data provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0077] The present application will be described in detail below with reference to the accompanying drawings and in combination with embodiments. It should be noted that the embodiments and features in the embodiments of the present application can be combined with each other without conflict.

[0078] At present, it is difficult for the existing attribute-based access control process to mine deeper attributes to comprehensively evaluate the user's access rights, which makes the access control process miss the evaluation of attributes, affecting the accuracy of the access rights evaluation results. In order to solve this problem, this embodiment provides an access rights control method based on tag data, such as Figure 1 As shown, the method can be applied to the access permission control platform, and includes the following steps:

[0079] 101. Obtain entity attribute data from different data systems.

[0080] Among them, different data systems can be databases, data platforms, and business platforms that store and generate various types of data. Here, various types of data may include access log data, identity authority data, business management data, etc. generated around entity attributes. The entity is equivalent to the access subject and can represent the user identity, such as the user name or terminal device. The entity attribute can be a static attribute, which is equivalent to the user's basic information record, such as user identity information, user account information, etc., or a dynamic attribute, which is equivalent to the user's behavior record, such as user access behavior, user login behavior, etc. Access log data is data related to various access behaviors of entities recorded through the database, including access resource content, access time, and access times. Identity authority data is a golden record from user devices and management devices, with a high degree of credibility, including basic attribute information of users and devices, such as user name, user ID, user account activation date, user role, device type, device identification, etc. Business management data is business data associated with the use of the device, such as financial settlement business data, communication business data, sales business data, etc.

[0081] Since the various types of data that can be connected to different data systems come from different data sources and different data access environments, the data generated by the same access entity will form different data structures and different data states. For example, data platform A uses field encoding format to store data, and data platform B uses wide table format to store data. Data platform A generates access records of entity a logging in remotely during a certain period of time, and data platform B generates access records of entity a connecting to the external network. In order to summarize the attribute data associated with the entity, on the one hand, the various types of data collected around the entity can be processed in a unified format to form entity attribute data with the same data structure. On the other hand, various types of data can be associated according to the entity identifier to form entity attribute data summarized by different data systems. It should be noted that entity attribute data will be generated for each entity identifier here, and this process is equivalent to summarizing the entity attribute data collected by the entity from various data systems.

[0082] The executor of the embodiment of the present invention may be an access permission control device based on tag data, or may be a server of an access permission control platform. The access control platform may be connected to different data systems, and may obtain various types of data generated in different data systems, and may process various types of data to obtain entity attribute data. The entity attribute data may be associated with more data source information, and may obtain deeper attribute data to describe the entity, thereby making the entity identity more explainable.

[0083] 102. Use the entity's feature fields in different attribute dimensions to perform feature mining on entity attribute data and generate different types of entity label data.

[0084] In the embodiments of the present invention, considering that entity attribute data has feature fields of different attribute dimensions in describing the entity state, there are corresponding different application capabilities. For example, entity attribute data such as the number of logins and the device used can be used to characterize the current event state of the entity, while entity attribute data such as the login location and the connection network can be used to predict the future event state of the entity. Here, with regard to the application capabilities of the entity attribute data, the feature fields of the entity in different attribute dimensions can be used to perform feature mining on the entity attribute data to generate different types of entity label data.

[0085] In the specific feature mining process, since entity attribute data usually has a high degree of credibility, when data security is not involved, the entity attribute data can be directly processed by feature field extraction and statistics to form fact label data that characterizes the entity, for example, the frequency of users logging in to a certain IP address, the frequency of users using a certain device, the user's business role, the device security configuration level, etc. within a period. The fact label data can characterize the current event state of the entity. Here, for each record in the entity attribute data, a fact label data that characterizes the entity can be formed. The fact label data generally has 100% confidence. In the case of data security, certain risks can be mined from the entity attribute data. The entity attribute data can be processed by feature field prediction to form predicted label data that characterizes the entity, for example, user behavior deviation, machine crawler, and overstepping of authority. The predicted label data can predict the future event state of the entity. Here, for multiple records in the entity attribute data, a predicted label data that characterizes the entity can be formed. The confidence of the predicted label data is between 0 and 1 according to the prediction accuracy.

[0086] 103. Select target entity label data with a confidence level greater than a preset threshold from among different types of entity label data to perform access permission control on the entity.

[0087] Taking into account the different ways in which entity data labels are generated, different types of entity label data have different confidence levels. In order to improve the accuracy of access permission control, we can select target entity label data with a confidence level greater than a preset threshold from different types of entity label data to perform access permission control on entities. If we want to ensure that the entity label data is completely accurate, we can select entity label data with a confidence level of 100%, preferably entity label data with a confidence level greater than 95%.

[0088] Since entity access rights often change and problems with excessive permissions sometimes occur, it is necessary to evaluate entity access rights based on the current session state. Specifically, in the process of using target entity tag data to control entity access rights, the session information formed based on the current session state can be matched with the target entity tag, and the matching target entity tag data can be used to determine whether the entity has access rights. Normally, each time an entity triggers a session access request, it carries entity session information, which may include user name, device name, device IP address, and other information, which can indicate attribute information of the entity's current state. The attribute information of the entity's current state may not have access rights, or it may be an access behavior triggered by an attacker after stealing an account. Here, the entity session information can be matched with the entity tag data to obtain an entity session tag, which is equivalent to matching consistent tag data from different types of entity tag data, and can accurately characterize the entity identity by combining different types of entity tag data, with higher credibility. For example, when the entity session information carries attribute information such as zhangsan, zhagnsan_device, ip10.94.56, the user name, user device, IP address, and other tag data in different types of entity tag data are matched to obtain session tag data including the user's commonly used IP, commonly used time period, device configuration security, and device environment risk.

[0089] In the process of using session tag data to evaluate entity access rights, the access rules pre-set by the authorization system for each resource can be used to evaluate the entity access rights, and determine whether the entity has access rights based on the evaluation results. The access rules can be set by the authorization system according to the entity role. The relevant permission tags are set to determine whether the session tag data hits the corresponding permission tag. If it hits, the entity is determined to have access rights, otherwise it is determined that the entity does not have access rights. For entities with access rights, the permission level of the entity that can access the resources can be further evaluated based on the hit permission tag. Here, the evaluation results can reflect whether the entity has access rights and the permission level of the accessible resources. For example, the evaluation results reflect that entity A will have the permission to access website m, but not the permission to access website n, and entity B has the permission to access website m and website n. Of course, the evaluation results can also reflect whether the entity has risk factors. In the case of risk factors, the entity access rights can be restricted or a verification request can be sent to the entity terminal to verify the entity identity. After the entity identity is confirmed, the entity is authorized to access, and the entity access is intercepted when the entity identity is not confirmed or the entity identity is confirmed incorrectly.

[0090] The access permission control method based on label data provided in the embodiment of the present application obtains entity attribute data from different data systems, and uses the characteristic fields of the entity in different attribute dimensions to perform feature mining on the entity attribute data, generates different types of entity label data, and further selects target entity label data with a confidence greater than a preset threshold in different types of entity label data to perform access permission control on the entity. Compared with the current attribute-based access permission control method, the different types of entity label data in the present application can mine deeper attribute information, have higher interpretability and flexibility, and greatly enrich the attribute information required for access permission control. The session label data uses different types of entity label data to conduct a comprehensive assessment of access permissions, which can support the trust assessment of the access entity and improve the accuracy of the access permission assessment results.

[0091] Further, as a refinement and extension of the specific implementation of the above embodiment, in order to fully illustrate the specific implementation process of this embodiment, this embodiment provides another access permission control method based on tag data, such as Figure 2 As shown, the method includes:

[0092] 201. Connect to different data systems through pre-set protocol interfaces to obtain entity data of different data types generated in different system environments.

[0093] Among them, the pre-set protocol interfaces may include but are not limited to sylog, http, spml, etc. Through the protocol interface, different data systems can be connected to complete the connection with the entity data in the corresponding system environment. Here, the entity data at least includes one or more of log data, identity data and business data. Specifically, the sylog protocol interface can be connected to the log server, and receive the authentication log and access log generated by the log server. The http protocol interface can be connected to the request server, and receive the device perception log and device management information generated by the request server. The spml protocol interface can be connected to the business server, and receive the user directory information generated by the business server.

[0094] It is understandable that, considering the randomness and timeliness of entity data generated in different data systems, a time interval or time point for receiving entity data can be set for each data system or different data systems. For example, entity data generated by the log server can be received every 2 hours, or entity data generated by the log server can be received at 0:00 every day.

[0095] 202. Process entity data generated in different system environments to obtain entity attribute data.

[0096] Specifically, the preprocessing process mainly includes two parts. One part is to use the preset data format to clean the entity data generated in different system environments to remove redundant information in the entity data. This processing process mainly verifies the data integrity, uniqueness, authority and legality, eliminates irrelevant information, and converts and unifies the identifiers and data formats of data fields with the same meaning; the other part is to use the correlation between entity attribute data to perform primary key association and fuzzy matching on the entity data generated in different system environments to obtain entity attribute data around the entity identifier. This processing process mainly associates the correlation between data from different sources and data with different structures, including but not limited to primary key association of data from different tables and fuzzy matching of data from different sources, so as to determine whether the data is generated by the same entity.

[0097] It should be noted that in order to speed up the data processing progress, the data processing mode used in the preprocessing here may include but is not limited to the application of various open source distributed systems, such as streaming data processing using flink and batch data processing using spark.

[0098] 203. Using the characteristic fields of the entity in the fact attribute dimension, feature extraction and statistics are performed on the entity attribute data to generate fact label data representing the entity.

[0099] It can be understood that entity attribute data has characteristic fields in different attribute dimensions. The characteristic fields in the fact attribute dimension include static fields and dynamic fields. The static fields are triggered by the current state of the entity attribute data. For the static fields of the entity in the fact dimension, the characteristic values ​​triggered by the entity attribute data in the current state can be extracted as the fact label data representing the entity. Here, the current state is equivalent to the state of the entity at the current moment or the behavior triggered at the current moment, for example, the user's current login device, the network address currently connected to the user's device, and the security level of the user's current device. The dynamic fields are triggered by the historical accumulated state of the entity attribute data. For the dynamic fields of the entity in the fact dimension, the characteristic values ​​triggered by the historical accumulated state of the entity attribute data within a preset time period can be counted as the fact label data representing the entity. Here, the historical accumulated state is equivalent to the accumulation of state changes or behavior changes experienced by the entity over a period of time, for example, the accumulated login frequency of the user over a period of time, and the frequency of the user using a certain device over a period of time.

[0100] Taking the feature extraction and statistics of entity attribute data with entity identification zhangsan as an example, by counting zhangsan's IP usage, system access time, and device usage over a period of time, we generate fact label data such as the most commonly used IP, most commonly used time period, and most commonly used device for entity identification zhangsan. Through the device perception log of remote control activation, lock screen password setting, and blacklist software operation, we generate fact label data such as high configuration security level and environment risks for entity identification zhangsan. According to the device management information, we generate fact label data such as registered devices and controlled devices for entity identification zhangsan.

[0101] It should be noted that since the fact label data representing the entity is a characteristic value triggered by the current state of the entity in each attribute dimension or the historical cumulative triggering, the fact label data has a first confidence level, that is, when no risk factors are involved, the value of the fact label data at the corresponding confidence level usually reaches 100%.

[0102] 204. Using the feature fields of the entity in the prediction attribute dimension, the entity attribute data is input into the pre-trained machine model for feature clustering and analysis to generate prediction label data representing the entity.

[0103] Specifically, the entity attribute data can be input into a pre-built prediction model, which can first cluster and analyze the characteristic values ​​of each attribute dimension in the entity attribute data, extract the entity's behavior pattern, and then identify whether the entity has an abnormality on the preset risk factor label based on the entity's behavior pattern. If so, the entity is output on the risk factor label as the prediction label data that characterizes the entity.

[0104] In the process of constructing the above prediction model, various machine learning models can be used to train historical sample data. The machine learning models include but are not limited to unsupervised learning models such as Bayesian, logistic regression, decision tree, mean clustering, dbscan clustering, oneclss random forest model, and other unsupervised learning models, as well as deep learning models such as recurrent neural network and long short-term memory model.

[0105] It should be noted that since the predicted label data representing the entity is predicted by the feature value triggered by the current state of the entity in each attribute dimension or the historical cumulative triggering using the prediction model, it cannot reach the first confidence of the factual label data. The predicted label data has a second confidence. In other words, affected by the training accuracy of the prediction model and the validity of the feature value, the value of the predicted label data at the corresponding confidence level is usually difficult to reach 100%, but is distributed between 0-1. Although the factual label data and the predicted label data have different confidence levels, the use of the factual label data certainly has a higher credibility, but if the access permission control is only based on the factual label data, it is difficult to predict the risk situation, which makes the access permission control process have hidden dangers. Here, the predicted label data can make up for the missing attributes of the factual label data to a certain extent.

[0106] 205. Update the predicted label data by deleting the predicted label data whose second confidence is less than the second preset threshold, or send the predicted label data to the physical device for authentication by using a label feedback mechanism, and update the predicted label data based on the authentication result.

[0107] It is understandable that, considering the different ways in which entity data labels are generated, different types of entity label data have different confidence levels. In order to improve the evaluation accuracy of access permission control, the predicted label data can be updated here.

[0108] Furthermore, considering the accuracy of the update of the predicted label data, on the one hand, the predicted label data can be updated by deleting the predicted label whose second confidence is less than the second preset threshold. For example, the predicted label data with a second confidence less than 90% can be deleted. A label feedback mechanism can also be set for the predicted entity data, and the predicted label data can be updated using the label feedback mechanism. The label feedback mechanism can be used for confirmation by operators, automatic notification to users, and suggested actions, etc., and the predicted label data can be updated after receiving feedback including but not limited to administrators, business managers, users, etc. Here, the predicted label data can be updated by adjusting the second confidence of the label prediction data or deleting the predicted label data.

[0109] 206. Use the factual label data to judge the pre-defined label data, and use the judgment result to generate the model label data representing the entity, and / or use the pre-established logical rules to associate the factual label data with the predicted label data, and then judge the pre-defined label data, and use the judgment result to generate the model label data representing the entity.

[0110] It is understandable that although the factual label data and predicted label data cover the vast majority of label data involved in the entity access process, single-dimensional label data is difficult to reflect the deeper attributes of the entity. Here, label data can be pre-defined for the factual dimension, and the factual label data can be used to judge the pre-defined label data, and the judgment results can be used to generate model label data that represents the entity. For example, to define manipulated label data, you can use the label data such as shared location, consistent device usage, and consistent geographic location in the factual label data to make judgments and generate model label data for entities that are not manipulated. At this time, the model label data is obtained by judging the fact label data, and the model label data has a third confidence, which is calculated by the first confidence. The specific calculation method can be determined in combination with the number of hit fact label data. The weight values ​​of different fact label data on the defined label data can also be set. The third confidence is calculated by weighted summing up the weight values ​​corresponding to the hit fact label data. For example, a weight of 0.8 is set consistently for the geographic location, a weight of 0.7 is set consistently for the device used, and a weight of 0.7 is set for the shared location. The weighted sum of the weight values ​​results in a confidence of 0.73. It is also possible to pre-define label data in combination with the fact dimension and the prediction dimension, associate the fact label data with the prediction label data using pre-established logical rules, judge the pre-defined label data, and use the judgment result to generate model label data representing the entity. For example, to define manipulated label data, the expired account in the fact label data can be associated with the account in the prediction label data to determine the risk, and generate a model data label of the manipulated entity. The pre-established logical rules can be set in combination with the attribute information of both the fact label data and the prediction label data, including but not limited to AND, OR, NOT, time series arrangement, etc. For example, the fact label data represents that the user uses an overseas VPN to log in, and the prediction label data represents that the user logs in from a different place to steal the account. At this time, the model label data of the user logging in from a different place during this time period is determined by the logical rules. At this time, the model label data is determined by combining the fact label data with the prediction label data, and the model label data has a third confidence calculated by weighted sum of the first confidence and the second confidence, and the third confidence is greater than the second confidence and less than or equal to the first confidence.

[0111] Furthermore, in order to ensure the reliability of the model label data, at the same time, manual operation can be introduced in the process of using the judgment results to generate the representation data. For the case where there is a large gap between the confidence of the fact label data and the predicted label, that is, the value formed by the gap between the two is greater than the preset value, or for the label data with a smaller third confidence in the model label data, the generated model label data can be sent to the entity device for feedback confirmation. Specifically, it can be judged whether the third confidence corresponding to the model label data is greater than the first preset threshold. If not, it means that the confidence of the model label data is low and the application value is low. The model label data is further sent to the entity device for authentication using the label feedback mechanism, and the model label data is updated based on the authentication result. Here, updating the model label data is the process of updating the third confidence. For example, for the model label data that has been successfully confirmed, the third confidence can be updated to 100%, and for the model label data that has not been confirmed, the third confidence can be reduced by a certain percentage. For the model data label that has failed to be confirmed as invalid label data, the third confidence can be updated to 0, that is, the model label data is deleted.

[0112] In practical applications, since factual data labels with a confidence level of 100% are added to the model data labels as the basis for generation and manual operations are introduced for confirmation, the third confidence level of the model label data can usually reach more than 95%.

[0113] 207 . In response to the entity access authority evaluation instruction, extract attribute information of the entity session information on different attribute tags for the entity session information carried in the evaluation instruction.

[0114] 208. Traverse and match target entity tag data based on attribute information on different attribute tags of the entity session information, and use the target entity tag data that matches consistently as session tag data representing the entity.

[0115] It is understandable that entity session information usually includes a variety of attribute information that characterizes the current state of the entity, such as user device type, user login address, etc. Since entity label data has multiple types, in the process of matching entity session information with entity label data, each attribute information that characterizes the current state of the entity can be matched with different types of entity label data respectively. If the attribute information in the entity session information is not successfully matched in a certain type of entity label data, the attribute information is matched with other types of entity label data, and then the label data that matches the attribute information is found as the session label data. For example, the user device type in the entity session information may not be successfully matched in the factual label data, but it will be matched in the predicted label data, and then the matching label data will be formed into session label data.

[0116] 209. Use session tag data to evaluate entity access rights and perform access rights control based on the evaluation results.

[0117] Specifically, the label determination rules pre-set for access rights can be used. The label determination rules are usually set by the authorization system according to the entity role. The label conditions that need to be met are set for different entity roles. For example, the entity role needs to meet both label conditions A and label conditions B to access website m, and the entity role only needs to meet label condition C to access website n. It is further determined whether the session label data hits the label determination rules, that is, whether the session label data meets the label conditions set for the corresponding entity role. If so, an evaluation result is generated that the entity has access rights. Otherwise, an evaluation result is generated that the entity does not have access rights.

[0118] Compared with the existing authorization control system that only supports specific device perception items and user risk points, the label-based access permission control process in this embodiment comprehensively considers the historical interaction information between devices and users and business systems, identity authority data, business data, etc., to generate identity labels with high interpretability, high flexibility and high accuracy, which greatly enriches the attribute information required for access permission control, and can support trust assessment of access subjects consisting of users and devices.

[0119] The specific access control process based on tag data is as follows: Figure 3 As shown, on the one hand, it is a process of tag generation, and the generated entity tag data is stored in the tag warehouse, and on the other hand, it is a process of authentication and access login. When authentication and access login occur, the evaluation instruction of the entity access rights will be triggered accordingly, and an entity session log will be formed. The attribute tags output by the tag warehouse will be matched according to the relevant entity information to generate session tags, and the session tags will be further provided to the access rights control system, which will evaluate whether the entity has access rights and control access rights according to the evaluation results. It should be noted that in order to connect the entity attribute tags to different application scenarios, the tag warehouse here can directly provide the generated entity tag data to the access rights control system, and can also form session tag data after matching the entity tag data with the relevant entity information and provide it to the access rights system, which is not limited here.

[0120] In actual application scenarios, the access permission control process based on tag data can be used in the access permission control platform. The structure of the access permission control platform is as follows: Figure 4As shown in the figure, it mainly includes four modules, which are divided into label generation module, label matching module, label operation module and label supply module. Among them, the label generation module is mainly composed of data connector, data processing engine, fact label generation engine, prediction model training engine, rule engine and label warehouse. The data connector mainly connects various types of data, mainly including logs, identity authority data, business management and others. The data processing engine mainly cleans the data in two aspects, one is to clarify the data, and the other is to complete the association of data from different sources. The data cleaning process is to verify the integrity, uniqueness, authority and legality of the access data, eliminate irrelevant information and redundant information, convert and unify the identification and data format of data fields with the same meaning, and the data association process is to associate the correlation of data from different sources and different structures, including but not limited to primary key association of data from different tables, fuzzy matching of data from different sources, etc. The fact generation engine is mainly used to generate fact labels, including but not limited to extraction and statistics based on data after the data processing engine. The prediction model training engine is mainly used to generate prediction labels, including but not limited to using machine learning models to predict data based on data after the data processing engine. The rule engine is mainly used to generate model labels. The input is fact labels and prediction labels. Model labels are generated according to the rules and feedback specified in the label operation rules. The label warehouse is used to store all generated labels, including but not limited to fact labels, prediction labels and model labels for entities such as users and devices. The storage mode can be in the form of wide tables or graph databases, and can associate wide tables and graph databases related to different entities. The label matching module mainly matches labels based on the entity session information transmitted from the factual session log and the fact labels, prediction labels and model labels stored in the label warehouse. The label operation module mainly includes two parts: label confirmation and adjustment, and label rule operation. Label confirmation and adjustment can introduce a workflow processing mechanism for labels with a confidence level less than a preset number after the session label is generated, including work order confirmation, automatic notification to users, and recommended actions. After receiving feedback from relevant personnel, the relevant labels are updated, adjusted, and deleted; label rule operation involves two aspects. On the one hand, the generation rules of prediction labels and model labels are adjusted by introducing experts and label feedback mechanisms, and on the other hand, the workflow of label confirmation and adjustment is formulated and adjusted. The label supply module includes but is not limited to continuously providing labels for authorization systems, trust assessment systems, etc., supports batch supply, incremental supply, and supports real-time query and push.

[0121] Further, as Figure 1-Figure 2 The specific implementation of the method, the embodiment of the present application provides an access control device based on tag data, such as Figure 5 As shown, the device includes: an acquisition unit 31, a generation unit 32, an evaluation unit 33, and a control unit 34.

[0122] The acquisition unit 31 can be used to acquire entity attribute data in different data systems;

[0123] The generating unit 32 may be used to perform feature mining on the entity attribute data using the characteristic fields of the entity in different attribute dimensions to generate different types of entity label data, wherein the different types of entity label data have corresponding different confidence levels;

[0124] The control unit 33 may be configured to select target entity tag data with a confidence level greater than a preset threshold from among the different types of entity tag data to perform access permission control on the entity.

[0125] The access permission control device based on label data provided by the embodiment of the present invention obtains entity attribute data from different data systems, and uses the characteristic fields of the entity in different attribute dimensions to perform feature mining on the entity attribute data, generates different types of entity label data, and further selects target entity label data with a confidence greater than a preset threshold in different types of entity label data to perform access permission control on the entity. Compared with the current attribute-based access permission control method, the different types of entity label data in this application can mine deeper attribute information, have higher interpretability and flexibility, and greatly enrich the attribute information required for access permission control. The session label data uses different types of entity label data to comprehensively evaluate access permissions, which can support the trust evaluation of the access entity and improve the accuracy of the access permission evaluation results.

[0126] In specific application scenarios, such as Figure 6 As shown, the acquisition unit 31 includes:

[0127] The acquisition module 311 can be used to connect to different data systems through a preset protocol interface to acquire entity data of different data types generated in different system environments, where the entity data includes at least one or more of log data, identity data, and business data;

[0128] The processing module 312 may be used to process the entity data generated in the different system environments to obtain entity attribute data.

[0129] In a specific application scenario, the processing module 312 may be used to clean the entity data generated in the different system environments using a preset data format to remove redundant information in the entity data.

[0130] The processing module 312 may be specifically configured to utilize the correlation between entity attribute data to perform primary key association and fuzzy matching processing on the entity data generated in the different system environments to obtain entity attribute data.

[0131] In specific application scenarios, such as Figure 6 As shown, the attribute dimension includes a fact attribute dimension and a prediction attribute dimension, and the generating unit 32 includes:

[0132] The first generating module 321 may be used to extract and count the entity attribute data using the characteristic fields of the entity in the fact attribute dimension, and generate fact label data representing the entity, wherein the fact label data has a first confidence level;

[0133] The second generation module 322 can be used to utilize the characteristic fields of the entity in the prediction attribute dimension, input the entity attribute data into a pre-trained machine model for feature clustering and analysis, and generate prediction label data representing the entity. The machine model is trained using historical entity attribute data as sample data, and the prediction label data has a second confidence level.

[0134] In a specific application scenario, the characteristic fields on the fact attribute dimension include static fields and dynamic fields. The static fields are triggered by the current state of the entity attribute data, and the dynamic fields are triggered by the historical accumulated state of the entity attribute data. The first generation module 321 can be specifically used to extract the characteristic values ​​triggered by the entity attribute data in the current state for the static fields on the fact attribute dimension of the entity as the fact label data representing the entity;

[0135] The first generating module 321 may be specifically used to count the characteristic values ​​triggered by the historical accumulation state of the entity attribute data within a preset time period for the dynamic field of the entity in the fact attribute dimension as the fact label data representing the entity.

[0136] In specific application scenarios, such as Figure 6 As shown, the generating unit 32 further includes:

[0137] A third generation module 323 may be used to, after utilizing the feature field of the entity in the prediction attribute dimension, input the entity attribute data into a pre-trained machine model for feature clustering and analysis, and generate prediction label data representing the entity, utilize the fact label data to determine the pre-defined label data, and use the determination result to generate model label data representing the entity, wherein the model label data has a third confidence level, and the third confidence level is calculated by using the first confidence level; and / or

[0138] After associating the fact label data and the predicted label data using a pre-defined logical rule, the pre-defined label data is judged, and the model label data representing the entity is generated using the judgment result, wherein the model label data has a third confidence level, and the third confidence level is calculated by weighted sum of the first confidence level and the second confidence level;

[0139] The third confidence level is greater than the second confidence level, and less than or equal to the first confidence level.

[0140] In a specific application scenario, the third generation module 323 may be specifically used to determine whether the third confidence level corresponding to the model label data is greater than a first preset threshold;

[0141] The third generation module 323 may be specifically configured to, if not, send the model label data to the physical device for authentication by using a label feedback mechanism, and update the model label data based on the authentication result.

[0142] In a specific application scenario, the third generation module 323 may also be used to update the predicted label data by deleting the predicted label data whose second confidence is less than a second preset threshold before associating the fact label data with the predicted label data using a pre-established logical rule; or

[0143] The predicted tag data is sent to the physical device for authentication using a tag feedback mechanism, and the predicted tag data is updated based on the authentication result.

[0144] In specific application scenarios, such as Figure 6 As shown, the control unit 33 includes:

[0145] The extraction module 331 may be used to extract attribute information of the entity session information on different attribute tags in response to the entity access permission evaluation instruction and for the entity session information carried by the evaluation instruction;

[0146] The matching module 332 may be used to traverse and match the target entity tag data based on the attribute information of the entity session information on different attribute tags, and use the target entity tag data that matches consistently as the session tag data representing the entity;

[0147] The evaluation module 333 may be used to evaluate entity access rights using the session tag data, and perform access rights control based on the evaluation results.

[0148] In a specific application scenario, the evaluation module 333 may be specifically used to use a tag determination rule pre-set for access rights to determine whether the session tag data matches the tag determination rule;

[0149] The evaluation module 333 may be specifically configured to generate an evaluation result indicating that the entity has the access rights if yes, and otherwise, generate an evaluation result indicating that the entity does not have the access rights.

[0150] It should be noted that for other corresponding descriptions of the functional units involved in the access control device based on tag data that can be applied to the access control platform side provided in this embodiment, please refer to Figure 1 and Figure 2 The corresponding description in will not be repeated here.

[0151] Based on this understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.), and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each implementation scenario of the present application.

[0152] Based on the above Figure 1-Figure 2 The method shown, and Figure 5-Figure 6 In order to achieve the above-mentioned purpose, the embodiment of the present application further provides a server-side entity device, which can be a computer, a server, or other network devices, etc. The entity device includes a storage medium and a processor; the storage medium is used to store a computer program; the processor is used to execute the computer program to achieve the above-mentioned Figure 1-Figure 2 The access permission control method based on tag data is shown.

[0153] Optionally, the above-mentioned physical devices may also include a user interface, a network interface, a camera, a radio frequency (RF) circuit, a sensor, an audio circuit, a WI-FI module, etc. The user interface may include a display screen (Display), an input unit such as a keyboard (Keyboard), etc., and the optional user interface may also include a USB interface, a card reader interface, etc. The network interface may optionally include a standard wired interface, a wireless interface (such as a WI-FI interface), etc.

[0154] Those skilled in the art will appreciate that the physical device structure for access rights control based on tag data provided in this embodiment does not constitute a limitation on the physical device, and may include more or fewer components, or a combination of certain components, or different component arrangements.

[0155] The storage medium may also include an operating system and a network communication module. The operating system is a program that manages the hardware and software resources of the physical device for the store search information processing, and supports the operation of the information processing program and other software and / or programs. The network communication module is used to realize the communication between the components inside the storage medium, and the communication with other hardware and software in the physical device for information processing.

[0156] Through the description of the above implementation methods, those skilled in the art can clearly understand that the present application can be implemented by means of software plus the necessary general hardware platform, or by hardware. By applying the technical solution of the present application, compared with the current existing methods, the different types of entity label data in the present application can dig out deeper attribute information, have higher interpretability and flexibility, and greatly enrich the attribute information required for access permission control. The session label data uses different types of entity label data to conduct a comprehensive assessment of access permissions, which can support the trust assessment of the access entity and improve the accuracy of the access permission assessment results.

[0157] Those skilled in the art will appreciate that the accompanying drawings are only schematic diagrams of a preferred implementation scenario, and the modules or processes in the accompanying drawings are not necessarily necessary for implementing the present application. Those skilled in the art will appreciate that the modules in the devices in the implementation scenario can be distributed in the devices of the implementation scenario according to the description of the implementation scenario, or can be changed accordingly and located in one or more devices different from the present implementation scenario. The modules of the above-mentioned implementation scenario can be combined into one module, or can be further split into multiple submodules.

[0158] The above serial numbers of this application are only for description and do not represent the advantages and disadvantages of the implementation scenarios. The above disclosure is only a few specific implementation scenarios of this application, but this application is not limited to them, and any changes that can be thought of by technicians in this field should fall within the scope of protection of this application.

Claims

1. A method for access rights control based on tag data, characterized in that: include: Obtain entity attribute data from different data systems; Performing feature mining on the entity attribute data using the entity's feature fields in different attribute dimensions to generate different types of entity label data, wherein the different types of entity label data have corresponding different confidence levels; Selecting target entity tag data with a confidence greater than a preset threshold from the different types of entity tag data to perform access control on the entity, specifically comprising: responding to an entity access permission evaluation instruction, extracting attribute information of the entity session information on different attribute tags for the entity session information carried by the evaluation instruction; The target entity tag data is traversed and matched based on the attribute information of the entity session information on different attribute tags, and the target entity tag data with consistent matching is used as the session tag data representing the entity; the entity access rights are evaluated using the session tag data, and access rights are controlled according to the evaluation results.

2. The method according to claim 1, characterized in that The obtaining of entity attribute data in different data systems specifically includes: Connecting to different data systems through a pre-set protocol interface to obtain entity data of different data types generated in different system environments, wherein the entity data includes at least one or more of log data, identity data, and business data; The entity data generated in the different system environments are processed to obtain entity attribute data.

3. The method according to claim 2, characterized in that The processing of the entity data generated in the different system environments to obtain entity attribute data specifically includes: Using a preset data format, cleaning the entity data generated in the different system environments to remove redundant information in the entity data; By utilizing the correlation between entity attribute data, primary key association and fuzzy matching processing are performed on the entity data generated in the different system environments to obtain entity attribute data.

4. The method according to claim 1, characterized in that The attribute dimensions include fact attribute dimensions and prediction attribute dimensions. The feature fields of the entity in different attribute dimensions are used to perform feature mining on the entity attribute data to generate different types of entity label data, specifically including: Using the characteristic field of the entity in the fact attribute dimension, feature extraction and statistics are performed on the entity attribute data to generate fact label data representing the entity, wherein the fact label data has a first confidence level; Utilizing the feature fields of the entity in the prediction attribute dimension, the entity attribute data is input into a pre-trained machine model for feature clustering and analysis to generate prediction label data representing the entity. The machine model is trained using historical entity attribute data as sample data, and the prediction label data has a second confidence level.

5. The method according to claim 4, characterized in that The characteristic fields on the fact attribute dimension include static fields and dynamic fields. The static fields are triggered by the current state of the entity attribute data, and the dynamic fields are triggered by the historical accumulation state of the entity attribute data. The characteristic fields on the fact attribute dimension of the entity are used to extract and count the entity attribute data to generate fact label data representing the entity, specifically including: For the static fields of the entity in the fact attribute dimension, extract the feature values ​​triggered by the entity attribute data in the current state as the fact label data representing the entity; For the dynamic fields of the entity in the fact attribute dimension, the characteristic values ​​triggered by the historical accumulation state of the entity attribute data within a preset time period are counted as the fact label data representing the entity.

6. The method according to claim 4, characterized in that After using the feature field of the entity in the prediction attribute dimension to input the entity attribute data into a pre-trained machine model for feature clustering and analysis to generate prediction label data representing the entity, the method further includes: Using the fact label data to judge the predefined label data, and using the judgment result to generate model label data representing the entity, the model label data has a third confidence level, and the third confidence level is calculated by using the first confidence level; and / or After associating the fact label data and the predicted label data using a pre-defined logical rule, the pre-defined label data is judged, and the model label data representing the entity is generated using the judgment result, wherein the model label data has a third confidence level, and the third confidence level is calculated by weighted sum of the first confidence level and the second confidence level; The third confidence level is greater than the second confidence level, and less than or equal to the first confidence level.

7. The method according to claim 6, characterized in that The method further comprises: Determine whether a third confidence level corresponding to the model label data is greater than a first preset threshold; If not, the model tag data is sent to the physical device for authentication using a tag feedback mechanism, and the model tag data is updated based on the authentication result.

8. The method according to claim 6, characterized in that Before the method uses the pre-defined logical rules to associate the fact label data with the predicted label data, the method further includes: Update the predicted label data by deleting the predicted label data whose second confidence is less than a second preset threshold; or The predicted tag data is sent to the physical device for authentication using a tag feedback mechanism, and the predicted tag data is updated based on the authentication result.

9. The method according to claim 1, characterized in that: The step of evaluating the entity access rights by using the session tag data and performing access rights control according to the evaluation result specifically includes: Using the tag determination rule pre-set for the access authority, determining whether the session tag data matches the tag determination rule; If so, an evaluation result is generated that the entity has access rights, otherwise, an evaluation result is generated that the entity does not have access rights.

10. An access rights control device based on tag data, characterized in that: include: An acquisition unit, used to acquire entity attribute data obtained from the docking process of different data systems; A generating unit, configured to perform feature mining on the entity attribute data using the characteristic fields of the entity in different attribute dimensions, and generate different types of entity label data, wherein the different types of entity label data have corresponding different confidence levels; A control unit is used to select target entity tag data with a confidence greater than a preset threshold from among the different types of entity tag data to perform access control on the entity, specifically comprising: in response to an entity access permission evaluation instruction, extracting attribute information of the entity session information on different attribute tags for the entity session information carried by the evaluation instruction; The target entity tag data is traversed and matched based on the attribute information of the entity session information on different attribute tags, and the target entity tag data with consistent matching is used as the session tag data representing the entity; the entity access rights are evaluated using the session tag data, and access rights are controlled according to the evaluation results.

11. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 9 are implemented.

12. A computer storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

Images