Identity control method and device

Abstract

The present application discloses an identity management method and device, and relates to the field of identity management technology. The method of the present application includes: obtaining multiple original identity data at multiple data sources; matching each of the original identity data with multiple preset identity entity models respectively to generate identity entity data corresponding to each of the original identity data, wherein the multiple preset identity entity models are entity models pre-created for multiple target entity types, and the multiple preset identity entity models correspond one-to-one to the multiple target entity types; merging the multiple identity entity data to obtain multiple unified identity entity data, wherein the multiple unified identity entity data belong to different entities.

Description

Technical Field

[0001] The present application relates to the technical field of identity control, and in particular to an identity control method and device. Background Art

[0002] With the gradual deepening of enterprise informatization, the environment faced by enterprise information management and control is becoming more and more complex. In order to meet the needs of different business departments and different functional management and control within departments, enterprises need to establish various identity management and control systems. The identity information of enterprise employees, terminal devices and other entities is stored in the database corresponding to each identity management and control system. Since the databases of various identity management and control systems are not interconnected, a large amount of isolated and scattered identity information and access control methods will be generated, which increases the burden and high cost of enterprise information management and control.

[0003] Therefore, it is crucial to uniformly manage the identity information of corporate employees, terminal devices and other entities. Summary of the invention

[0004] The embodiments of the present application provide an identity management method and device, the main purpose of which is to uniformly manage the identity information of entities such as enterprise employees and terminal devices.

[0005] In order to solve the above technical problems, the embodiments of the present application provide the following technical solutions:

[0006] In a first aspect, the present application provides an identity management method, the method comprising:

[0007] Obtaining multiple raw identity data at multiple data sources;

[0008] Respectively matching each of the original identity data with a plurality of preset identity entity models to generate identity entity data corresponding to each of the original identity data, wherein the plurality of preset identity entity models are entity models pre-created for a plurality of target entity types, and the plurality of preset identity entity models correspond one-to-one to the plurality of target entity types;

[0009] The plurality of identity entity data are merged to obtain a plurality of unified identity entity data, wherein the plurality of unified identity entity data belong to different entities.

[0010] Optionally, the original identity data includes multiple fields, and the preset identity entity model includes multiple field names; and the matching processing of each original identity data with multiple preset identity entity models to generate identity entity data corresponding to each original identity data includes:

[0011] Matching the field names of the multiple fields included in the original identity data with the multiple field names included in each of the preset identity entity models according to the preset matching rules, so as to obtain the similarity between the original identity data and each of the preset identity entity models;

[0012] Determine at least one preset identity entity model whose similarity with the original identity data is greater than a first preset threshold as a target identity entity model corresponding to the original identity data;

[0013] The field value of each field included in the original identity data is substituted into each of the target identity entity models to generate at least one identity entity data corresponding to the original identity data.

[0014] Optionally, the merging of the plurality of identity entity data to obtain a plurality of unified identity entity data includes:

[0015] Performing semantic matching processing on the plurality of identity entity data according to a preset matching algorithm to obtain the similarity between any two identity entity data;

[0016] When the similarity between the plurality of identity entity data is greater than or equal to a second preset threshold, merging the plurality of identity entity data to obtain the unified identity entity data;

[0017] When the similarity between any one of the identity entity data and other identity entity data is less than the second preset threshold, the identity entity data is determined as the unified identity entity data.

[0018] Optionally, the merging of the plurality of identity entity data to obtain the unified identity entity data includes:

[0019] When there is a semantic conflict between the plurality of identity entity data, the plurality of identity entity data are subjected to conflict handling according to a preset rule;

[0020] The plurality of identity entity data that have undergone conflict resolution are merged to obtain the unified identity entity data.

[0021] Optionally, when the preset rule is specifically an automatic processing rule, the conflict processing of the plurality of identity entity data according to the preset rule includes:

[0022] Obtaining priorities corresponding to the plurality of data sources;

[0023] Determine priorities corresponding to the plurality of identity entity data according to priorities corresponding to the plurality of data sources;

[0024] Delete semantically conflicting fields contained in identity entity data other than the identity entity data with the highest priority.

[0025] Optionally, when the preset rule is specifically a manual processing rule, the conflict processing of the plurality of identity entity data according to the preset rule includes:

[0026] Outputting and displaying the plurality of identity entity data;

[0027] Receiving a deletion instruction, wherein the deletion instruction includes a unique identifier corresponding to the target identity entity data;

[0028] The semantically conflicting fields included in other identity entity data except the target identity entity data are deleted according to the unique identifier.

[0029] Optionally, after merging the plurality of identity entity data to obtain a plurality of unified identity entity data, the method further includes:

[0030] Clustering the plurality of unified identity entity data according to a preset clustering algorithm to obtain a plurality of clusters;

[0031] Outputting and displaying the plurality of clusters so that an analyst can determine the entity role and / or entity grouping corresponding to each cluster;

[0032] Receive entity roles and / or entity groups corresponding to each of the clusters input by the analyst;

[0033] An entity role field and / or an entity grouping field is added to each unified identity entity data according to the entity role and / or entity grouping corresponding to each cluster.

[0034] Optionally, after merging the plurality of identity entity data to obtain a plurality of unified identity entity data, the method further includes:

[0035] Generate a unique identity corresponding to each of the unified identity entity data;

[0036] Extracting the original identity identifier corresponding to each unified identity entity data from the original identity data corresponding to each unified identity entity data;

[0037] The first mapping relationship between each unified identity entity data and its corresponding unique identity identifier and the second mapping relationship between the unique identity identifier corresponding to each unified identity entity data and the original identity identifier are stored.

[0038] Optionally, the method further includes:

[0039] Receiving a data query instruction sent by a first query terminal, wherein the data query instruction includes a target data format and a unique identity corresponding to a first target entity;

[0040] Searching for unified identity entity data corresponding to the first target entity according to the unique identity identifier corresponding to the first target entity and the first mapping relationship;

[0041] Performing format conversion processing on the unified identity entity data according to the target data format;

[0042] The unified identity entity data after format conversion is sent to the first query terminal.

[0043] Optionally, the method further includes:

[0044] Receiving an authentication instruction sent by the second query terminal, wherein the authentication instruction includes a unique identification corresponding to the second target entity and a unique identification corresponding to the target data source;

[0045] Searching for the original identity identifier corresponding to the second target entity according to the unique identity identifier corresponding to the second target entity and the second mapping relationship;

[0046] Sending the original identity identifier corresponding to the second target entity to the target data source according to the unique identifier;

[0047] Receive the authentication result fed back by the target data source, and send the authentication result to the second query terminal.

[0048] Optionally, after merging the plurality of identity entity data to obtain a plurality of unified identity entity data, the method further includes:

[0049] Generate metadata corresponding to the unified identity entity data according to a mapping relationship between a field value of each field in the unified identity entity data and its corresponding data source;

[0050] The unified identity entity data and its corresponding metadata are stored in a target database.

[0051] Optionally, the method further includes:

[0052] Receiving original identity data corresponding to a third target entity sent by the data source;

[0053] Matching the original identity data corresponding to the third target entity with the plurality of preset identity entity models to generate identity entity data corresponding to the third target entity;

[0054] Determining whether unified identity entity data corresponding to the third target entity is stored in the target database according to the identity entity data corresponding to the third target entity;

[0055] If unified identity entity data corresponding to the third target entity is stored, merging the identity entity data corresponding to the third target entity into the unified identity entity data corresponding to the third target entity in the target database, and updating metadata corresponding to the unified identity entity data in the target database according to the identity entity data corresponding to the third target entity;

[0056] If the unified identity entity data corresponding to the third target entity is not stored, the identity entity data corresponding to the third target entity is determined as the unified identity entity data corresponding to the third target entity, metadata corresponding to the unified identity entity data is generated, and the unified identity entity data and the metadata are stored in the target database.

[0057] In a second aspect, the present application further provides an identity management device, the device comprising:

[0058] An acquisition unit, used for acquiring a plurality of original identity data from a plurality of data sources;

[0059] A first matching unit is used to match each of the original identity data with a plurality of preset identity entity models to generate identity entity data corresponding to each of the original identity data, wherein the plurality of preset identity entity models are entity models pre-created for a plurality of target entity types, and the plurality of preset identity entity models correspond to the plurality of target entity types one by one;

[0060] The first merging unit is used to merge the multiple identity entity data to obtain multiple unified identity entity data, wherein the multiple unified identity entity data belong to different entities.

[0061] Optionally, the original identity data includes multiple fields, and the preset identity entity model includes multiple field names; the first matching unit includes:

[0062] A first matching module, configured to match the field names of the multiple fields included in the original identity data with the multiple field names included in each of the preset identity entity models according to a preset matching rule, so as to obtain a similarity between the original identity data and each of the preset identity entity models;

[0063] A first determination module, configured to determine at least one preset identity entity model having a similarity with the original identity data greater than a first preset threshold as a target identity entity model corresponding to the original identity data;

[0064] The substitution module is used to substitute the field value of each field included in the original identity data into each target identity entity model to generate at least one identity entity data corresponding to the original identity data.

[0065] Optionally, the first merging unit includes:

[0066] A second matching module is used to perform semantic matching processing on the plurality of identity entity data according to a preset matching algorithm to obtain the similarity between any two identity entity data;

[0067] a merging module, configured to merge the plurality of identity entity data to obtain the unified identity entity data when the similarity between the plurality of identity entity data is greater than or equal to a second preset threshold;

[0068] The second determining module is configured to determine the identity entity data as the unified identity entity data when the similarity between any one of the identity entity data and other identity entity data is less than the second preset threshold.

[0069] Optionally, the merging module includes:

[0070] A processing submodule, used for performing conflict processing on the plurality of identity entity data according to preset rules when there is a semantic conflict between the plurality of identity entity data;

[0071] The merging submodule is used to merge the plurality of identity entity data after conflict processing to obtain the unified identity entity data.

[0072] Optionally, when the preset rule is specifically an automatic processing rule, the processing submodule is specifically used to obtain the priorities corresponding to the multiple data sources; determine the priorities corresponding to the multiple identity entity data according to the priorities corresponding to the multiple data sources; and delete the semantic conflict fields contained in other identity entity data except the identity entity data with the highest priority.

[0073] Optionally, when the preset rule is specifically a manual processing rule, the processing submodule is specifically used to output and display multiple identity entity data; receive a deletion instruction, the deletion instruction includes a unique identifier corresponding to the target identity entity data; and delete the semantic conflict fields contained in other identity entity data except the target identity entity data according to the unique identifier.

[0074] Optionally, the device further comprises:

[0075] a clustering unit, configured to, after the first merging unit merges the plurality of identity entity data to obtain a plurality of unified identity entity data, cluster the plurality of unified identity entity data according to a preset clustering algorithm to obtain a plurality of clusters;

[0076] An output unit, used for outputting and displaying the plurality of clusters, so that analysts can determine the entity role and / or entity group corresponding to each cluster;

[0077] A first receiving unit, configured to receive an entity role and / or entity grouping corresponding to each of the clusters input by the analyst;

[0078] The adding unit is used to add an entity role field and / or an entity group field to each unified identity entity data according to the entity role and / or entity group corresponding to each cluster.

[0079] Optionally, the device further comprises:

[0080] A first generating unit, configured to generate a unique identity identifier corresponding to each unified identity entity data after the first merging unit merges the plurality of identity entity data to obtain a plurality of unified identity entity data;

[0081] An extraction unit, configured to extract the original identity identifier corresponding to each unified identity entity data from the original identity data corresponding to each unified identity entity data;

[0082] The first storage unit is used to store a first mapping relationship between each unified identity entity data and its corresponding unique identity identifier and a second mapping relationship between the unique identity identifier corresponding to each unified identity entity data and the original identity identifier.

[0083] Optionally, the device further comprises:

[0084] A second receiving unit, configured to receive a data query instruction sent by the first query terminal, wherein the data query instruction includes a target data format and a unique identity corresponding to the first target entity;

[0085] A first searching unit, configured to search for unified identity entity data corresponding to the first target entity according to a unique identity identifier corresponding to the first target entity and the first mapping relationship;

[0086] A conversion unit, configured to perform format conversion processing on the unified identity entity data according to the target data format;

[0087] The first sending unit is used to send the unified identity entity data after format conversion to the first query terminal.

[0088] Optionally, the device further comprises:

[0089] A third receiving unit, configured to receive an authentication instruction sent by the second query terminal, wherein the authentication instruction includes a unique identification corresponding to the second target entity and a unique identification corresponding to the target data source;

[0090] A second searching unit, configured to search for an original identity corresponding to the second target entity according to the unique identity corresponding to the second target entity and the second mapping relationship;

[0091] A second sending unit, configured to send an original identity identifier corresponding to the second target entity to the target data source according to the unique identifier;

[0092] A fourth receiving unit, configured to receive an authentication result fed back by the target data source;

[0093] The third sending unit is used to send the authentication result to the second query terminal.

[0094] Optionally, the device further comprises:

[0095] a second generating unit, configured to generate metadata corresponding to the unified identity entity data according to a mapping relationship between a field value of each field in the unified identity entity data and a corresponding data source after the first merging unit merges the plurality of identity entity data to obtain a plurality of unified identity entity data;

[0096] The second storage unit is used to store the unified identity entity data and its corresponding metadata in a target database.

[0097] Optionally, the device further comprises:

[0098] a fifth receiving unit, configured to receive original identity data corresponding to a third target entity sent by the data source;

[0099] A third generating unit, configured to match the original identity data corresponding to the third target entity with the plurality of preset identity entity models to generate identity entity data corresponding to the third target entity;

[0100] A judging unit, configured to judge whether unified identity entity data corresponding to the third target entity is stored in the target database according to the identity entity data corresponding to the third target entity;

[0101] a second merging unit, configured to merge the identity entity data corresponding to the third target entity into the unified identity entity data corresponding to the third target entity in the target database when the determination unit determines that the unified identity entity data corresponding to the third target entity is stored in the target database, and update metadata corresponding to the unified identity entity data in the target database according to the identity entity data corresponding to the third target entity;

[0102] A third storage unit is used to determine the identity entity data corresponding to the third target entity as the unified identity entity data corresponding to the third target entity when the judgment unit determines that the unified identity entity data corresponding to the third target entity is not stored in the target database, generate metadata corresponding to the unified identity entity data, and store the unified identity entity data and the metadata in the target database.

[0103] In a third aspect, an embodiment of the present application provides a storage medium, wherein the storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the identity management method described in the first aspect.

[0104] In a fourth aspect, an embodiment of the present application provides an identity management device, which includes a storage medium; and one or more processors, wherein the storage medium is coupled to the processor, and the processor is configured to execute program instructions stored in the storage medium; when the program instructions are executed, the identity management method described in the first aspect is executed.

[0105] By means of the above technical solution, the technical solution provided by this application has at least the following advantages:

[0106] The present application provides an identity management method and device. The present application can obtain multiple original identity data stored in each data source from a data source such as an AD identity management system of a target enterprise and an LDAP identity management system of the target enterprise in an identity management application program, and then match each original identity data with multiple preset identity entity models, thereby generating identity entity data corresponding to each original identity data, and then merge the multiple identity entity data, that is, when there are multiple identity entity data corresponding to a certain entity among the generated multiple identity entity data, the multiple identity entity data corresponding to the entity are merged into unified identity entity data corresponding to the entity; when there is only one identity entity data corresponding to a certain entity among the generated multiple identity entity data, the identity entity data corresponding to the entity is determined as the unified identity entity data corresponding to the entity, thereby realizing unified management and control of identity information of entities such as enterprise employees and terminal devices in the target enterprise.

[0107] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0108] By reading the detailed description below with reference to the accompanying drawings, the above and other purposes, features and advantages of the exemplary embodiments of the present application will become easy to understand. In the accompanying drawings, several embodiments of the present application are shown in an exemplary and non-limiting manner, and the same or corresponding reference numerals represent the same or corresponding parts, wherein:

[0109] Figure 1 A flow chart of an identity management method provided in an embodiment of the present application is shown;

[0110] Figure 2 Another flow chart of an identity management method provided by an embodiment of the present application is shown;

[0111] Figure 3 A block diagram of an identity management device provided in an embodiment of the present application is shown;

[0112] Figure 4 A block diagram of another identity management device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0113] The exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0114] It should be noted that, unless otherwise specified, the technical terms or scientific terms used in this application should have the common meanings understood by technicians in the field to which this application belongs.

[0115] This application embodiment provides an identity management method, such as Figure 1 As shown, the method includes:

[0116] 101. Obtain multiple original identity data from multiple data sources.

[0117] The multiple data sources may include, but are not limited to: the target enterprise's AD identity management system, the target enterprise's LDAP identity management system, the target enterprise's analysis system, the target enterprise's application system, the target enterprise's identity data file, and the like.

[0118] In the embodiment of the present application, the execution subject in each step is an identity management application running in the target terminal device, wherein the target terminal device can be but is not limited to: a computer, a server, etc.

[0119] In an embodiment of the present application, in order to uniformly manage the identity information of entities such as corporate employees and terminal devices within the target enterprise, the identity management application first needs to obtain multiple original identity data stored in each data source from data sources such as the target enterprise's AD identity management system and the target enterprise's LDAP identity management system.

[0120] 102. Match each original identity data with a plurality of preset identity entity models respectively to generate identity entity data corresponding to each original identity data.

[0121] Among them, multiple preset identity entity models are entity models created in advance for multiple target entity types, and the multiple preset identity entity models correspond one-to-one to the multiple target entity types; among them, the multiple target entity types may include but are not limited to: person entity type, terminal device entity type, server entity type, etc.

[0122] In the embodiment of the present application, since the data formats of identity data stored in various data sources are different, in order to facilitate the merging of multiple original identity data obtained from multiple data sources, the identity management application needs to first perform data format conversion on the multiple original identity data obtained, that is, match each original identity data with multiple preset identity entity models respectively, so as to generate identity entity data corresponding to each original identity data.

[0123] 103. Merge multiple identity entity data to obtain multiple unified identity entity data.

[0124] Among them, multiple unified identity entity data belong to different entities.

[0125] In an embodiment of the present application, after the identity management application generates identity entity data corresponding to each original identity data, it is necessary to merge the multiple identity entity data to obtain multiple unified identity entity data, that is, when there are multiple identity entity data corresponding to a certain entity among the multiple identity entity data generated in step 102, the multiple identity entity data corresponding to the entity are merged into the unified identity entity data corresponding to the entity; when there is only one identity entity data corresponding to a certain entity among the multiple identity entity data generated in step 102, the identity entity data corresponding to the entity is determined as the unified identity entity data corresponding to the entity, thereby realizing unified management and control of the identity information of entities such as enterprise employees and terminal devices within the target enterprise.

[0126] An embodiment of the present application provides an identity management method. After an identity management application obtains multiple original identity data stored in each data source from a data source such as an AD identity management system of a target enterprise and an LDAP identity management system of the target enterprise, the embodiment of the present application can match each original identity data with multiple preset identity entity models respectively, thereby generating identity entity data corresponding to each original identity data, and then merge the multiple identity entity data, that is, when there are multiple identity entity data corresponding to a certain entity among the generated multiple identity entity data, the multiple identity entity data corresponding to the entity are merged into unified identity entity data corresponding to the entity; when there is only one identity entity data corresponding to a certain entity among the generated multiple identity entity data, the identity entity data corresponding to the entity is determined as the unified identity entity data corresponding to the entity, thereby realizing unified management and control of identity information of entities such as enterprise employees and terminal devices in the target enterprise.

[0127] To explain in more detail below, the present application embodiment provides another identity management method, as follows Figure 2 As shown, the method includes:

[0128] 201. Obtain multiple original identity data from multiple data sources.

[0129] Regarding step 201, obtaining multiple original identity data from multiple data sources, please refer to Figure 1 The description of the corresponding parts will not be repeated here in the embodiments of the present application.

[0130] 202. Match each original identity data with a plurality of preset identity entity models respectively to generate identity entity data corresponding to each original identity data.

[0131] In an embodiment of the present application, in order to facilitate the merging of multiple original identity data obtained from multiple data sources, the identity management application needs to first perform data format conversion on the multiple original identity data obtained, that is, match each original identity data with multiple preset identity entity models respectively, so as to generate identity entity data corresponding to each original identity data.

[0132] Specifically, in this step, for any original identity data, the identity management application can match the original identity data with multiple preset identity entity models in the following manner to generate identity entity data corresponding to the original identity data:

[0133] The original identity data includes multiple fields, and the preset identity entity model includes multiple field names.

[0134] First, the field names of multiple fields included in the original identity data are matched with the multiple field names included in each preset identity entity model according to the preset matching rule, so as to obtain the similarity between the original identity data and each preset identity entity model, wherein the preset matching rule is specifically an exact match or a fuzzy match. When the preset matching rule is specifically an exact match, the field name of a field in the original identity data needs to be completely consistent with the field name in a preset identity entity model, and the identity management application will determine that the two field names are the same. When the preset matching rule is specifically a fuzzy match, the field name of a field in the original identity data needs to be completely consistent with the field name in a preset identity entity model, and the identity management application will determine that the two field names are the same. If a field name in a preset identity entity model has the same meaning, the identity management application will determine that the two field names are the same; secondly, at least one preset identity entity model whose similarity with the original identity data is greater than a first preset threshold is determined as the target identity entity model corresponding to the original identity data; finally, the field value of each field contained in the original identity data is substituted into each determined target identity entity model respectively, and a field is formed with the corresponding field name in the target identity entity model, thereby generating at least one identity entity data corresponding to the original identity data; wherein the first preset threshold can be but is not limited to: 50%, 60%, 70%, etc.

[0135] The identity management application can generate identity entity data corresponding to each original identity data in the above manner.

[0136] 203. Merge multiple identity entity data to obtain multiple unified identity entity data.

[0137] In an embodiment of the present application, after the identity management application generates identity entity data corresponding to each original identity data, it is necessary to merge multiple identity entity data to obtain multiple unified identity entity data.

[0138] Specifically, in this step, the identity management application can merge multiple identity entity data in the following manner to obtain multiple unified identity entity data:

[0139] First, semantic matching is performed on multiple identity entity data according to a preset matching algorithm to obtain the similarity between any two identity entity data, wherein the preset matching algorithm may be, but is not limited to, any one of the matching algorithms such as Soundex matching algorithm, NYSIIS matching algorithm, Levenshtein matching algorithm, and deep learning matching algorithm; when the similarity between multiple identity entity data is greater than or equal to a second preset threshold, it can be determined that these identity entity data belong to the same entity. At this time, it is necessary to merge these identity entity data to obtain unified identity entity data corresponding to this entity; when the similarity between any identity entity data and other identity entity data is less than the second preset threshold, it can be determined that the identity entity data and the other identity entity data belong to different entities. At this time, it is necessary to determine the identity entity data as the unified identity entity data of the entity corresponding to the identity entity data; wherein the second preset threshold may be, but is not limited to, 50%, 60%, 70%, etc.

[0140] It should be noted that in the process of merging multiple identity entity data belonging to the same entity, when it is determined that there are semantic conflicts between the multiple identity entity data, the identity management application needs to perform conflict resolution on the multiple identity entity data according to preset rules, and merge the multiple identity entity data that have undergone conflict resolution to obtain unified identity entity data.

[0141] Among them, when the preset rule is specifically an automatic processing rule, the specific process of conflict resolution for multiple identity entity data according to the preset rule is: first, obtain the priorities corresponding to multiple data sources; second, determine the priorities corresponding to multiple identity entity data according to the priorities corresponding to the multiple data sources; finally, delete the semantic conflict fields contained in other identity entity data except the identity entity data with the highest priority among the multiple identity entity data.

[0142] Among them, when the preset rule is specifically a manual processing rule, the specific process of conflict processing for multiple identity entity data according to the preset rule is: first, the multiple identity entity data are output and displayed so that the analyst can determine which identity entity data contains the semantic conflict field that needs to be deleted; second, a deletion instruction is received, wherein the deletion instruction includes a unique identifier corresponding to the target identity entity data, and the target identity entity data is the identity entity data that needs to retain the semantic conflict field; finally, according to the unique identifier corresponding to the target identity entity data, the semantic conflict fields contained in other identity entity data among the multiple identity entity data except the target identity entity data are deleted.

[0143] Furthermore, in an embodiment of the present application, after the identity management application merges multiple identity entity data to obtain multiple unified identity entity data, it can also mine the entity relationship between the multiple unified identity entity data: first, cluster the multiple unified identity entity data according to a preset clustering algorithm to obtain multiple clusters, wherein the preset clustering algorithm can be any clustering algorithm, and the embodiment of the present application does not specifically limit this; secondly, output and display the multiple clusters so that analysts can determine the entity role and / or entity grouping corresponding to each cluster; finally, receive the entity role and / or entity grouping corresponding to each cluster input by the analyst, and add entity role fields and / or entity grouping fields to each unified identity entity data in each cluster according to the entity role and / or entity grouping corresponding to each cluster input by the analyst.

[0144] Furthermore, in an embodiment of the present application, after the identity management application merges multiple identity entity data to obtain multiple unified identity entity data, it is also necessary to generate a unique identity identifier corresponding to each unified identity entity data, and extract the original identity identifier corresponding to each unified identity entity data from the original identity data corresponding to each unified identity entity data, and store the first mapping relationship between each unified identity entity data and its corresponding unique identity identifier and the second mapping relationship between the unique identity identifier corresponding to each unified identity entity data and the original identity identifier.

[0145] When a terminal device (i.e., the first query terminal) needs to query the identity data corresponding to a certain entity (i.e., the first target entity), the first query terminal will send a data query instruction carrying the target data format and the unique identity identifier corresponding to the first target entity to the identity management application; after receiving the data query instruction sent by the first query terminal, the identity management application can search for the unified identity entity data corresponding to the first target entity according to the unique identity identifier corresponding to the first target entity and the first mapping relationship, and then perform format conversion processing on the unified identity entity data according to the target data format, and finally send the unified identity entity data after format conversion processing to the first query terminal.

[0146] It should be noted that when the data query instruction sent by the first query terminal carries the original identity identifier corresponding to the first target entity, the identity management application can first search for the unique identity identifier corresponding to the first target entity based on the original identity identifier corresponding to the first target entity and the second mapping relationship, and then search for the unified identity entity data corresponding to the first target entity based on the unique identity identifier corresponding to the first target entity and the first mapping relationship.

[0147] When a terminal device (i.e., the second query terminal) needs to perform identity authentication on a certain entity (i.e., the second target entity), the second query terminal will send an authentication instruction carrying the unique identity identifier corresponding to the second target entity and the unique identifier corresponding to the target data source to the identity management application; after receiving the authentication instruction sent by the second query terminal, the identity management application can search for the original identity identifier corresponding to the second target entity according to the unique identity identifier corresponding to the second target entity and the second mapping relationship, and then send the original identity identifier corresponding to the second target entity to the target data source according to the unique identifier corresponding to the target data source, so that the target data source can authenticate the second target entity, and after receiving the authentication result fed back by the target data source, the authentication result can be sent to the second query terminal.

[0148] It should be noted that when multiple original identity identifiers corresponding to the second target entity are found, it is necessary to first select the original identity identifier belonging to the target data source from the multiple original identity identifiers corresponding to the second target entity.

[0149] 204 . Generate metadata corresponding to each unified identity entity data, and store each unified identity entity data and the metadata corresponding to each unified identity entity data in a target database.

[0150] In an embodiment of the present application, after the identity management application merges multiple identity entity data to obtain multiple unified identity entity data, it is necessary to generate metadata corresponding to each unified identity entity data, and store each unified identity entity data and the metadata corresponding to each unified identity entity data in the target database.

[0151] Specifically, in this step, for any unified identity entity data, the identity management application can generate metadata corresponding to the unified identity entity data in the following manner: first, record the mapping relationship between the field value of each field in the unified identity entity data and its corresponding data source; second, determine the recorded mapping relationship as the metadata corresponding to the unified identity entity data; wherein, according to the metadata corresponding to the unified identity entity data, it can be known which data source the field value of each field in the unified identity entity data comes from.

[0152] Furthermore, in an embodiment of the present application, when a data source needs to store the identity data of a certain entity (i.e., a third target entity), the data source will send the original identity data corresponding to the third target entity to the identity management application; after receiving the original identity data corresponding to the third target entity, the identity management application can match the original identity data corresponding to the third target entity with multiple preset identity entity models, thereby generating identity entity data corresponding to the third target entity, and then determine whether unified identity entity data corresponding to the third target entity is stored in the target database based on the identity entity data corresponding to the third target entity, that is, match the identity entity data corresponding to the third target entity with each unified identity entity data stored in the target database according to the preset matching algorithm, thereby calculating the similarity between the identity entity data corresponding to the third target entity and each unified identity entity data, and when the similarity between the identity entity data corresponding to the third target entity and a certain unified identity entity data is greater than or equal to a second preset threshold, determine that the unified identity entity The data is unified identity entity data corresponding to the third target entity, that is, the unified identity entity data corresponding to the third target entity is stored in the target database. When the similarity between the identity entity data corresponding to the third target entity and any unified identity entity data is less than a second preset threshold, it is determined that the unified identity entity data corresponding to the third target entity is not stored in the target database; if the unified identity entity data corresponding to the third target entity is stored in the target database, the identity entity data corresponding to the third target entity is merged into the unified identity entity data corresponding to the third target entity in the target database, and metadata corresponding to the unified identity entity data is updated in the target database according to the identity entity data corresponding to the third target entity; if the unified identity entity data corresponding to the third target entity is not stored in the target database, the identity entity data corresponding to the third target entity is determined as the unified identity entity data corresponding to the third target entity, metadata corresponding to the unified identity entity data is generated, and the unified identity entity data and the metadata are stored in the target database.

[0153] In order to achieve the above-mentioned purpose, according to another aspect of the present application, an embodiment of the present application further provides a storage medium, wherein the storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the above-mentioned identity management method.

[0154] In order to achieve the above-mentioned purpose, according to another aspect of the present application, an embodiment of the present application also provides an identity management device, which includes a storage medium; and one or more processors, the storage medium is coupled to the processor, and the processor is configured to execute program instructions stored in the storage medium; when the program instructions are executed, the above-mentioned identity management method is executed.

[0155] Furthermore, as a response to the above Figure 1 and Figure 2 In order to realize the method shown in the figure, another embodiment of the present application also provides an identity control device. This device embodiment corresponds to the aforementioned method embodiment. For ease of reading, this device embodiment will not repeat the details of the aforementioned method embodiment one by one, but it should be clear that the device in this embodiment can correspond to all the contents of the aforementioned method embodiment. This device is used to uniformly control the identity information of entities such as enterprise employees and terminal devices. Specifically, Figure 3 As shown, the device comprises:

[0156] An acquisition unit 301 is used to acquire multiple original identity data from multiple data sources;

[0157] A first matching unit 302 is used to match each of the original identity data with a plurality of preset identity entity models to generate identity entity data corresponding to each of the original identity data, wherein the plurality of preset identity entity models are entity models pre-created for a plurality of target entity types, and the plurality of preset identity entity models correspond one-to-one to the plurality of target entity types;

[0158] The first merging unit 303 is configured to merge the plurality of identity entity data to obtain a plurality of unified identity entity data, wherein the plurality of unified identity entity data belong to different entities.

[0159] Further, such as Figure 4 As shown, the original identity data includes multiple fields, and the preset identity entity model includes multiple field names; the first matching unit 302 includes:

[0160] The first matching module 3021 is used to match the field names of the multiple fields included in the original identity data with the multiple field names included in each of the preset identity entity models according to the preset matching rules, so as to obtain the similarity between the original identity data and each of the preset identity entity models;

[0161] A first determination module 3022, configured to determine at least one preset identity entity model having a similarity with the original identity data greater than a first preset threshold as a target identity entity model corresponding to the original identity data;

[0162] The substitution module 3023 is used to substitute the field value of each field included in the original identity data into each of the target identity entity models to generate at least one identity entity data corresponding to the original identity data.

[0163] Further, such as Figure 4 As shown, the first merging unit 303 includes:

[0164] The second matching module 3031 is used to perform semantic matching processing on the plurality of identity entity data according to a preset matching algorithm to obtain the similarity between any two identity entity data;

[0165] A merging module 3032 is used to merge the multiple identity entity data to obtain the unified identity entity data when the similarity between the multiple identity entity data is greater than or equal to a second preset threshold;

[0166] The second determining module 3033 is configured to determine the identity entity data as the unified identity entity data when the similarity between any one of the identity entity data and other identity entity data is less than the second preset threshold.

[0167] Further, such as Figure 4 As shown, the merging module 3032 includes:

[0168] The processing submodule 30321 is used for performing conflict processing on the plurality of identity entity data according to a preset rule when there is a semantic conflict between the plurality of identity entity data;

[0169] The merging submodule 30322 is used to merge the multiple identity entity data after conflict processing to obtain the unified identity entity data.

[0170] Further, such as Figure 4 As shown, when the preset rule is specifically an automatic processing rule, the processing submodule 30321 is specifically used to obtain the priorities corresponding to the multiple data sources; determine the priorities corresponding to the multiple identity entity data according to the priorities corresponding to the multiple data sources; and delete the semantic conflict fields contained in other identity entity data except the identity entity data with the highest priority.

[0171] Further, such as Figure 4 As shown, when the preset rule is specifically a manual processing rule, the processing submodule 30321 is specifically used to output and display multiple identity entity data; receive a deletion instruction, the deletion instruction includes a unique identifier corresponding to the target identity entity data; and delete the semantic conflict fields contained in other identity entity data except the target identity entity data according to the unique identifier.

[0172] Further, such as Figure 4 As shown, the device also includes:

[0173] A clustering unit 304 is used for clustering the plurality of identity entity data according to a preset clustering algorithm to obtain a plurality of clusters after the first merging unit 303 merges the plurality of identity entity data to obtain a plurality of unified identity entity data;

[0174] An output unit 305, configured to output and display the plurality of clusters so that an analyst can determine the entity role and / or entity group corresponding to each cluster;

[0175] A first receiving unit 306 is configured to receive an entity role and / or entity grouping corresponding to each of the clusters input by the analyst;

[0176] The adding unit 307 is configured to add an entity role field and / or an entity group field to each unified identity entity data according to the entity role and / or entity group corresponding to each cluster.

[0177] Further, such as Figure 4 As shown, the device also includes:

[0178] A first generating unit 308 is configured to generate a unique identity identifier corresponding to each unified identity entity data after the first merging unit 303 merges the plurality of identity entity data to obtain a plurality of unified identity entity data;

[0179] An extraction unit 309 is used to extract the original identity identifier corresponding to each unified identity entity data from the original identity data corresponding to each unified identity entity data;

[0180] The first storage unit 310 is used to store a first mapping relationship between each unified identity entity data and its corresponding unique identity identifier and a second mapping relationship between the unique identity identifier corresponding to each unified identity entity data and the original identity identifier.

[0181] Further, such as Figure 4 As shown, the device also includes:

[0182] The second receiving unit 311 is used to receive a data query instruction sent by the first query terminal, wherein the data query instruction includes a target data format and a unique identity corresponding to the first target entity;

[0183] A first searching unit 312 is configured to search for unified identity entity data corresponding to the first target entity according to the unique identity identifier corresponding to the first target entity and the first mapping relationship;

[0184] The conversion unit 313 is used to perform format conversion processing on the unified identity entity data according to the target data format;

[0185] The first sending unit 314 is configured to send the unified identity entity data after format conversion to the first query terminal.

[0186] Further, such as Figure 4 As shown, the device also includes:

[0187] The third receiving unit 315 is used to receive an authentication instruction sent by the second query terminal, wherein the authentication instruction includes a unique identity corresponding to the second target entity and a unique identity corresponding to the target data source;

[0188] A second searching unit 316, configured to search for an original identity corresponding to the second target entity according to the unique identity corresponding to the second target entity and the second mapping relationship;

[0189] A second sending unit 317 is configured to send the original identity identifier corresponding to the second target entity to the target data source according to the unique identifier;

[0190] The fourth receiving unit 318 is used to receive the authentication result fed back by the target data source;

[0191] The third sending unit 319 is configured to send the authentication result to the second query terminal.

[0192] Further, such as Figure 4 As shown, the device also includes:

[0193] A second generating unit 320 is configured to generate metadata corresponding to the unified identity entity data according to a mapping relationship between a field value of each field in the unified identity entity data and its corresponding data source after the first merging unit 303 merges the plurality of identity entity data to obtain a plurality of unified identity entity data;

[0194] The second storage unit 321 is used to store the unified identity entity data and its corresponding metadata in a target database.

[0195] Further, such as Figure 4 As shown, the device also includes:

[0196] A fifth receiving unit 322, configured to receive original identity data corresponding to a third target entity sent by the data source;

[0197] A third generating unit 323 is used to match the original identity data corresponding to the third target entity with the plurality of preset identity entity models to generate identity entity data corresponding to the third target entity;

[0198] A judging unit 324, configured to judge whether unified identity entity data corresponding to the third target entity is stored in the target database according to the identity entity data corresponding to the third target entity;

[0199] A second merging unit 325 is configured to merge the identity entity data corresponding to the third target entity into the unified identity entity data corresponding to the third target entity in the target database when the judging unit 324 determines that the unified identity entity data corresponding to the third target entity is stored in the target database, and update metadata corresponding to the unified identity entity data in the target database according to the identity entity data corresponding to the third target entity;

[0200] The third storage unit 326 is used to determine the identity entity data corresponding to the third target entity as the unified identity entity data corresponding to the third target entity when the judgment unit 324 determines that the unified identity entity data corresponding to the third target entity is not stored in the target database, generate metadata corresponding to the unified identity entity data, and store the unified identity entity data and the metadata in the target database.

[0201] An embodiment of the present application provides an identity management method and device. The embodiment of the present application can, after the identity management application obtains multiple original identity data stored in each data source from data sources such as the AD identity management system of the target enterprise and the LDAP identity management system of the target enterprise, respectively match each original identity data with multiple preset identity entity models, thereby generating identity entity data corresponding to each original identity data, and then merge the multiple identity entity data, that is, when there are multiple identity entity data corresponding to a certain entity among the generated multiple identity entity data, the multiple identity entity data corresponding to the entity are merged into unified identity entity data corresponding to the entity; when there is only one identity entity data corresponding to a certain entity among the generated multiple identity entity data, the identity entity data corresponding to the entity is determined as the unified identity entity data corresponding to the entity, thereby realizing unified management and control of identity information of entities such as enterprise employees and terminal devices in the target enterprise.

[0202] The identity management and control device includes a processor and a memory. The above-mentioned acquisition unit, first matching unit and first merging unit are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0203] The processor contains a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set, and the identity information of enterprise employees, terminal devices and other entities can be uniformly managed by adjusting the kernel parameters.

[0204] An embodiment of the present application provides a storage medium, which includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the above-mentioned identity management method.

[0205] The storage medium may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM, and the memory includes at least one storage chip.

[0206] An embodiment of the present application also provides an identity management device, which includes a storage medium; and one or more processors, wherein the storage medium is coupled to the processor, and the processor is configured to execute program instructions stored in the storage medium; when the program instructions are executed, the identity management method described above is executed.

[0207] The embodiment of the present application provides a device, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, the following steps are implemented:

[0208] Obtaining multiple raw identity data at multiple data sources;

[0209] Respectively matching each of the original identity data with a plurality of preset identity entity models to generate identity entity data corresponding to each of the original identity data, wherein the plurality of preset identity entity models are entity models pre-created for a plurality of target entity types, and the plurality of preset identity entity models correspond one-to-one to the plurality of target entity types;

[0210] The plurality of identity entity data are merged to obtain a plurality of unified identity entity data, wherein the plurality of unified identity entity data belong to different entities.

[0211] Further, the original identity data includes multiple fields, and the preset identity entity model includes multiple field names; the matching process of each original identity data with multiple preset identity entity models to generate identity entity data corresponding to each original identity data includes:

[0212] Matching the field names of the multiple fields included in the original identity data with the multiple field names included in each of the preset identity entity models according to the preset matching rules, so as to obtain the similarity between the original identity data and each of the preset identity entity models;

[0213] Determine at least one preset identity entity model whose similarity with the original identity data is greater than a first preset threshold as a target identity entity model corresponding to the original identity data;

[0214] The field value of each field included in the original identity data is substituted into each of the target identity entity models to generate at least one identity entity data corresponding to the original identity data.

[0215] Furthermore, the merging of the plurality of identity entity data to obtain a plurality of unified identity entity data includes:

[0216] Performing semantic matching processing on the plurality of identity entity data according to a preset matching algorithm to obtain the similarity between any two identity entity data;

[0217] When the similarity between the plurality of identity entity data is greater than or equal to a second preset threshold, merging the plurality of identity entity data to obtain the unified identity entity data;

[0218] When the similarity between any one of the identity entity data and other identity entity data is less than the second preset threshold, the identity entity data is determined as the unified identity entity data.

[0219] Furthermore, the merging of the plurality of identity entity data to obtain the unified identity entity data includes:

[0220] When there is a semantic conflict between the plurality of identity entity data, the plurality of identity entity data are conflict processed according to a preset rule;

[0221] The plurality of identity entity data that have undergone conflict resolution are merged to obtain the unified identity entity data.

[0222] Further, when the preset rule is specifically an automatic processing rule, the conflict processing of the plurality of identity entity data according to the preset rule includes:

[0223] Obtaining priorities corresponding to the plurality of data sources;

[0224] Determine priorities corresponding to the plurality of identity entity data according to priorities corresponding to the plurality of data sources;

[0225] Delete semantically conflicting fields contained in identity entity data other than the identity entity data with the highest priority.

[0226] Further, when the preset rule is specifically a manual processing rule, the conflict processing of the plurality of identity entity data according to the preset rule includes:

[0227] Outputting and displaying the plurality of identity entity data;

[0228] Receiving a deletion instruction, wherein the deletion instruction includes a unique identifier corresponding to the target identity entity data;

[0229] The semantically conflicting fields included in other identity entity data except the target identity entity data are deleted according to the unique identifier.

[0230] Furthermore, after merging the plurality of identity entity data to obtain a plurality of unified identity entity data, the method further includes:

[0231] Clustering the plurality of unified identity entity data according to a preset clustering algorithm to obtain a plurality of clusters;

[0232] Outputting and displaying the plurality of clusters so that an analyst can determine the entity role and / or entity grouping corresponding to each cluster;

[0233] Receive entity roles and / or entity groups corresponding to each of the clusters input by the analyst;

[0234] An entity role field and / or an entity grouping field is added to each unified identity entity data according to the entity role and / or entity grouping corresponding to each cluster.

[0235] Furthermore, after merging the plurality of identity entity data to obtain a plurality of unified identity entity data, the method further includes:

[0236] Generate a unique identity corresponding to each of the unified identity entity data;

[0237] Extracting the original identity identifier corresponding to each unified identity entity data from the original identity data corresponding to each unified identity entity data;

[0238] The first mapping relationship between each unified identity entity data and its corresponding unique identity identifier and the second mapping relationship between the unique identity identifier corresponding to each unified identity entity data and the original identity identifier are stored.

[0239] Furthermore, the method further comprises:

[0240] Receiving a data query instruction sent by a first query terminal, wherein the data query instruction includes a target data format and a unique identity corresponding to a first target entity;

[0241] Searching for unified identity entity data corresponding to the first target entity according to the unique identity identifier corresponding to the first target entity and the first mapping relationship;

[0242] Performing format conversion processing on the unified identity entity data according to the target data format;

[0243] The unified identity entity data after format conversion is sent to the first query terminal.

[0244] Furthermore, the method further comprises:

[0245] Receiving an authentication instruction sent by the second query terminal, wherein the authentication instruction includes a unique identification corresponding to the second target entity and a unique identification corresponding to the target data source;

[0246] Searching for the original identity identifier corresponding to the second target entity according to the unique identity identifier corresponding to the second target entity and the second mapping relationship;

[0247] Sending the original identity identifier corresponding to the second target entity to the target data source according to the unique identifier;

[0248] Receive the authentication result fed back by the target data source, and send the authentication result to the second query terminal.

[0249] Furthermore, after merging the plurality of identity entity data to obtain a plurality of unified identity entity data, the method further includes:

[0250] Generate metadata corresponding to the unified identity entity data according to a mapping relationship between a field value of each field in the unified identity entity data and its corresponding data source;

[0251] The unified identity entity data and its corresponding metadata are stored in a target database.

[0252] Furthermore, the method further comprises:

[0253] Receiving original identity data corresponding to a third target entity sent by the data source;

[0254] Matching the original identity data corresponding to the third target entity with the plurality of preset identity entity models to generate identity entity data corresponding to the third target entity;

[0255] Determining whether unified identity entity data corresponding to the third target entity is stored in the target database according to the identity entity data corresponding to the third target entity;

[0256] If unified identity entity data corresponding to the third target entity is stored, merging the identity entity data corresponding to the third target entity into the unified identity entity data corresponding to the third target entity in the target database, and updating metadata corresponding to the unified identity entity data in the target database according to the identity entity data corresponding to the third target entity;

[0257] If the unified identity entity data corresponding to the third target entity is not stored, the identity entity data corresponding to the third target entity is determined as the unified identity entity data corresponding to the third target entity, metadata corresponding to the unified identity entity data is generated, and the unified identity entity data and the metadata are stored in the target database.

[0258] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing program code that initializes the following method steps: obtaining multiple original identity data at multiple data sources; matching each of the original identity data with multiple preset identity entity models respectively to generate identity entity data corresponding to each of the original identity data, wherein the multiple preset identity entity models are entity models pre-created for multiple target entity types, and the multiple preset identity entity models correspond one-to-one to the multiple target entity types; merging the multiple identity entity data to obtain multiple unified identity entity data, wherein the multiple unified identity entity data belong to different entities.

[0259] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0260] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1A device that provides the functions specified in a block or multiple blocks.

[0261] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0262] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0263] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0264] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0265] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0266] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0267] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0268] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. An identity management method, characterized in that: The method comprises: Obtaining multiple raw identity data at multiple data sources; Respectively matching each of the original identity data with a plurality of preset identity entity models to generate identity entity data corresponding to each of the original identity data, wherein the plurality of preset identity entity models are entity models pre-created for a plurality of target entity types, and the plurality of preset identity entity models correspond one-to-one to the plurality of target entity types; Merging the plurality of identity entity data to obtain a plurality of unified identity entity data, wherein the plurality of unified identity entity data belong to different entities; The merging of the plurality of identity entity data to obtain a plurality of unified identity entity data includes: Performing semantic matching processing on the plurality of identity entity data according to a preset matching algorithm to obtain the similarity between any two identity entity data; When the similarity between the plurality of identity entity data is greater than or equal to a second preset threshold, merging the plurality of identity entity data to obtain the unified identity entity data; When the similarity between any one of the identity entity data and other identity entity data is less than the second preset threshold, the identity entity data is determined as the unified identity entity data.

2. The method according to claim 1, characterized in that The original identity data includes a plurality of fields, and the preset identity entity model includes a plurality of field names; and the matching processing of each of the original identity data with the plurality of preset identity entity models to generate identity entity data corresponding to each of the original identity data includes: Matching the field names of the multiple fields included in the original identity data with the multiple field names included in each of the preset identity entity models according to the preset matching rules, so as to obtain the similarity between the original identity data and each of the preset identity entity models; Determine at least one preset identity entity model whose similarity with the original identity data is greater than a first preset threshold as a target identity entity model corresponding to the original identity data; The field value of each field included in the original identity data is substituted into each of the target identity entity models respectively to generate at least one identity entity data corresponding to the original identity data.

3. The method according to claim 1, characterized in that The merging of the plurality of identity entity data to obtain the unified identity entity data includes: When there is a semantic conflict between the plurality of identity entity data, the plurality of identity entity data are conflict processed according to a preset rule; The plurality of identity entity data that have undergone conflict processing are merged to obtain the unified identity entity data.

4. The method according to claim 3, characterized in that When the preset rule is specifically an automatic processing rule, the conflict processing of the plurality of identity entity data according to the preset rule includes: Obtaining priorities corresponding to the plurality of data sources; Determine priorities corresponding to the plurality of identity entity data according to priorities corresponding to the plurality of data sources; Delete semantically conflicting fields contained in identity entity data other than the identity entity data with the highest priority.

5. The method according to claim 3, characterized in that: When the preset rule is specifically a manual processing rule, the conflict processing of the plurality of identity entity data according to the preset rule includes: Outputting and displaying the plurality of identity entity data; Receiving a deletion instruction, wherein the deletion instruction includes a unique identifier corresponding to the target identity entity data; The semantically conflicting fields included in other identity entity data except the target identity entity data are deleted according to the unique identifier.

6. The method according to claim 1, characterized in that After merging the plurality of identity entity data to obtain a plurality of unified identity entity data, the method further includes: Clustering the plurality of unified identity entity data according to a preset clustering algorithm to obtain a plurality of clusters; Outputting and displaying the plurality of clusters so that an analyst can determine the entity role and / or entity grouping corresponding to each cluster; Receive entity roles and / or entity groups corresponding to each of the clusters input by the analyst; An entity role field and / or an entity grouping field is added to each unified identity entity data according to the entity role and / or entity grouping corresponding to each cluster.

7. The method according to claim 1, characterized in that After merging the plurality of identity entity data to obtain a plurality of unified identity entity data, the method further includes: Generate a unique identity corresponding to each of the unified identity entity data; Extracting the original identity identifier corresponding to each unified identity entity data from the original identity data corresponding to each unified identity entity data; The first mapping relationship between each unified identity entity data and its corresponding unique identity identifier and the second mapping relationship between the unique identity identifier corresponding to each unified identity entity data and the original identity identifier are stored.

8. The method according to claim 7, characterized in that The method further comprises: Receiving a data query instruction sent by a first query terminal, wherein the data query instruction includes a target data format and a unique identity corresponding to a first target entity; Searching for unified identity entity data corresponding to the first target entity according to the unique identity identifier corresponding to the first target entity and the first mapping relationship; Performing format conversion processing on the unified identity entity data according to the target data format; The unified identity entity data after format conversion is sent to the first query terminal.

9. The method according to claim 7, characterized in that: The method further comprises: Receiving an authentication instruction sent by the second query terminal, wherein the authentication instruction includes a unique identification corresponding to the second target entity and a unique identification corresponding to the target data source; Searching for the original identity identifier corresponding to the second target entity according to the unique identity identifier corresponding to the second target entity and the second mapping relationship; Sending the original identity identifier corresponding to the second target entity to the target data source according to the unique identifier; Receive the authentication result fed back by the target data source, and send the authentication result to the second query terminal.

10. The method according to claim 1, characterized in that After merging the plurality of identity entity data to obtain a plurality of unified identity entity data, the method further includes: Generate metadata corresponding to the unified identity entity data according to a mapping relationship between a field value of each field in the unified identity entity data and its corresponding data source; The unified identity entity data and its corresponding metadata are stored in a target database.

11. The method according to claim 10, characterized in that The method further comprises: Receiving original identity data corresponding to a third target entity sent by the data source; Matching the original identity data corresponding to the third target entity with the plurality of preset identity entity models to generate identity entity data corresponding to the third target entity; Determining whether unified identity entity data corresponding to the third target entity is stored in the target database according to the identity entity data corresponding to the third target entity; If unified identity entity data corresponding to the third target entity is stored, merging the identity entity data corresponding to the third target entity into the unified identity entity data corresponding to the third target entity in the target database, and updating metadata corresponding to the unified identity entity data in the target database according to the identity entity data corresponding to the third target entity; If the unified identity entity data corresponding to the third target entity is not stored, the identity entity data corresponding to the third target entity is determined as the unified identity entity data corresponding to the third target entity, metadata corresponding to the unified identity entity data is generated, and the unified identity entity data and the metadata are stored in the target database.

12. An identity control device, characterized in that: The device comprises: An acquisition unit, used for acquiring a plurality of original identity data from a plurality of data sources; A first matching unit is used to match each of the original identity data with a plurality of preset identity entity models to generate identity entity data corresponding to each of the original identity data, wherein the plurality of preset identity entity models are entity models pre-created for a plurality of target entity types, and the plurality of preset identity entity models correspond to the plurality of target entity types one by one; A first merging unit is used to merge the plurality of identity entity data to obtain a plurality of unified identity entity data, wherein the plurality of unified identity entity data belong to different entities; The first merging unit comprises: A second matching module is used to perform semantic matching processing on the plurality of identity entity data according to a preset matching algorithm to obtain the similarity between any two identity entity data; a merging module, configured to merge the plurality of identity entity data to obtain the unified identity entity data when the similarity between the plurality of identity entity data is greater than or equal to a second preset threshold; The second determining module is configured to determine the identity entity data as the unified identity entity data when the similarity between any one of the identity entity data and other identity entity data is less than the second preset threshold.

13. A storage medium, characterized in that: The storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the identity management method described in any one of claims 1 to 11.

14. An identity control device, characterized in that: The device includes a storage medium; and one or more processors, the storage medium is coupled to the processor, and the processor is configured to execute program instructions stored in the storage medium; when the program instructions are executed, the identity management method described in any one of claims 1 to 11 is executed.

Images